Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 15:10
Static task
static1
Behavioral task
behavioral1
Sample
cfd0b507641ffe7345becaef361904a4_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
cfd0b507641ffe7345becaef361904a4_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
cfd0b507641ffe7345becaef361904a4_JaffaCakes118.html
-
Size
102KB
-
MD5
cfd0b507641ffe7345becaef361904a4
-
SHA1
bf6921cecda67e3f59a1a4e17c8cff60d958e952
-
SHA256
97350da386f35f0b4704117345e5e07c0f245de6138d8bba0e172b550930bd36
-
SHA512
b5cccec46fd20458ad9c9fe374f8db89d78d22b011c41bc9e1ce5ed4ff7e3025b1090c33841efe8ee153ade38a98267306de3611df10f797586e24eefb3507ee
-
SSDEEP
3072:S8ZBFWUzEgyVVOmNEBGWTmWDJhdq/E7iwAsLo:SCFWUzZyVVOmNEBGWTmWDJhdq/E7iwA9
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33360DB1-6C62-11EF-9DFD-D67B43388B6B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431797320" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2336 iexplore.exe 2336 iexplore.exe 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2212 2336 iexplore.exe 29 PID 2336 wrote to memory of 2212 2336 iexplore.exe 29 PID 2336 wrote to memory of 2212 2336 iexplore.exe 29 PID 2336 wrote to memory of 2212 2336 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cfd0b507641ffe7345becaef361904a4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5786524618ff6f49854c24ca523ab6e9f
SHA17b11ef56d0153e2c059821a9209ddf8cf25f6cf7
SHA256adce4aa2f8a5061aa2555e2a4ccae569cf122d8c049d8cf077a7c6c2817db8fa
SHA5128ce0616c99301ca89026c99ad2d40a9842f9c14bdaf91d27925aa46e5408b07737b0bdfe2a7cf33205a9c66e1442f5ae09ba7b36f65870a86b0a23ecb1b6c121
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537e50c171bf3d91b21595bbee9ba43cd
SHA13a05625d7c55fb0e4098fb0ea8a3586ca6367ba4
SHA256b6c1b0e808decaeac71c09012ab2850046346a46acc0e7d94b0a7ca6137e7658
SHA5128f74fe86012108b8579863c37f45d0a3466cab7ce8fecb93c3e372c180da54ca05274863c0f548c0cf24b0bbc004015f61df651653e9597c2661c0eb732a4f0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577b319c10c5af6d8f3a72f45674bb413
SHA16c7db115f53f4d1ac20fe96f8bc3ebafa360f532
SHA256957e97da149311d13fa48f9b09fa590ee31403c4c5b3109166081fe09d652613
SHA512999b0148a654e2bd7dc9aa2217ce5fe0923fc84e2d9e788d8a6ade3343ca37192488df91bfba859e5f46cd882834fb69386f848b5e2be655581eff7e7d6fe3f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537ec0a40bff25c433061ebd83190fff9
SHA19069ae50f00b18aba6d8b6692f63c65e6001719d
SHA25677a704683c26c545fd90a88814808cd8b974ca75859712151c57a31026dbd186
SHA5126e0ad7e55376abfa84957f08f5647341bcb9f2d632c999fc8cd801bb09c9b43f146c553cc554f3aa1c50a498a29bfe4e1958220ecfca944ff6bd6877687d21de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537cc171ce1a6b4135882176017a1229a
SHA17063d6c619405e05aa3b163966c20165cffbf1ae
SHA256627a6e6b91ccf8a97fda9c5eb42d7cb2eb9038dfc7aade426aae90793fd6c43a
SHA51206315d60f060918cafd2e9c2c4460d6de266134081e3b50f5ce4e571d5dd4b2f559c2368e3ce875ede3d4ea1939bc52eb912b53a6d177d95745c9b76676fed21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5033a4e82239e710692897cdcc36c007b
SHA14389c5b80f212fcc5d87c1b2705b1b2393de8b51
SHA2567d71337254a85668764b04b66465cd6cf7c24d9958d7d6438afa2ddcd19e8618
SHA51252a8c9541a233787b3804d045651da74b6387b8b035abd708c13b39d97728fa5d32c7e73ba4d490a878f7d899a9324fd89234980a4c8a9250090820803a75459
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505406ddad8cd5f036e1479f4deb8a552
SHA1583004313e49e5af2527eb072caa68a5527eef0b
SHA2567bccdfc088c65669b590ad50eab520977f452d0719d183d2ccb31c877642af5c
SHA512563631bcdd8b2cff0048dd0ff2d2f13bc5afb88afde2e3ccac3bf65e234affa052a3bdde39beef64e90171b98ee232cca312eac3e23c23dfcb50c8a349e9429a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5ceea0b08b0966f3f595fba9329a071
SHA124f800672e588ffae1bca915221e615970bf07bd
SHA256ce68d79b01df15c8ef5969d924540c515e54d8e47541e12b40c741e65ae42d52
SHA5123602043bfc6a8dd575e2c8ff4b2939ae88a12571de649723f677f221247490743dcef2479973cb61e43b9101907d1dedb28a551ff6598152b39a1e84523e566c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b76b380dbe922b6df58db3cb4e7bddbb
SHA1c4f4e637547cf4ce0b830806436ca947a9749560
SHA256fee165f748efb934883a6d7857dbb2f17ca8f65cc6c9862d3550ac1e1d764ab4
