Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
cf4f96e6e19fcc2a1a399826eb0f9388_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf4f96e6e19fcc2a1a399826eb0f9388_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
cf4f96e6e19fcc2a1a399826eb0f9388_JaffaCakes118.html
-
Size
4KB
-
MD5
cf4f96e6e19fcc2a1a399826eb0f9388
-
SHA1
3c98fa8fa728db0a33d28dd34957a38efed7f0ce
-
SHA256
02a5053fd02b084d6722f00e0fbc66faf84c6b7df4fca25f025dcc7ab6e34836
-
SHA512
cca2bc983e6a5667545dafec145af6ca8627fa5732440cda72d7a564669c91f1b5e0501d6dc66c3661ffdfa26f7c5b3ffd5e19361c8bc0bac3d27fa00b0c5b46
-
SSDEEP
96:VGWjLUx2TmyY+H2LTp9Txg9t9+KEhp462YVJbo2:0yUx26na9tpIu2
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431779593" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000ba0cbbd8377dce4385db69b4630d5cad7b5d671dde8c8f39e7f039f60088254b000000000e800000000200002000000069e415755889d8708ca0dfc937553377cf175564078238dc2c3cd50dd39d51a320000000ba0c338e84382d214953186b718543fdcfaec8c8201c24e14ad4f30147654e9140000000ea4e55d71b83529f3893b72021cad71388fdf3e5536e201b4df841b539e9eb34495311ae35a3f2db6f0625a17ae449015614c8bf4d94ef2e5c30af19696ad2da iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402663c34500db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EED67841-6C38-11EF-8C8A-62CAC36041A9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000004d0aff78166e320dd81b3cf87ffb6b889912c1da85c090d3af4d47888bdd93eb000000000e8000000002000020000000db5e99bbab695a0fc5b023e8a84a40f9370049ef4bb00313ef30ea12d9bc059d90000000729d4aae5b7c32aa101eb3275af35f3de4fc282c17ad7370a74a88ca88b77011409d4a57690cf966c5cde1532764a0b51eaf109c49c9fb1c87e21bb89b8126a9f337e42d891eef6123eac032f63854c50ed1baa4804da7b6f7527eeabfb5eeb8ea15057674942da5d841d07adcb62105193000407aab1fc04e75572891a3108158cfdb686215575905b1eb3fa6c3a7e34000000069cf031ff83446c33cc23ba074e05d842b57464529dc141bff7609c9bd6ec7116d47708b5da48c626720b2eb30960d78897e2e3296dd1c7fb61b72e86f28585e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2280 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2280 iexplore.exe 2280 iexplore.exe 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2664 2280 iexplore.exe 30 PID 2280 wrote to memory of 2664 2280 iexplore.exe 30 PID 2280 wrote to memory of 2664 2280 iexplore.exe 30 PID 2280 wrote to memory of 2664 2280 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cf4f96e6e19fcc2a1a399826eb0f9388_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52203a5d0fa109a2b24cd7e1f4e24bf3c
SHA1ff33c3e950f359373b4c11f8327d0b55c219a544
SHA2565dff60a415722eb3339787e33fbeae1d5c8f33b707a051704fd3e37f62557869
SHA51289f3961056a2d4d51a19375d3fa4dd017ecd4d48b37e1e264dbe7a9a848c4d8b0cd7223413749e0865fdaf1756eca7ab98191b7636c02734057ed1cbc550cbf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5225c558e1efabe2741ac86f723817552
SHA1284d29952bbcd3f3f95ce266f1fb378b7f233071
SHA25604fcaef909b9a4307ee4ea90e2875f01680b3d515e0f602f5afe248dc57d9dc1
