Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 20:21
Static task
static1
Behavioral task
behavioral1
Sample
d50ae364cd08252141de2889bcf74702_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d50ae364cd08252141de2889bcf74702_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d50ae364cd08252141de2889bcf74702_JaffaCakes118.html
-
Size
27KB
-
MD5
d50ae364cd08252141de2889bcf74702
-
SHA1
4c81af48fd5716ace185675b07867299e820d3d7
-
SHA256
4429d26aadab67427d47348a725b49c250fa4089164bca141795a0c18b084b16
-
SHA512
21ad4ae3626e6fa5cc268164f5499200915e36ae236a680e8fb714a753abb7c64edcbeb1fc63c7962ac4017845c5390d6bc447ec5c5a6e46ccefe51c3c92a44e
-
SSDEEP
768:Sqj/u8Rm02NCsCZCZCCCCCzCzCTFP4dpjbtD70xfKpb:Sqj/u8Rm0YfWWjjGG4FP4bjbtD7wfKd
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00C666D1-6E20-11EF-A540-C28ADB222BBA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000000f92438cf217463df27d91b78428a7cfa88d1301f7f736a2dcd72ba33173d070000000000e80000000020000200000005e9f80ef4e16c13799212eb416bcaffc771cb856f4add9837addc22cfab65c1420000000beb372b4527aad992bc4ed1e84df5b149d41462b4f4ae2d2c80bb38ce796f1ca40000000176d167b80ba5a83f13353efd52b1cdf3bee7733f97e1e5adef5d5016207aeb7d2f11dfe957371453cbf81b6daf3f38d79b18a31ceda834ae937d5eb2fa1ef6a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202bccd72c02db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431988787" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000001fee7f976e3cbe0106f78224e737d0575b20b7f6194de8f32b3e10f8555b671b000000000e800000000200002000000073859f031c70b44610a22f257093f1f37d88e9eeddaae7852db20f812676269b900000007abcd124cccef28f1a0b2f063a080a101c4641f6ae532f77070376317e373d035e503889b6228c59ec825b793f3ae5c1c2f7e8e43d0463359298194e63a198f934726a647122691af2448dae3539f3701c7db58ab84ff2e823808de05b4e80b0e65240780c3fb795315593caef00ec1f2483936af66ee4700128dcbf890a30aeffd5d6f043f4215f5343b45b83aea98b40000000715d8791e44efcae015e52d6f7538f10ab0cdfc62ccf0866823dae5eeeb7b1556a12836526545c868cb5e26b12637586c62b036a9fd982ea7b30a127bc806f60 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2384 iexplore.exe 2384 iexplore.exe 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2052 2384 iexplore.exe 30 PID 2384 wrote to memory of 2052 2384 iexplore.exe 30 PID 2384 wrote to memory of 2052 2384 iexplore.exe 30 PID 2384 wrote to memory of 2052 2384 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d50ae364cd08252141de2889bcf74702_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1a1eae7b3cad1947182a2ea5e098054
SHA1a9c61ffdc1ea1d9a33798f9023c11f17fc6fe973
SHA25695152d6a13705ea6813489c5c7c8ef169515e6990bd5b829f1bca201784593cc
SHA51248f45fa8926d8900027cf5844d7aad1031f3a909aaf1d5f09f398ca067ee23c8eb54020cc00f9c8df73e1d2fcf8895715bd8ade257136ba2ca74d9b1b02411af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffef715e47e100e27edff23f0d46ca38
SHA1be0e661189570add5494d6934d5851d985cc8f2c
SHA25656029e40d9a4215b7a200e7410e77dfe3dfd3a269459ff3a4831a1f3ed714609
SHA51264f833985c65c945be2eac2c06c6bec966ad705faedf30834aeab24d820953a19429e8c178ba0daedab5e8b17acdde121fa9b1651cb999c8dec6a75a9b540f68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515c967b18f99b570502ea18885d0c679
SHA10cd1360ee6b6ed6339365ad32d4b9adea1e25aad
SHA2567cfc6f0b6c53596c00c205484130c77fc34af368facc3da4474d1b934cc309d2
SHA512f6cbac3643d550b2767eeb1c68b03eaf00ee687402672dbbc026034bfed0dbd886843306c014e36755ad70e961f411a95438abf0c1aac4396eea8240313a8272
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a8c43e6997cd7b2bd8a6be5f137d61b
SHA1e16d621ae4dcb65906edca664bff48b614be323d
SHA25644fc3cc00898acd2b0b22d866050e146530010e9966d5b072a5f06676f19b172
SHA512238c5a6acf17feed06b3604d83d4059b631db452f94d5e1c0fe9422c55986f0bb942bca1e7b52a4a281f14d711966bec9ce6f5ee2287720f2f8f5164119f88f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550e7378848b58b394c1ed2b397e22c28
SHA12d0641e0960123d4f3c7f55c09df50c581fbffe8
SHA256392f11612242067b41e75fa32d748bd5abc0aafa5c091da5d74d96816a008501
SHA512bd3595a98e27476c358a06e7621bd384f2706eb38af95100d1918ff8d58ee181e664fa6874427a81f8228034d10f71e0941ada1d79fd3ebbdffa14ab34941ffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508f4f7babc2dfa6b1870c9ee5e91ff36
SHA1575fffffa6acc34b6d91031c75442a89cf1ecf72
