Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
cef5925340dde65df322a24c56ae96bc_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cef5925340dde65df322a24c56ae96bc_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
cef5925340dde65df322a24c56ae96bc_JaffaCakes118.html
-
Size
5KB
-
MD5
cef5925340dde65df322a24c56ae96bc
-
SHA1
b1a1e6b873e7944d065aee85c9d287b82c439864
-
SHA256
956a19275d5683fe7a82042160bd26ef9dc0869e139f925dcd03b4153f39bae5
-
SHA512
270b42e3b43e84b4d5f287a5fa3f9f0e7e6afcbf320ac46e19b21467b8743c4cff88231a674162f7318d25c7e40be132ff691525256dfc3cc68d7960562c4613
-
SSDEEP
96:xXNBSLkPgtPq0NxgF5mfuuz994OVMGvIQmtJm03:pNEk6Pqv5euuhmOuJ5tJm03
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0716a772b00db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000900dbeb590ede96c26c65ffc2cdb479e4b660e9a51217e07c8a1ea525f04b264000000000e8000000002000020000000c36e7b86e7850f97fac35d666aee307594fc38e87f71e1a44eac55d5c330a57620000000116dfc9ace2be5928ae30c03bb97a16e3c63153d5b21788c2d0a01b430e12bb24000000071a97c42192c22db782e906dedcdac3335f3fa78a6403c8436b08d1262045138a8511f552e2a2fc46e442a777ccd42bb7d674153908143f213698793e1dcfdc9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000639678c1895d55baad9cd5f8a898e8eed5aa56da878d97d31e6af895d36edff4000000000e800000000200002000000044e32d1dd552141e6840b0c2e3220ac233020de8c693131aac893cfe0ec65dcd900000008eb29f8870b3806b26893786ae0393bee0602992585b685aba6b9ee17c8ae0534c16016358d61ad75f3fa792633b267b45038718f48c7448d0ead36cdcc0cf0a138aee8647fc79669782b73dc7db798fa747165297927f0c43f4acdc4b290a5717478f93c7896f151b5563060bcb965d22c9c3ac19969a990aaaff5c12422f7ad25bc5731065c2ba57d1ad8670c756ba400000008dbc17fbb2f323465d6c09772f75b5bb5f24571a3d81c7d219ad99b18bd8281fa7793e193632ddf2e1c3556100a5c069c0fa15d9f91e282fd3cfae44cd190ad8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431768294" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A03281D1-6C1E-11EF-AC2A-E6BAD4272658} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2432 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2432 iexplore.exe 2432 iexplore.exe 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2552 2432 iexplore.exe 30 PID 2432 wrote to memory of 2552 2432 iexplore.exe 30 PID 2432 wrote to memory of 2552 2432 iexplore.exe 30 PID 2432 wrote to memory of 2552 2432 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cef5925340dde65df322a24c56ae96bc_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3822ea50255c3122537c1b2b176c995
SHA18b605ebce84d266a1e5ace879a9e6e3b2ebd7cc1
SHA256cf330372ee85fbd514e45f16f80351a6d929bee785ede2cd0a2a5029d187f97a
SHA512559d769f381c4f1beee5a593f3c57f584a8b2fb98685006c58fcca44b7f8b86ee4d3a2eba86cce29128550d481b1db48e279fe1c4322d230d42f3fbb6504e8a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3ab759fda0844d1e87a271efa310b0e
SHA18dc1da37f3f7b1e5ba77d3bbd65e84d345d6c8cf
SHA2564ad26b9bb74384b1faf8b6a88b380133285d2ceabe89f975555381c1cd11432d
SHA5128be43a467879dc982b594d2b8e967459530584002d418bb37ba64477dc2dfbd5249cad44224a7999a4976641d905ddd74e742ebb68eb7e095d347e65d83f1457
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7c1cf3cbe05b61ad8f88f8b253ef64d
SHA1534288ca464fefb8b02e9ec26be55123e6106537
SHA2564cf622510179995b65a0406fa5ea06114a6823ff872915e0f97384d2899da289
SHA512e59f862e401cd2b338249c49ca7f956f95201a109c1d38eb63f2904cba576feeb149c254e9cdb2890c07fe9338b52414ad39eaed4164d55f2a3f42f03c591f37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD545d02f151df770ac26cfee9019837fc3
SHA166ce5133a7a155e079c642c6d9302046f71a699f
SHA256f7be9d7e8233d58f67bd4fc6a3e43068d3cfc1ebaf467eedfe3716dc691739a3
SHA5128b142d65d726b32209bc89a92c9a6f06670cc78f7bebdc0d17d5cf6bc1e649e0fcb6443def476d8a38e78995e9830ed56c15dc4757fbc802532ea66fa68990f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a3a0809806a52c6f0b2df7364b4ae63
SHA16da7fff8ccd0136b086bd024163ba7c1a81b87d7
SHA256da1d3a0a4f4ac8c93ea32fdcda08be0b2167f90c8c16ef889a81b8d2b7efecb9
SHA51257d8e194a716210524822d21cbd9781cbccc2470617386814501c439eea38f2605418b20e70b5428874b80c527b1ab13701319d5543c885cc7f5839a430cc501
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad99b51ca83821a034a29fcf91e1643b
SHA12bfc8326f4634a21ea9876c06dd299bd0e9c280e