SHA512baaca47725d8a32f6fb2dc076a8286be2e3a126c325006641d062e5a67cd89fdd167a9e7cbd335bc539c8fd6675ef332ec5b841bf5394213bf77cfe3b6786fdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5974e7906b77b00b2a19fad7eb09163d5
SHA17deed723ed01695c3f84782aaa93648ffff3b2ab
SHA2564cd980d04a0e1f9f194513bbde1d3084f1726ec325ac60b421d352f3c19040a1
SHA512010c2885141fac4ed1dc96509812504457f44336ebdd3144e5f43245e9d3691e848f1e4fd4174472d12cc290ce52fb19d7de46aa48ef09131c19db5f627a0277
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af9108c99d201b8f2ef662c240547a31
SHA145bd3cf43644520004b5f0848c8a4c5f8f7085b5
SHA256c38dd7e463783c6b20b9c29b7286ed1f8c4dafed35a005003ab6052759c44dd4
SHA5121cca3a5bdda65d232b07ad4332061006ca47f57cfd7a4f257a7ca3ce2496661718f62a18d71f878d60f1f9de8407c189c150eeaec1b5d1605628a2d5cd373d2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5575a47ba0757669b370e6b4c98befd78
SHA1b3549348842ab9eeb28c3f69e8d306ce445deecb
SHA25646243a770f73e70da6e5590737ea605e5372ff66cb48ae53baf6ab7929c7a5fd
SHA5120989e1fe95a0617cfd293f919ad3be04331d1e5c8842a31ffddf72b7ff4be6b37ab88f3e209f1b3fa771f331f975a029c16615f73b47c5f0a0ae5f0709290b73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adef9c2627d58113ba5f33a1b64437ba
SHA12ca87026385f7a71c42a3edc0798faa99b72f176
SHA256cb53293c3449bfa998208b77c83962ed77f96e3daef2630cec5984b25f09493b
SHA51265305593d1bd7ebd2b1476da544a2807d6fd383ceb85c5d03e23b9ff62c30124d415cc2e8af7ce25637f4171204fafe27742d68261912f261131ffb7abaf2ab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5129543795fd47d50d11498bcbb84d257
SHA1838fe145f32cfd8087cbf215e8630abde980bfde
SHA2563dea2e031373c70335536f3e026cf57b87a57aeb572d7f9caf0be84372283efd
SHA512ff9513742eab8c385cf8f34596e151fdb4ace95a983be1c0076c672c4d22dca0b99cf2fd26c752154a5fcaf294a073f6d7fa335a7b1b242d130bba83b6c8db4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569044672d4ecd5916611f032ead9cf49
SHA1e45a3abfc06eece8e7afbdb64ac89da5b04da581
SHA2567957e836f4cf164e55d74b03c246ddcd7aff0aaf669d9c7c604b1cd7c5c5a7be
SHA51264ca9e87a112685202484d9345324aa7ce2bd28d12b349ad7a95af2ccb333e543cc3741dcf1edf244edaa23989d0f8f381cf5668548a6d3d858040aa7cdfb6f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575d3ffd76de3c6181605c3ad7b2f8f38
SHA1cbb7022585ed8718313641e94179716e23d2c482
SHA256809be55ed96d59c6821aba8043b376da015d7b8495919935d6c527fb8eb296b4
SHA512e0705731421661e2d5837864ad431376dcf6b20d684ae0720d440f8703b4c24bf21b194845d638429abee35a6845240f8942bae22a9c2210d420323da189ca6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5529da9675f59363c811ad54c9ae5fa87
SHA1f08351b24b4711c66618d6fedfc04e897b393b15
SHA256d9cc93efa8ed14c6d255544c411c7ea703184ac9166eddd4722024f6a8b8af79
SHA512ed67337c7acc5cc1b3a33cab9dcab98b9f452f4732e7920aeed949df583158f380310219e2d6fa0e4634792da334c2d54fd7c9c4d48f7b3811b030663f0861b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b47f10df2c5ffe2575438457d0b2e27
SHA18c86129571010032b5852758819df5d44d36b5be
SHA256b8fde52aded29f91e781aa0dabae8a7a80273a319a0e35ccc1aaec50faeabfab
SHA5121850933cc9e24c50c5550dfb1aa0a838e0bfeb97efaf0fc6f0363230c6687bb625f70f59fcbb723b2b6a69d37179fffaea0f88f5610d248ed16b84aff6125e67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b886f42958898046fe00a99afbc1b46e
SHA11f3ad8d97f326185e9617ca60ee0bd1b4374258e
SHA2560ded0d6e959b543ba7882db9acd8c09c80164084d19f0167afce5a87bf254e96
SHA51238754b8216fb99e379cf05f0d9f5bc828777bc0d71ba1f7b1574b8b5ab88d6c28582414fc44bf18a38c128e2710147ca22d2bf85fcb398896c85ce22e0d30485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2e020ec57984465d653d88f9e48ba67
SHA168d3fac23f4e28cc78a439f800f1be294681b21a
SHA256488463bcfb36bde8f7e3bd813564d98d571142ec75b420353efc1a1d211945ae
SHA512a0f4868fe0dc02fee4c2813e1e804852134932c9cad4ed8eff8795df8f4ba23846ddc8cd508746ae6f76b1db80f2e964903d1f0ca3f2f11e7e6c02f5bc7b6b20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a93004f5ab2dcc4a118f496bd10521aa
SHA1efb77eb9445bacb3d4c8052ef937136b15f7b4ef
SHA256c66e212c9bbacfb64bd148d29d19e01ba294551ee8cffee14f41173ecc71f5db
SHA5128cc0d6608207887f496190e30a2739a106c32cd48e56dc391626761aa4ec9e17c01c73d15916cedf5aea8faf25c42fc85edc4a25578b02f1a03a6d9b9af7b553
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b