Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 15:46
Static task
static1
Behavioral task
behavioral1
Sample
d2490c40ed6747ce3f47f8a64ba32183_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2490c40ed6747ce3f47f8a64ba32183_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d2490c40ed6747ce3f47f8a64ba32183_JaffaCakes118.html
-
Size
2KB
-
MD5
d2490c40ed6747ce3f47f8a64ba32183
-
SHA1
03ec5f595adc328c2cbe6bcba9f634ad4b78c94f
-
SHA256
4b51c4e2f3db69cd3728738af35be3c8da25faf9d22fe38141a61a9aaaf09733
-
SHA512
0f49355ff8454ccca740fe0553eccfc644831631c3bfe5f092f82cefac5a8b9280df9c426d05d0942cde648aa80ea38d57e5a6c4383faa37e03be4932fc0262a
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431885840" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000cb5b2ab25c7617f2dc38550f425cc3857bc47cf67118fd3c0b8d58e45efe4837000000000e8000000002000020000000c6307b44885b5feee3e1adf81462da48a983e44fc7cea626fcb6ba1ca59189e0900000008f6980f7f4e52bb13fd6144d32d75daa4817087424705452e781c3bf5cb99b17f99e44f2798bba3037a15c8e820a1e6bca2c3671fbf07ede9030057c7408d94caf786d8f23641ea7b77ff82502253e8a5f7875e650392f4f7c5a54ad0a86e446056dc1fdd64d0b66e15c1d6634abb218904c50659302d268fce40e192536b540b0f086f119dead6725b11a911960c4234000000023c47ae850bf62c3481b30d78eabf06c1bec6cc0d2ab88a87cdc119e37b811458806a70396af3d3f2c2d80d13a16c5c8c7f91c041e91a3002ea479e4c2a05356 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0dcc63c3d01db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000006ee6808f20c7e180d45c20e20650f7e1c2370ae4857b3e64d41bf9d25aadc80d000000000e8000000002000020000000698f28bd844f96a641457884bddc2727eba347bd67a7c136cf8f236dc28c16c5200000008f5c862b5a4c9f89af0c3f13942c299a50c39da08e0eaa91bfb04f62ddb4c5bd40000000ae79f8e1e47134cf72d10c471564c9c44e6798b6fd6267f6708284ac4ec3e88ff92caeb7590387e82d9518fdf4941ba3ba91411cd59ef00ea3ccfa49bf95136b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DC654E1-6D30-11EF-8967-F2DF7204BD4F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1748 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1748 iexplore.exe 1748 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2504 1748 iexplore.exe 30 PID 1748 wrote to memory of 2504 1748 iexplore.exe 30 PID 1748 wrote to memory of 2504 1748 iexplore.exe 30 PID 1748 wrote to memory of 2504 1748 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2490c40ed6747ce3f47f8a64ba32183_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a1da691d35512b63bbbbf0cdcd76ff5
SHA100c465d60a86ff25a63021ca9f285c421fbcead3
SHA2561de70385614486188fe59187b2f9b94eb1e9ce158a025cdae3a6568064346fa4
SHA5129ac3e345a11d8d8e708d1e245a46f9890d4abd65028328c1169b3673f1bd89f69fdad5f5d27b0ef69e35c2be77f4705864c6c7ce6eb165af93e4bfc77a16f045
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599bf1a9ce217ee28bad0c50cd2c9b0fa
SHA13ef490e472f9cc76cab68d628d44e957c76338a9
SHA256d6b07eddca8b97afe55b7ab656b6b9587490d09da77a3b3a29a811684271345b
SHA5127bd0e7c0e2956b55c23d591ce25886ef3b260ff27b549e7694db7cdd628acbd8108a7dfe7f9bdacae59e0207b2727cfd74beefc5a6cac9a9b18d6198ead7785c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b34c4312c806e68b39671fd95801470
SHA194638283fcafcff2701a07758611f917075cc50d
SHA2568c718198722f33b5360cc4e05beeb7594ab34fa8cdf8f8a27ec59ebac3f125d3
SHA51249d3a84600fab3684a1f0fe0e6dd934f85a6e3cef409797383421986e7f1ba8487349e9f874f6a9976b86c446226d6ea27258be1daf33de9a351f848dd9a1942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559a6cb5748283b813402d0dd22a51a97
SHA1dd9c1436e7dbb8de9b123382b2a2ac7fb328447c
SHA2565468cfd9f0adb6a120b2764a16be31424fa9de9d1df46319a13292afad52a8d9
