Analysis
-
max time kernel
137s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 22:49
Static task
static1
Behavioral task
behavioral1
Sample
db5c85b93fdf7304174e8699a9108e17_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db5c85b93fdf7304174e8699a9108e17_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
db5c85b93fdf7304174e8699a9108e17_JaffaCakes118.html
-
Size
214KB
-
MD5
db5c85b93fdf7304174e8699a9108e17
-
SHA1
fbbdfd10dbee3cfd56bacd9ea74bcfdbaee5e7eb
-
SHA256
221ff1b79187915210e668e53e00417d6b1a93f1fe819e075b2ec0ac97b3a6db
-
SHA512
ae482ecd3f1f8d6ddfbb8b8bd153f44a90e44fd6041144470d82a5249269649888b4256df5299cee2b6623489cf1dc9989a1c64fea150669a4dbd8c5f93cab52
-
SSDEEP
3072:BrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJw:Vz9VxLY7iAVLTBQJlw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16E63591-7090-11EF-A02E-E67A421F41DB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432256832" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2876 iexplore.exe 2876 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2704 2876 iexplore.exe 30 PID 2876 wrote to memory of 2704 2876 iexplore.exe 30 PID 2876 wrote to memory of 2704 2876 iexplore.exe 30 PID 2876 wrote to memory of 2704 2876 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db5c85b93fdf7304174e8699a9108e17_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD565d5620820d7cc35d984ff47574cd2fd
SHA1413486a7d5da65f58281f5fe1a43bc37f1b09f83
SHA2567f6793b558fab52647dab9b682b5a992b32f99e288f2e54d031d0d7f02747d81
SHA5125179e70f8998b9610349c65feea71d8d23b859e314486f337f021384d44f80afd10f60619194ff2f8c29a8db115d76395bfb941538746568f30698b09594d292
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c37ef650fdd976e904b099429b07dcac
SHA19dd91bdeeda1c9dbb28a96391190bbcf6137dcbf
SHA2562d35ebaef7e5bb5b69d27ded716c9a084566b706fc30559e31c9f738253e4428
SHA51221e4193ab4592d15c27db8daa5eab52b98fd8e2b965053a182690b49d8ef30f33b7db6f470c00b8d7c6d7f2e0513814b3ff9ccae28e1c4d942370110d401a596
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502b58737775c45ccb4f560877159c3b8
SHA1ab22e7428e1eeb8a616a601387223aa9b8c2991c
SHA256f2d42b44273ca93a7cccefbf175833c84cc364854ef4b2b86985b12f4825a475
SHA512a89b6f17b34fd67f4f25e5981365b788dcb27b3c29e3df14622ee99c8e1cc27e85117ef0e2c8d53e664419e48eedcf392c038dcfbe8e347fac66cbe8ab689511
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5437807f7b28c42d976a659f8e11fb22e
SHA10c9ec7a50f84e72e884341bd4f5933569236f210
SHA256329afe2b0b5db2d0550fcbbd2daeb63d04c5596b1d8756bb525bbf38a9224af9
SHA51266592dada836df8a35bd6a385fa30e99e48632e509cf4cf938e6e3ed99183c2ca98557079714af5a216bfe6dc10006f5c2559c1996f4fff680031f82be338ae1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598849788ac38d2510cd7b4e6fde61f1b
SHA1b9460de962a3afa2cdbd8c485a667dbad13199d2
SHA256527e26453a5c6e3b0d9dd2f5f2f3c892d6386fba3a60bd69a9dbad96534044ec
SHA512e2a5e11a072ad35718c60b1ab75080a5cf168559a5025131a7afba76c30ed5dce1d0b4c0debac6c46a8650a75aa2db7afc7aaa2072029106f0eb5c4afb7f2fc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517525815a28e837a9ad97aa95b3eb5ee
SHA16d93fcee44f284092ca85321f78f7ce72c997cd1
SHA25693f7e76aaccdbcb89f964bb65c436414227ae492159cf20308dd7943e073314e
SHA51223def1aecf11ba731d721aac161ea347a9818e9da5854d897c38c48d5f229bb0014296d69f7e684192f0da26471889b793eea91f7031f41af54526b0fd87c94d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522e4c55e2113a5fcb13866fc2cbed68d
SHA102fce1a44238f72f72fa0af9d8d71ea22903c53a
SHA256acbb69cbe5d7b2d1a5a24ede96051a8a7a72414b102301f4b1a6fec9628abac5
SHA512f61d3892e3a3e82018e5b4340130299f1c5d509428a684ffeb8b3f81603726e918b92f18ba5b211077f5f4a1950ad4f6a29dc0442e099f0222415e59f9a4873c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58221fd3e0b862763a41154b9671961ad
SHA11208533c8b6d657e9432904e2a12db490a6a2f15
SHA2564905bf7d6f50ca6ecfdf12d8dde0010a9859268bc48a2676aec607782ae4c662
SHA512a0b36dddbf97b5b713c7f8125317b584575c7bdc70bc6fc0bec92ec1a8856c79cf6a26a71004a3b877de87b8995e24a7b562fd25c4b7c76eb1d3612e05ccc910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b8e95144e4bbc3e87e1d3ee0bd54430
SHA1b6fe52b7d01a2325c8b77047febcbd7658e45b59
SHA256273c8ce5050938a44160ff5de44208af986e6ad2447d3716ad4bc87cc98ec2a7
