Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 02:01
Static task
static1
Behavioral task
behavioral1
Sample
d34913ca275d67086ec174fa57c05fe5_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d34913ca275d67086ec174fa57c05fe5_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d34913ca275d67086ec174fa57c05fe5_JaffaCakes118.html
-
Size
463KB
-
MD5
d34913ca275d67086ec174fa57c05fe5
-
SHA1
d3fd5706017a7c8504b1bbc75db2ddae664eb6a3
-
SHA256
385ccac5f9fcfb4ab98ebf8258c4a764a144fd3f21a835d461422540a44331f1
-
SHA512
ebc78a2584f861b01a9986e0d288f44330c8acfdbf05ad191bded4c29c8567cf40f076bdb00b36fdde084c5364b4a4cdb5038e766fe037160e505178e2451e66
-
SSDEEP
6144:SWsMYod+X3oI+YCIQVQksMYod+X3oI+YNsMYod+X3oI+YLsMYod+X3oI+YQ:b5d+X3a5d+X3H5d+X315d+X3+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0eb530f9301db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000054d8c005758c78f7c87984ee62f3044c74a58fe6e3a4c7f36794f608c9749af5000000000e80000000020000200000001146026604ccc058fe825e9ed91dbff3ec27155b140b79011b09d4311d6dd35a9000000087bd74d22a07735f00e97b1da040a2412b0883235676470ba53effe0a7120020fd7fca871bc4d929cf98a84d7bce01019f7f14f548d8355c7e8e3d9497f4a317d1b5929104a17a201199f53d819cb81e7fc1ed0126249802bef2bd8860302457b27f7f0fdce25acae439f741aa0e585b52be4347e6ec20ccb38650feb4bc23359e1ebec09109706c7736c3aff3f8115940000000d9ad1ac2be58028918bbeb02683a474ce8e068feba1cdf451fd29d4bce5b215a00e5ead3e59c558904455cba08d3dc64fe0a4ca02d55f97695f6e268c0444e47 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36C1EA11-6D86-11EF-A17D-4A174794FC88} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000ad13f70ead6ec9930c9fd82be4a3100917b876c5b148316eb3eb1eb347aa8d81000000000e800000000200002000000093ab44935ce1a37e3fdf68cdb3f6bd1d4eb84083ec942a4eaac0664a8b4fbc9420000000c1c3d4c13515d8cda4a5c6484e6bc7838329288b8b9ae790d0a190059ec9d9fa400000007eecf0a53f551f28f544dacfacdbc9706d7423ca089c8c88cd3b67658dbd5c27afe1b4ec91169d5d5304bdfe0c9eba33dd6850606ed285bc4aaa7ba5440b3843 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431922736" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 684 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 684 iexplore.exe 684 iexplore.exe 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 684 wrote to memory of 2684 684 iexplore.exe 30 PID 684 wrote to memory of 2684 684 iexplore.exe 30 PID 684 wrote to memory of 2684 684 iexplore.exe 30 PID 684 wrote to memory of 2684 684 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d34913ca275d67086ec174fa57c05fe5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:684 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f76c0cf9f509a3869a3683fe556e79d
SHA1844ed04f6fdfa91f13289c928479331ed81d68e5
SHA256defc4f77bf7a728c073754ffd21d4c41d0cf004c5249e4ea43df65933c632db4
SHA5124ed6de027137e092e196bd827b709915e5111b90986eb232f7f6c8f92259dc10720feff6bf17630c56da6ef60e9105409e295a62fc98f25283bb8b6fe889194f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a44bbbaefbc7a9f6c978153ac043e473
SHA1dfc350144dbe094ab569ee647962a6aa4d5b8d7e
SHA256d863626667c56aa60b506d943d94cdef0f80f51cf57ebaad522aefb95a4ba07d
SHA5128de122e4a38c8bffd4049a3759bbfa027f2ef687824a3445c64ceb4e432152c59d316234a86c86dc94fe582a06090ec3d47375fe1127ff95c881f15c3e2fba8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e9231b43c5c719c287d34382671747f
SHA18e3edb7bd06d70c6cb6c846e1e79730de3b12925
SHA25658d43afa307044e9e90da60dfc843ec5e6e990a856d5d44c0251b44d9904ce24
SHA512893ff5c0d9c2910c2eef42540fd2c3c8069589860f875c9d23ff3770f621febfdda755e7bbb270fcad3e7dcc548742abf6a12d70e3cf4e14b3a44aed86b14f35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e763fef0d9501c7e7af2d119dc3847e3
SHA1eafcc79b04f9401b8466eaa93b7dc72d4778557b
SHA256b1a27af7868c21027ec0ec94e5d1c7063438a6edfdacc8f2e3becf1cab3623be
SHA5120b9e53eb451ccc98492bce37caacbcc6014c27009139d7620935d87443e0da3f1567bc79499c66b6f2cf05049f7339f267e6d0050650ac5805174ba6f9605d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a98d66698a069f5c973bf6df05111300
SHA1c7f81440ace266e9e124252b9150b5f7a0bb57a1
SHA256045a316c2085a91f0f0a9ca5ea97b955b7c35b6432eee79363a63c1fdfd34fb1
SHA512c6db0181712cfb4f089bbc4fff8db4db8dab3e26851a8f16c2272ed8bb69604274092b7a83990e16001e1b7bf9f595396bacbcbb7a2e0aa7a1663a2abe540a3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59008e4424796953ae8078e7a6cdf1d4d