SHA51232d22db131c484d0654159664ec23616fc0350620dea212689516a619a9f6d7bd3c176d520e215c90e95cfbc835be4925c4f4c49b278b2a69577af0f6e0404ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5279459211351f7f16f6314d1226199ed
SHA182cda02de5344e00b0123139bff06c53dbb5bdf5
SHA2564e3a3cf8cb30f914dbadc4d811a6f22d4f6c24e99203ff80c095e5f0535f3e15
SHA5124558744ddd5a99663ce54c1d2e068f9a360dd2fbcb93015bb208fd7033e5a03e3504841f8dfcfb514690ced7ce57e5b97c00d0fd3ccb67379f3ff3e718360b87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb111da3f374611f44277365d4380ce6
SHA13ddfeb6364b19492a3f3e35052f6fe604de75006
SHA25603875436967fb25274ff899fc0f0c7e9c1295bbcb06afe21cf24bdb5e8ece673
SHA51214ff5280c9914c095326be82c5b564624308eee0a918d8b48ee4b95538488bfd77ff3cd8128b14bae8c46ebe1a033f0479d28b3eabc08121ae86f52c0c5b2143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba7543e85109f6eb5883a5547221a689
SHA15a86dff5558bafdfbf3f94835015bdbb7818713a
SHA2565e1997218de005be5f0b84f1f0019d6c55d150984d8d67120fcc8c999b380033
SHA512ccc43eaea327818e18077a6648c421537025fc5a81cb734df4193f08c72bf5a4e42b89e4e3e5e235219bd52c496211a006d203763f404289c44cabf9a290554e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504747ddd7f83beeabe069a97a69fad00
SHA1c1bcfa12eb6a02b10089e02d89d75e74cfb8e70d
SHA2566e69d538687c162d7f52d4caedbcd2cb049d2a5a7815aa9d9148c80d140887ea
SHA512dbda5de92a82c9b649f19424967538c384c4f33238a9fec46101c6b73c8c236aa9724609e275a838ee944e9fd4d37f7c6d1d7c67399294fb4a97680aa393349c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596f293631418865c09d3d3c96a2cbffb
SHA199db799b5528f1604d63f8ce0b4491edbcbfd78f
SHA256afbdd29183498951e641cf7e50bb249c02fda23771e379d170731e6fa0d21453
SHA512dbb5a5ff9a3e3be4f27406f47293bbb6656c2eb9c52c3d8b7295d35d091ff9fa944abc630a23e95d3275fc10916f254452a44bb7c83f9d1d8b3012443cdc234a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597fdb6a18fef5319ecd862c0f4e4a20f
SHA1c5d8dc26cf39084c6be543d1103233e4f678a275
SHA256d4f91dae7a9693b20aee312b7e30706bd2c28c1a83fbd7be743ae4d90cf4f40b
SHA512fd745296f716c781e2378aa53025dc1fdd79c89adda77b50d31a20fe69531edf863b8f78a038e6e9c872a4a23a68778619dfac89f56a16dc0b2716646c5b82df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522b5e7dc8732dd426eb73aad30c43123
SHA15e1755718432349efad73537f9228dd48a2764cc
SHA256887d0f6d99c7616de5608492b1c0b3b026c7b0796715e0321fe3e082b3ed84b0
SHA5127bc4dc3c020d4c9269701230e97e5251b95fe407680b765a80931072d857354e7bb7c234b6eb8350b216963f2eb85a5a7257faff6c1cdc6c70354cddf88e246e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59834c5ec407f7efca34ab4f673b2fcb1
SHA1c13cd66b7427cbf36ebe869762797a903be2f48b
SHA256fa327a1f253d5c96cceed938f1bfadb397660152236709b1d9f558d6164cf64b
SHA512f52eed747bb18bdf02911eae3851d3810de92ab763483d8e51dcf38458990bf96ef08b69d3df9e5e9d6e1a9d98417005f66db00916ff8ad9743e6e5522e95b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57462efdb69220277d6c0c61fd962f041
SHA110fad012a8de4de2e67e27e2d6ede80ad256e16d
