Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 22:20
Static task
static1
Behavioral task
behavioral1
Sample
ce0eaedc0134d8951db01be07eb28029_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ce0eaedc0134d8951db01be07eb28029_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ce0eaedc0134d8951db01be07eb28029_JaffaCakes118.html
-
Size
13KB
-
MD5
ce0eaedc0134d8951db01be07eb28029
-
SHA1
73018d0d4ced0d87739c596eb8efd42fa7264637
-
SHA256
41690c7336b87926e1ec870f919de41dda82a59a3aad44cd3af5e67cc34edcf2
-
SHA512
ffb7b25be6c406ee2c9666967f6c9f41ab76ed947a940e091159fff5ca963495ff3724232e17c403eedd811dedfbcb331897d0cb17ae65ac7bba22d955c2b851
-
SSDEEP
384:Fa9hM6iE/Hxf7OSjhth2ljxHyy0NnHP0G7yiqfZWv:YFiqmjxNG7zv
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000080183f88853c4c6d9b4fb7f7b0512e4949d05de23b71e69372af6f0df9374324000000000e80000000020000200000008c50aca5cf9191a26fd6c555971124f60ba51806457ea306e4c1a9c67b5a23bd90000000aff816e91cd9b16cc5f9a85e795a41ed97075a8a99be2b16e55208e24e014b5460533fdb83ae1144299f296d4fe1588a63379458b30406c0f6a549f502dcbe2ff68c45ff0073949e51ab32082ee0b48e2c05b8abebd3edea1d67a6749d4f73e1a1930dfb65c5983f0806fcfcbf02de76f4751f6da5df70d9124701ad19c9da11c14373b5a5568bc8b83004f1adcab0c3400000000e4e27ae20241a937d45533cca9bef65408013eb24674273b949871d9d0bf7c74d3e055e88e813716c9d7a27901252e1ab6227d7f0d9a3380116e4f279034413 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431736722" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502b00f3e1ffda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E568741-6BD5-11EF-AD58-7ED3796B1EC0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000070384294cdc9e42e010218aa645b2bf0b9e51222268155252fe8fb3e90415489000000000e800000000200002000000070c38054b57daaf4fd763178c4931e0196b1166ed844a89d0591733f8070457820000000227800b221685d016a723b77afd9701fed8fb0ce00d48ee4916596d53a856885400000009bfc9ea9ea7abe089b20463bd2cd844d66fc99c7145f4300323b890fbb691888d46e569f874099b4f3f5ab7c1ca587703e8e4ff606059700f5b4a2ff21bcb3fe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2856 2172 iexplore.exe 31 PID 2172 wrote to memory of 2856 2172 iexplore.exe 31 PID 2172 wrote to memory of 2856 2172 iexplore.exe 31 PID 2172 wrote to memory of 2856 2172 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ce0eaedc0134d8951db01be07eb28029_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d98017b71f9b7af211ea67dbccad814b
SHA1887fa4b79c48431694fc4e2887ffcdd5d42ebe9e
SHA256e62fd2c651cfcd5cdfd0a0654c130247cdd1ad1ce4ee7faf4a7b87817f7fd6b4
SHA51249461fd546b184fe9a99e0c505463f70c86e5a4734067ec58f432f8f5660eaad111e8448960ae4a75411c7d92300e5bf944a32029cdc42b73434939f6536aa98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f2d54bfeed3b44a14a10ab5725a2381
SHA1830bacea30ff048765edee7aabb5c1e668ac82ff
SHA256a7bc41fcbb2d4a549e28bb3157c179a97a7db2ce1f2433010593f4fc46ae1f4e
SHA512c97c855e62e3867f4f71e2a2dff4af2a9c45ad8491111c7c2a1280d955ca417df15680e565ee97201a21bbc9f1fd65d4c1f17b32af6ea6c4700930848f08635d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e249703c666771ff5a067a313c5f90ea
SHA14de03fe359963d8530ca83b2c3381a1507e486a8
SHA2564345d0e8e4e1f7864706174af24069822bfa5c98af32d390ac9b43ce2ccdded1
SHA5125c195c108ca4317f3c5cf7fe7ef8e82f06633eb3add5d8530da9628227294504754c240952e819a95bdeb0f8c8c8a37ee2b529ad74749bb98e2a5877b9b3655a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d522de2b26372ef69d48ed476ec21f6f
SHA1cd16f2607b5d4ecf9e03564a3934b39cc513b5c5
SHA2563e6d5f1649fb366b5c0bb04915159fcd21a9fd19aa326d2e695bde3235125d36
SHA512b8dc1e7d6ee115498dbfabf35ee8838b6bdde763d22c4f962b63d3105abb1440bcc50c48bedd6335645bfd73cbe7d11949789bab8cc0a5a103472878f220f928
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ea64f150c0507ab459b042b5d110324
SHA1cb99348551ae25a61b6190494776bb92e2d21b05
SHA2565b28558d6b6aa6d3b4f90aa3e262997f2145496cb6062c73ab273a2e6992e7c8
SHA51220b311c0ea0a65f6a2300f2661203734978bb78e70b7cd8cc257453acc94d9fa909f2bed1837ba5254867da563b72986ebfbd2ea8399aead82306a62defe1c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9e1ff0169d8a3814a6e0e95b439648c
SHA10792ef51b0ccc83258298eccb242c41f1f099f7d
SHA256d1781e8c5aa78777ea9b1f0e37b925c5d43559e1189aef5fa976acb7569ad963