SHA15bf28f5f44bc7dbf3db4a783fa93b6ca6adfc11f
SHA256aa638010d15c82bd56e7722b9cdc9a375777deb7181418344a993aa02c4ba31d
SHA5123003f9df27bb45c4631164be60749f39f664f378b74d862535ad816bf6d5b505d7e0ea2684b684a50dc230595fd181627b9b8ad4607c87416ccc69cbfabb53ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554cb3d81bf565ace4152088fbab00cfd
SHA1364a945800ede6fc6acc2981b4dc0491a1fa4145
SHA256c83634a455d3a8f94e929521a2dd2abfacfb593caa7ea5936fad1a560038b2a1
SHA51299dd7288f52a5184214e50846921cf72309dff8414ceadadf3c0deaa4d6d888cc3c1dfd23fd8f210d6f76cb4549ca2cc0e2354c74f905d009254c0cff2c9ba96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555c1abbd2d9af40fff0512ae086c5798
SHA1cb5cc57701e8441b0bcedcbc71a42d9ac61b67d2
SHA2565cc615bf33ac73c05da44123d0e3781c731ba563a1083edf3cac157ff7de3054
SHA5120f9aaaec9331805769f195d98461637b7ae44a71f75beea65a7a9776b03c77082be2f5b7a4453ea63cf955bcafb02ced5b58f24a9e23f451dd9f9415e2941f29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550ec1dd60c5ae8471cb783a9cb84ccbc
SHA1e4ff2b287d42aa7356f00a9a98e5bb80681998bf
SHA256812c39bc8ae787a144302e534188720b547e8dcdd4e2188c4ae2c6be0bf7cac4
SHA512f36ab1b2c97f42733dad91a6aabc7e4a513f7949cf9fdb347be080270778a44edf2a03d6a4feeb046d2dc670485c0c57018c94063ff5b2287b344f3702b55231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f33896b566a3479fe5499d7ab3c07ba
SHA13567f9bd5d15cd7d174d9826910a7e4bfeec00a3
SHA25641242cb9105ce1f615fab08b9a5ffa64ac952c76802bf2a31431002e5e824a7d
SHA5120a49ddedf75eae5b37e69a79d6144e6fe0a46de7c6e91fa6437dc78a1e70cfed4eb96086b8f8c99b85b15db2d0dce67ead1ca08123fdae53989ba0efcb2886d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515db46d4cb87dd32ef275a047c8939e7
SHA1de67f7a7469a7258a793bd071adda92416d91ec5
SHA256b42fefa9ef35ab511fc2498435e82ce5360ce933cc8e16109d66dd25407ecf79
SHA5123fa81ec1fc3fca1b5c5e15d35e926c228382690b6bd8ac95a74394c60bc839a6fcd6b791d9885e5f4a333494fb4ff31ed698a2094b543a58943c917524656a1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5986984bf71618291134a0c61ad1950eb
SHA1fbb651d438fb95472336e8cc0ea45e61cdfe9b8e
SHA2566a44cb203ec0ae5e50f61f3b60150cdfa571683e7aa963a65709fb3f5022a2bd
SHA5124cd4b94ca815819f267ceaa39666680d22be5398a769dc7ee3ae05340efa8c7fc1c6841eed02b039ed8ae80d4272a7cfd80ae0ba51f2270362bcc57eae05f818
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52315f74f862fde0d98fed063849123c3
SHA140ccc5e49768ca759d522a49b05eee1bb3cc040a
SHA2564d72bd7474612be2f961bb7d67ac63d0f210f481280c6decd27ddc6b2c23e7db
SHA5121007f477cc05cb097b205c5e98a02b681694b3cd2ad1dfa42b1bfe1db3b73888d40ef90f057f9871efa9eb13e01772d9edc6e18a2f9e8518513cc344a1c84fe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5725c59922851573cdce158ae5a8c2d
SHA158796cba8f287de25bd5dc6f71c063726fda8727
SHA25667a67804d297bdc609e547f947fd2bc72ed2aba5ece860304f6087c49d39af96
SHA51270fd49a0df63dd07cd937720e7b741025afdc32d0887f7eecd4f10021a1ad45a76fcc692672a577c09805131fee5229a05d511864f865ffee291af46f6fa4a8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9fd12a2061e554a1dc5ef458a909584
SHA1af2030915eb46480c91534a8de7e4d1032dda4be
SHA2565df7079ef1ec73198bd39e72913846ffab53a66d37f2bf989983061868916156
SHA5120f20eb805ccfe55fed4bffbf8cba8f4c0e245f9971ce8d6928033c1699936e3a771c2a6e014368d3739e989f0af2a84cf705edaa8b4bb315ddf0134e14036eb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524f099187e88ab1acdd06ca156747803
SHA12f61de344e190f4da552004555de30c146c422b3
SHA25628cb5a122b94334c27a7bebe8f0509b2332dc4b64137e488918a3b1600c91004
SHA51239788d1a653ac4eee36139cab0a039cb6ab1463651f44a0161ca3915ff58e91b7cc08fdff792f4ebe91672bc776eaeb3777ca99686da3ff3360ed027158a3a64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5750b154c0938f7bf4af8a149e9efb825
SHA16cb63f7b2d31227433a3dc58e15ebca334f34da2
SHA256ee21f71d7c8a089d67f35cd1eb661198ecbe13228872b0c95e8be3b628ba601e
SHA512ab8c37095794cbdf15836e1441e9fa287deade1fd65f71e2ec8dad8fbff1ff01c5cadaed0d98f074b946aaa630e9064a4a1281a03e160b98031baf86e25d57c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5ed41e0bf6a2495a4241e56a82c8ade
SHA152055d331d655807c960ba5d3a86f1143ef1d59e
SHA2564cfcd5ae4d053712adedebb6afc7bb5c09f81e7ff94064813ca81b6fe6582be5
SHA512cbcc3a000a76239161d4bb2d737afff23ffc92a5ffadca76caf5aadc7d4df1ac6910a987cb44443d06216017acbcb0d4dd50d1855c3477beb69408852bfb87f5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b