SHA2562e0f5e7c24f3486a3f24ef247037840815449a7b90e5a7ef12070e7a8ddfdb85
SHA5122815fd50005e44a286d2a379ed027fd0b1066db430c7701c06044ef262dfc511d60074b81f2f3f167d23d40d4968d5eb386bf09a65c37448198783d89ac86ad3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f2c7022a7f7085c27eb73232e6fc318
SHA1c90f485c61ac4cf11954205b8bdcc740c285ea3f
SHA256e3c3ec2417fd5c62243346a50febedce6c2e84df14b4718d4411a79b15c4162e
SHA5122beb48392b73e647d68a796065a16492c552088e0729a944a695d7bbb0f3886fdf47580677e275c83baeb010986912116ba6be47ed2cba4a87a1045e88b6c580
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5636e5b16764805fe59d81bec05e08f2e
SHA195cdace7c2300a1c706c27fd76fe35d18dfeb6e1
SHA2564e978eff2da28282691e659785e710f36245e581472ff3415dea48bbbba94a1f
SHA51243f3f38cb79f7ac6beb954c316c81fccf5ef712282a9b88290706895c8f80a5899dbe924b513399d1217cc360ed8ad3dfb0a79af58e84711ee6f8b8ddb65a327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d2c6653d528a87446319a0733789dc9
SHA192cdcfb3dfdc3cd07c709bd6217f5465e176b14b
SHA256e408e00d19df0101ad754ab42aa68a065b7746f61fe8227f3c6ecf311fc41718
SHA51283ab653da73caf489ff9e3202997164f6e013db0dbccecfe2b770a81fe64d366e63dec06a59b87bd6e99aa02540e8fab2da8bfc26c4ecd90a784f188fe4375a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acf1055bbccd4effe76597180edad6f5
SHA1bef4d6f4ee2f11961333a8241d551a6c38215f57
SHA256898be4e8f2b51b6c00d373037ffc6baca39f2f2d0f5a4986ab5afc7afabc0b49
SHA512d96b8416a2475abea9036e5f9d0246558178b819cac84abe0f3273206ce9ed445bcf65720444158c3d80a6feec91c290b1d6a13b6cda3c8b2d89f7adac1e2cae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adf2b91f6e6ddef241d8cef20f2e9afc
SHA1efdcedd226c8a6dd20c8e6bb8165b72e44f605eb
SHA256485a38ed29c95deded75d873a2ff737b97d83604e00f88e4a90e72108d7c58d7
SHA512b79ca05902bb044e8b0ce77245ee70781c40976c11f7226a38dafe964be210653fd53db9f65ae7debf0f78f41fb602832d38f121b248f0e1793fbe2309a90414
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55afecc0ad0ea3f85ea0984487b72f5e0
SHA129dd59cce636862d516a89011c2eb9ae42c0da59
SHA256651ad17dc9302e6fbbc44e28643ab0cbdafa98c42587778dc54df61ff763ce8a
SHA51278ee422217308e6857abd5b44bd9f64b6c3fcb9f8d97211fed09b6b0294aca082a6b8a96dfce5052621b60319fb8c86e3fc262d71237a914c316053bf064d4e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c302fb37e4fc517fb04e27f3d79effca
SHA1bb7b2c05d3954f06d637d057a63bc0b325df1c25
SHA256b5c0bad31c70a3ae7762ed1aeee88ddb9984250352454aba8daaaec6ddadff38
SHA512480f4dadf0ca1b662dc84087a8131b5c6bb0c48f99a93202bce4ef29d9c4dbc3448aecf8f3885a04d1a422d2e6107cb1bb1257ad29411ea92b75da124a5ae43d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52015e82406b184749da013969de0fdfd
SHA1cde425659a250d0b37cca13fd75e6f15700e1229
SHA2560d2a6ed524c0064bfda6c138306827cc1555148b1d6f0861a5261d9fbbf199bc
SHA512e1a36ebca47fbf4200e3df9e34ac99210473e076e47916f4dc8821ec8d3e29dffb9eeccc59b2627d408af20f3ae7ccd0c3b490b48ebf736011b4d4270b125a2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8380a214bfe629f48f863d52b67d508
SHA1218c524b8eebbde0e2e9cd03bac3d784668098b1
SHA25636876f3d12e9864b7b329b275beeb0b4d65a594960965f5fcc98c75510fc24f5
SHA512fc302014b3e2e53f0f4be91ba4fdf16f9e38f05be255f9501167f9694d73f1ac20b62cc93e6465eff7845960166e3d07babc411c03cc2513123a8a2a9bb4b32a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5faab8d5bddf6fd71d4010e2e59b0946b
SHA1db249818484565b4121b021e1f3962f3fcb7a940
SHA2568c3859efacfa322c466a55d86ee67bada564e0b934a5f95c03afbbb981c37273
SHA512aaff3a25b48189d484ab3cbbc9e2cf3f54a0f92f29dafe7f38793eef4c821cb738c58926bd6b0fdb23738662ef1ff009c3d385b547b68405dbb6dc4f8dd4576f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8faf1d629bf840656bb218b74cbe477
SHA144e57f2124b10a424ad1871d363651d13d4d9282
SHA256ff75d475d1c0b40bab8b8b3a40365d3ef07cc1c16643bce8806fdb733327c229
SHA512d0098a707feeccfebc5ff24cda3db91f7290aca4ae57ac07f76b5c717dac37dc59822819a8b10387a31863d47cb24b4e780b95a4d9b3578da8c40d826ee8d09d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bfd977db481ec8f7b224beb1e2d352b
SHA116dbd1d8dff3b5997f4c91a10cfe7f5eecd27a64
SHA256e6dcd4da41022a40edb479f2d7a28f7118255f6133d3a1fd13cb22dde00d170d
SHA5123b7a78549062e6a179069a993ac1f023db9f560fa3094b00c2686f3d3036b4a4990cb6b92d44deff95ccfe27a2511ce8638cf65cdbd32e6fb8b1d50132baffb7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b