SHA51280a98e88a979c25019e4e0ff3ffbf41891b19eb17e66a24049ec4f1233572712548e95f0911f23e3f31ea9c74a68578d5514d43de79135f7f88edf2b32d8897b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e87d61ab278e0118a62c2b72bc5e044
SHA10888ac5fc4ce44abf83ac67f16a0deb9d499a27d
SHA256bb84970d14545b73388ea74eb6055dba04922046d5d0dab64ca6925a09f78ef1
SHA512dac30b0210211affb55a4c3bee2567759f4eb08503b1793d63e9a9290fe9c77218e960b1f650de0339eca1eb1362d41b497f0080b7e4d4637cc0a2c78eac5e2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d01cfcd32ba365c4e9b437150c6ffbae
SHA1408c2e2bfea387f92014a2622ac4dd48771478f4
SHA256853cba52874af4dd1d2feb1d4aca15aeb10adab4ea127949dfd9956011993f47
SHA512fef70dd65342f74de44c695ebdc06e16424727eeac6d2bae9ac9b0e1c3737bb84b897d6365ba8de0fc8e24719105e94097fa63d0c3b28eff2a7ffd8c46caf667
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f95b06fed3da752ebbaf71bc7aee740
SHA11b8d289930485347f6d000b886ee8c6e2a68d793
SHA2565129a2e1c1eae13b2ed1b863822a2aecb61c2394d0e257ed2f694109ead90ef2
SHA5120f789c878f6d19cf325e046c02d74ac7a9a67a89c86a0708439c24d19e0cd863655a25c5af0510360c3ef2c9556bf0cd967a18225dc64444c974f498e372ed8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5842c5a176fe81d3c74db8f31955852f8
SHA1f0220d4783786db21152345f70a7ba8b0e0a4845
SHA256e52eadfb5aba513813c0a6335944eeb1d00f7d5a85eaaf4c2ee3b95c785f94c2
SHA51202982573a2adf3d6b8c37b4d89e17e8366bee48bf154d0c9a4d257ea4d88a2e3bb81d8f43ca50f38c9998b75739f52aaf23a44ecac7d7413eac15e7443de259e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1e693c4e44326dc399431f1ef522f52
SHA165198b4eb33694da2838d33c9ff3808abf39c417
SHA2560424fa6ad3de114aa1ed4cfbd648a77ecba6005d5287da2ab492fed6359b1f63
SHA51212a04c01ea156d27d9a0f9be08b6f242dbc1b44d4c7151713b9f90dccb0ab4705cbe21c9d766df9c0528e4e56ecfe73490c5412046cfa4024dbb3f868a172a7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c102d700516bbae10505620cc334aff5
SHA16fc5ab736829091612306cbffc249a1540adb163
SHA256b14a9742f20998e0b3cffd94e5d2787cef8675a4bc5fb1fa499e7599d21d677b
SHA512869780099b1fb4628b73a91d4433f9081a0565cce78eb242703307cbecdef0498891adc8d851d6184fe8f1cfed4ab8af78f2eab76406e5689a568bfe17aaa7af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5401319cde156cd3fe1769cf3cd08df8b
SHA1483504060f82d88dc7c33338079ab944189ec898
SHA25693778a05237bb5a21cae56a33942e788ad084c201628734bfe3c9a76a689f5aa
SHA512a12d44dace52da9c27a0394e09e08ac59a8827d6092303efd9c1071f5e827e0e4cbb881e5607104b5402aa20bf8f79f81f2ad2599d131372d0ab6edc15098c04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bda3e007ff3d3814b0bf20f7167f1f4
SHA1d582acb79c8391feb461ae40a906807abd896486
SHA2565364b6028882b9cfc48d696afe81c1be0b8c43bd7d7fdb34427a57ff8c943ff4
SHA5123aaedeb0f6b86b6ccc8d4af7850a7373e82a5d5b786e2601188a6b33cc25268abf1ab25567f6af60c14b54b9ed447375d87ad6035e1780c9eedc49f366d828d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a605cf38fddbd16012dcb72f0402c2c
SHA16820fb099db6a902c70d52da15c921ce72d77b0f
SHA256352c8c8a1e800ac9b46b9ebc828b3f700ec71e632162e4772f5426a4120971d5
SHA512f5448c98fe825de4ae720f2cfb77ed74f23ddbb7d4ff6e3e59c677ed03b090b45240528dafd143ffe5995f6cb795078fffcd4b832a274fbdc9ff0ed4ec5f961c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592d28a4507b959939e89cb63528d7cf8
SHA1561e86ffcd5d021656804cfa6fdef1c3ea55901a
SHA256f236251ed666b75ed0119025906c6c6887d014469b05d07cad625378cea10923
SHA5128e0d767658f4240a1b9fae7f5a984b9f6179f7882044ca09ea8f4f19a8cdf059a9195fced5e4050c5d0e0bd93d07f2cb9ec5d01fc42b1ba12bdbca93d53ad75b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f74bd9599687569b6b2690d186081559
SHA19366f8b4cfbda850d68e262a7cf335497b1163a0
SHA256a70bdf3192c78c3187f81c2691fc9eb044def5867d5ca9ec3018db4e45d8d0a1
SHA512627cce42bc5978475c8859cfa2aa5d67a7d5ef1a303dcc05fd99e9177f4fd2b51d2aa96addd93d86a2246997a2700caa70e217756083cd2532456366f2711c12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c5e653f1d64f77c00ec1bf8cb79ee34
SHA1ae3d943bec7e34484b8d380e3d19161a57de9328
SHA25674f2dd00b66b36f6b481c266b69cbe886e3a2218d01843deb5e65ead4e8c68c8
SHA512995fd7136f35d00a29f6385b070d2333f482a9bc3f93241231af25c69e17c25027e887fd66faa409b19f0c8204487afcf2f871bb8760bccc9008103bcb815011
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b