SHA512b8201011ec56e0c4aa97c40f8651d1f35c776630584483ac46e16bc4aa24e33f91846447a0d7f69e7e2b2c7a78c96c4bbc5daeb1b805a1eacd8deea3a332b9d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f23fce9255ff17d9958d5bc71f33699
SHA1de391c528d77738e6ac0c2fac26df83bb312e893
SHA256d7dfeac8494aaf1634dc4a84fc5b7efe79bb07c36df79feabd4994bfae50a013
SHA5128bf269dbdb1f81c79fd10ba6ea52b302d6b10a6e2ff22a0d4a2b962343ab4e2c1e1bcd85b35514c51db2fb98d21229118176abcc59a4dd269ae8fc57cdb8ac6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50731f2696e9b5dc19f93dc189c09e261
SHA103b93bf36506e8c05dab756c40e25e1975e868c4
SHA2561413b06c5982097b050d2ed225c6f2a6d0e77a4cb6708b6651fa9286d105b40a
SHA512cee51d96719623444a582ef19c77ac1249d6000f350558ca626d6c2dcc22028f39a07e19547b1932dccd45f23f252b921a60edefaaf04bba3c4212e7287cc5d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5512e42b95f498dd85e59a1dd9c89f392
SHA160ea0a76fc2aefa74189ced01b31ff977b2e91f3
SHA256697d1178cc81ea3616a2f45a169d2e485ab474046e6146f60be3b20e793ff4ff
SHA512e573609c8a1b8d569fd4eaa08dd8b2b326c8d141f04e461463a2c77548f4f898564e15cbec5cad7e26072534c2c2f1e46da3fb8dbb925787288b381b722f9b3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e380ea0ffeb77e575fa765188744440
SHA1f56aed7dfae3fa10c0ca83f1b31349497c77a26a
SHA256f6e914de02928836fb0a8e5f6adc8d4a1df61fb42ebd52a5f6d9c2ad39466dbc
SHA51233d997778c7e0e765b09a37471be8167d197a4d04699855d060bd57cde0cc48258d668d299d813bb1cc6192a42f9ecd061f1da676dfd0140a997a11c919b2d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f48d3d7bc7c515b56c53b9a357877005
SHA1479fe58625f7df3a419ae061c9958d00ce5b3eac
SHA256a35b12f3f0a4ce1947830ccfa3278137246a76a8fe7a916f2e0806f1ca346819
SHA51211e87632f00c4a4572cd639cc85bf02e6b3d72d0b8ec916a9e5d4bdfee1e471c4a7aed41c87f5d6299fb3643f50d28fc99fbd2bc997dc347a2d98a733a78e366
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51558f181f5d473906a2a8fe14bdb627b
SHA1827873dc641165fdc8d88b035ceec4c260fd7c42
SHA256d3c45605e9e72859b22a6bba83a3bd677c758686a5df418d32f5cdcdc17e242a
SHA512c6f9f2cdbb6e7a8ce28d02ef6bb6a98c1cbfd9caf8662dcb91ecb7ed15b71a36b5d16a7ad0bba42e9c459b2783cd753383e612cfaa0f6260af9a7cba3028cda4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b01a3c754551e2d769dba94101bda68
SHA19e3940a67f6f84e864da18419810103c374b0c28
SHA2567b3165d969e2a463710accbc0b318055c545e4011e3de1c0770a1d07e64b480a
SHA5125b21f071a98580665a3e73bb5dd5f201be284ea5ac7c99e4ae85e5fcb8abbc02e9526f73a2d3181d7ee8b479d1144ceae81950efd3d5a931604f98baf6dd4a50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556ef09e8ad4f21be646957ae4fec3aa2
SHA171a0df2a12c1cc1329bbe83f2a74aea40074ac4d
SHA25638fa81701e94ae0bded7cab043d58bd098c41b8e1c48ee5d990cf024f55e0d1f
SHA5124bfe63c06a15c0ea765db3709e40088e2affd261176aea8fc95e9875ef18cbb6d510daeec1812003a2a8f424f6a3697c3e71107f9a92035a92b9af199347ce8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537b18f9900a5fc3b5e1e476881f5f1d7
SHA129d4e83f9118d5032522e207920d6ddb19992264
SHA2565ba4ba55f09639b14d80ad819eba84694211e6169ebeb2e0b4a2ead5a5103d49
SHA51212d8eacde4b781e12a587913b2188c828520303ba9cf1eecd2cf8ac99d460b88916dff8ae1f97fdd15ddbef997bc5471b92daf7a35201e671a9721d3ca54a8bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b59980130f3684f61901833b45434d05
SHA1b41e5ef2acad55fefcd25024f16372f52a1c287a
SHA2560439497624e0307bb4314aa8a064cc2dfc4f5d80483ee1219454209de1d8bd34
SHA51282339b80afee2f1b409882794d1af4ee3fcc2c1a80534ed7d3a41db963619fb83fc454abe65c9b2ad05641cded0fb11cabdb51225f3afee7e26cf6529cb03f8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548158edc7f7d6bd46a430c87af61c96c
SHA13736db2b4ce6f569f282f6bfeeaa72d024fbe620
SHA256970b6eb47bd831dd332ac6c3605aab92105e2ba8b28411425b6c4bb8bd8c812a
SHA5128ce73137dd45bf307085ff3d119c74c6b9adcf049f77b9466cb688816659a4a6abead4e16764c542836cd52941a589908c9ff4bd38ee715bec10bc0d2286b015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586e1d2486d74668849b00fb03b058fb3
SHA1dc6940397e666126ca31e7d2dca02033621ba0ec
SHA256df3fbc2bab0d0b9a9ef51a96b5fc6991ddf15eff6ae5230dc72c0b722b1b20ff
SHA512972be171f2d81613cbe3bf75cc24adce1ebca7df5b9ad3bb2c9c54bab2aa3c7fb2cbda6333575eb30a1cc619d533a10960f4062268c34baebb4b28e1a9f4aa52
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b