SHA512e2ea123a1c073d16e5c3cbbf2c04d5066c3e00b44429b7a87338bf8aa524583d44935560a07a6bc2748d2df3c58b829a928bc84e3d77fffe64d07f23e243284d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542d384a4f0b32450ba347d7bbe0a4e3e
SHA19876e83d411a9fcf6b8919f0d80050058333fe6a
SHA2564c86d309db15cb0c68fab3014996c4438f72c5e69fbec7464f38e498b38230c0
SHA512e2cf06960ffcec3322534d791d217c12651891131be1566bcd7aff95a035cb21ec1f4f13ac4b635916fc8097c1eafbe5fa9c6775405fb969915324fd6882ab5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8971f14f4f67d5ff6cc7d230a75762b
SHA11988389aee7bef758b6447dbb3a729b7920f8158
SHA256c44523840a116e87af355a683b2e7880161660d6403d0370bc02b49cb499dc1b
SHA512ca75f20dd981f603bb2ce65fa00d840c508d0150dc4f50b7d7c873b84504c97e879a72fb8aaf3e576de500f5ab37770d96cd5399582d2fb8cf65ae597d823d54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e40494a0b0b43f88b4f93776d1274308
SHA1121e0a35cdda1905221c46fa0c231fe3cec488ab
SHA256335ffdefed383de56766d66ea65e39ba377fe9407ef18fd77ac4579853812ae0
SHA512fa25364a1fdb78517b797ace1633a413058e072f5879fb3bba96fe2459bae4913b21a554d310d67fdf8dc73ae493f435fbd008e820043fd83ac9192937b6c05c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ef4feaf7afba29724738edf8805fa9a
SHA127f722353c1d98270443977653970106edd034b4
SHA256ab0aca416c14a13c179b21308c59c6e7437309893dbad034a906f5f8ac4994be
SHA5129821cccbdaedd86e603f78fa849d5e3ee22c78bf91837b7b8b8ca52439bacc667a6a415bc48d9170264895b90d325671858dd31354c4cabb1f652d8f85d931bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dabae03aece3c414df4fe9e7d64093a
SHA14779c701d260b7b7279cc38ab68e5b09c66ce4e1
SHA25662f034b130e4a3202d797040e30590be54385d5a59411482758ece1f0e0846ad
SHA512dfeb2ca62b477cd98a973efdd049a68629604efe184360ea0eaa835e16942137b75e4f7223c0da34da086e236ac31b69732b34d84653f3ad326fb831e275f00b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56040c731b7b844b195c4f738da9f6dc0
SHA109753d643f892d7aae5fc427cf19f1b7026af254
SHA25629d6d3701e3e3296eaaeac1891e187f2acf25b74d8005410a3d96b95f7401d64
SHA512c4801f88cffe4f28574474e23dbb1fdaa9d51b877e0443619f70c6ca3d4a514a7e6ff37684d978a65e77b355dc828b62951ae2d664d677077455fee91d8bb418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3a5c7aa87a350f10b6b79225e663323
SHA1271d1e4d737027dc7cf64efacce6ad231cc48e0a
SHA25656315ae0ca5027be75147239b1ddd99615514e99aee4fc165faaa278949145f5
SHA5125bd11b167221a1fc8f4f5757623a75bae32f5d3c35d74771cd80171921fec25314f5d48c33463f691d8880aa83569a21bd975bdf0dd7e7b3b43d83aa13b01838
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565cea993b4463d6cd1a0da5d9ef7be68
SHA1494ac1ff9796a21e62ddc61ffcb7cf81a1061cb1
SHA2567417b56927f12626dc7041be304c4f1bfade1aad7e7b61f8254be562f2b7c4e1
SHA51206b62fbf975587404ebe2068f8fbdbede2946e2b402f775dd0a48365803d6a613c1eafda89d2dfb99191172e8cf95682068ed3f968cc1a375cc381fc799896ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5433b59aa7d0d2cd5ab63143d5c13e6cc
SHA199b8c48a5f7dd7b11ad7859d0d5193dc862d6cc4
SHA256dd009d3a5e6f495260aa0850a1326f97a37231eec6e75b16b97651848554e122
SHA5124ce1d3fd6c4b051a822696d652e32d0d5706100defee24cc502ba9a344358953d2dc4cd5d19575132cc580fc13017674b2f0621c96b0c83eff027df559fc8dcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3e04ff3632095bb38c5e0657a0f4658
SHA1a158d692347c2a65f0959ce9bc7b747cc09121f6
SHA256dd17aef10121e2ff00440ede792cd405fbbfb15f73216d2ef6c1c0a1cfe301bb
SHA512dbe33b91d69a4406d74a66d1eb09c9d32b66b4fb04de63971ec2933d773a5a01816db40c581012c77c9dbbcffb77dc5e3bd562ed9ab263ca32af2103984c2dff
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b