SHA2565d74fca4b29813a3200b5fe32ba690a9f35d84df315acbc455bad32b78bee8de
SHA51259bd823842a2721a8a7e59897a30b29b79279cbe3912c31d40ca0d4e631ef97958f84a943bf0d8c8ca0f0f849a5cacb896942fa94574f8f0134df1ae5e38808f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e35a34b79d901474e8a4485f5d277fb
SHA17fb2828e96336b92be305ab59d3d11e8e6ff6b7f
SHA256833309aa46d593a6197dbc4cdc97d803b0d4c2f4723c7b236afa474aaf77d8ed
SHA512a03985fed9319955d874a43ddc00f6d4d8aec6dff7618fd6d2ff650c7925906955c74502efc7051d8db652825cf2e9a2ae7ee66f08dc5211cb310677fe497194
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cddb1152a5cb449171898e5862d6c9e
SHA1e3f854cfe9c0848cdd2a3f5f172dd8344d69033e
SHA256b3810698fd58881fd86c9519c1a770720fa80c3d2802fc655102fe4b98368b5f
SHA5128d2d604c68d244cf265e2eb2227edc71a751af95187ef1be73d1cf608aca48285046b65281ba042359d96f10f89f050514679529367ba4472eee26dfb3d5b829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5446d3ca5e910eee4b643a21736dcb640
SHA132e570459e71c11a33554527bafd1fe120a631a0
SHA2562ab012694c5965aa3eebdcafbcb50e809d30e2340833bdcbaf26d98d50f29307
SHA512658ea1ff7d949d689ed6d7708e04eade542914b0a977fd551695dee4246a5a28e7f89286b6ae1538bbe268995d9d10bcdce0b469add00aa487efe94eee03c4b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ba48bd758d9fc7957a5c8122ff2661d
SHA13a8dc1a8b2c39e87b39b1e0681873ab185ba1920
SHA2561c6afcd4933874f89db323b4e0d86f239a9aafafc29bd169d495f97cdd5acb5e
SHA512932d5296e20f7092c6e2c6757a71d97da892ac5c5376d040d1ce01be5d1ec102727ab677c6c0ee422ae9a339f6e46306630f1ecb91efdb6dbf9373b390765d73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a33e56bf1f6eafd330f7ff91e172ed42
SHA1fdf11a2d33de06b58262ac7b3430d4db1c702bea
SHA2568ce0fc4a9a45390faac219089219ea89777d5c5dd4850f05cc7eded9ce8f8f41
SHA51234316cbf8d19c9edb7c8f0875b6e9cf429c1bcddd48c3fc44d92a1454bfd500dc0fce04c57ca39578b7df059cfd69520545dc58ae9d1f3e33654270d8049ec97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5680933a02d8edf6290cc621f2ba4b66c
SHA14e0774262937103db77d6b59abc92db292f5fe47
SHA2568b3dd0a26a36ac7b5711022da770115d9f9c8706e8911426afa6cf869ea965e7
SHA51297fc9cf43f15503bd47a1c4598de9f929a7d0e2db8a186726fb058d5031e819d6220e2d3c4b8036ef2a845f061dc171c93ab95e9caf7383b36c71098ec20fa6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5625f3cf2249826c99b7b1fde1cde317d
SHA1a561a9a06071d7946070d653b2f562736812e3ca
SHA256b27f8f079ba5a33f31ce80985a972289020c68b5ba98e95a2a717e0c3cec357d
SHA512a63b21e1252701f7044bd0a4d1a4a49cd8f9e40ca248067a5805c4d5c37d81aed7cc1658914c8627e28d52c33115ac5e8a0dcb13d951af11ebfbec3dc597e738
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5223468b80dcc3ff8c4209e8613c84c06
SHA152f25d470f3fd90b8975360b53d06548d553278e
SHA25622892cf617b2456972db6648df6f28ea49289829a37ef6c4ff95008563f34915
SHA512133c131ba0a75e33b69600f2a4e82aa8c2120ab980826e30feb7ff67db501dfa4a88002a9c9d74cea811aad5cce1c0174b765bc0e1b9fbc9179b78b28fc0dd2a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b