SHA256d486a370a337cf73738c44bc6bc6ee47816e94e2f2895d7be2fcb004cab2815c
SHA51226d50246a366c382c88ce4556293bc52b31a0487766eed0645685b986c4149d9ead9dcac1890095ae4399f2a61ee4c83b389de591711bc3ab5ac3933be36c25f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ea91d5597ee6393269677e8eb215dc3
SHA13b2d9633240cbc1792541c30493158b44e0a6790
SHA25637a3481ad18d244f6720cfda19cdfa09187b8b6034192732f58160934e5169d7
SHA51223ebeb07aa7e763028ce62d42a6ca1501bfd8fa8d970358fe3d6f711f98e7ad034e92c89c88eff22f8daef269095dd58554b0e2d47d96ca12561f950d25eed57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b9b4458e77043a3a58309a16427abf3
SHA17a46f9b5a82ff29ef64b3c4ad7483f5c0c9dc309
SHA256e60424e6bcd249ca06ee914f91b887caf9c9ef2c830fae89360872e9b3248cbe
SHA512bef8f673c4e973aac6ccd16e6f1c52df16da291a7a7c88a2d94eabb4a3525afdb737c9712735f6cd50a6222d47431c5ef07e8aa2d0bc7cac3018b42809486c7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599df4ee69aebaf8cdd0ffdfa9893ea45
SHA1f460207a79395e6341c88cc3270deed40c321b0f
SHA256e2e78f70579476dfe488778e9c987f74efdc7752ca18c96c693ff49be82d78b7
SHA512c2655dc3636d422fa3093ed5642f9b9004467bb87a305b3f028d44da32d5548b03a34122e63684a46b635333b686600d7add431cf5bf993839fb67986225a9a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cd679c09f80df7696d27c2278a179c2
SHA135afa2b4fade9b8bb9a85c800b9385172dbf1bdb
SHA256630eb8f9be10e2409389ca346a870ad9c4fad056540e63bd6b3d111a1e68de65
SHA51247a51b9380cde2562e13966ffe38f23b8f899d10ac768814e08c2306337932da6bf56458bd0e2c24e4caf121488746b1ad18a40e80c16c7b7745dc4f5f167fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509443c4e159ab27561e78260c1d39420
SHA14c966c0e2f3ba0e1a9dc5a33f830bf6ede045929
SHA2562313cef1b816cdf76827f918e42b016ab360bd9a7c9d3052bee167ab8f970b3c
SHA512b769b0ef6f7efd99e9e944988e63b5624a77c6924df990450447c5923e94b48018d0b4618cc052b211fd52e04c4a76bb6397dd000d47f46cbe8a3c91b584f1f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7e9a62e3f35db8da80e6ea3de177c9e
SHA1aeb94118357ea4fc556f21054eb6fbc4e84c02e4
SHA256df347b014e9a43d2000410082316d41ab80a353f0e3c08251d9b57d39ce28a0a
SHA5127b28d6afca5c13b415caf7f3b3413f488a4640f71886b6de47f1db2fca7a2ffa4c23c7be9ba294b939228041b900b487f6e715a826887cae0a77162cb5c6c9c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f079101937d03e5b3c239dc8c502bd6e
SHA13424873a2222d790dcb8d0243e4287152957a9fa
SHA256173035ad3f850bfe39eace28e2c888f504021874486c8c7c1733f9dd6ba0b1c9
SHA5125c37d071d78dd812cfd51d4d12fddf93d3873bbbe8610a96db1f2935d7723a56272302dc5b4dd98efbf75328b1c0a793f0bdd8c1fd3b337e7fb8fdced7c62c34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea4df05fbf13ef6c1b382771947ad688
SHA1c7983c892c83142fb495b0632cca515311d34fbf
SHA256bda8d3e7a023288eec1560b2de0a144461cee8065eeef3ae059be9bc217771ad
SHA51233b0ffbe1a6df499f83646be451f2c9ccd1474703bd0ef0415fe39a8c972f743183557bc046260b63a110ec86ca5f45cefcbfc5f05e8ea99812b1983a2131e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cea652013b809bd1d40d6d1228e88c7
SHA1e6ef6f3c1b6b80b193b788ad1f5e3832b46db5e9
SHA2565e768179d85a8dfd88a8d20152cd107c87cfaea73f348a4c4985c5e070642efb
SHA512344f1af3bec482000c1aa33f0dc58178ee276bf82fc53f5d456ceb8f06e22051062bd147a1c8a4b0ca660672631ff7c5d619399a06527f22f64f94882ad7b094
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1bc5db3d1a09025e433388db1ba0af6
SHA13a04daa93176540692f31370726c71161b0253fa
SHA25681907c6db18a4a294b9c13108746a0092b9e49ca28dfc532d7b398d35fae79e9
SHA512442ba2a38ba76d4e04642cfa4efa0e922d136c23ef61db56f557686583d0d7149b1d16de8c7ebb01eda712ef05c49e3b82c5b760e63c2cd7df6edc34b74979e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa8b88329c6dc7788e20cc8a69e5ae92
SHA17a6f468ed3f466522a5e817b73249d099891f79f
SHA256a1974b41444a7bd269cabc23b850e1b2a170fffb0207d1002b1dc1c9f2123777
SHA512888024cafef1c8d6e9927c7749a04a26b38d1a9f6a081ce9cc090a02df3d8b470c939c3df8d5c71dd37f379450126513fd2a9180be2cb64be8c03795dcb02c3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51326bed0fb640c06a14521f018ea377c
SHA1553cc682cfe396777ed6f764a0530e4abd84dc4b
SHA256db25f1703d0322372e4770a964a8aad0cb35734c06b2047eb5fdb14d3cbe6c43
SHA512fe57433cda5eb7c1400e1e9594ca0a061c7cbd6b27db05f2e58878c5f911a65898591b80542e319524ee5eff26da4daada9847a296b06d253d3d697f2e36c496
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b