Analysis
-
max time kernel
142s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 10:49
Static task
static1
Behavioral task
behavioral1
Sample
da2de70b0aecc337b99660b6a2422dac_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da2de70b0aecc337b99660b6a2422dac_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
da2de70b0aecc337b99660b6a2422dac_JaffaCakes118.html
-
Size
34KB
-
MD5
da2de70b0aecc337b99660b6a2422dac
-
SHA1
d54bc1fedf52d401e4719271099950fe5dd03126
-
SHA256
c2570873d633efc594d289de7c4bb3711f1942157086bfd2e9f9500ba3fa333f
-
SHA512
cc2d2bd5e9dc18ea8e28a0189649e742481fe25f0a9d39c431d06d6047df3ac8b1fef72661f1e8abf94406b39d1a95c696723ac413910fcb8f9e8fa950e3223d
-
SSDEEP
768:r7EpFwSXe6eDewe7eIeygjI1FCJC3CNChCICrC/CvCPJExBq0Z24HLx8lF0Fn:rwpFwSuDqtClpjIXEWmyP84yiJ4q0Z20
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432213647" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000aa20f53f986bbd910f58ba77d285b6e992289fe36a71db4a1b360765c85b1390000000000e80000000020000200000007fd15d8a3eaf88f1ca339b26b6855d752126d46b54291182e1099ddd3894ca26200000007618f462aa3db4e5ac96a98d10aafc42b00dafc7c23e6e6dc0dd0594fcc63fc740000000214a1146cd12b6249e1ea563f827a05eddc9c5f8d06456ee13b31b00c92aa83f31dfd314ecfe10736a33f79a2d6d0ea68669c7a4dc63e798bf8d667443478ec2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000013470f081e281ac13c5003a5641a32f18c74828782db82d26bd64ab02becf6c2000000000e80000000020000200000006f688dc3fc78943e9a4daa7cc33d58e404d04b6abd87469445582c4ad2e87a4e900000009ee8be1a90c7fc837d0d9fcfa01a7ee8bce2c7f650ad9725aeada1b14a45295d870fd12ff808109e3f9c543661b6f064069e93ce7666d25f2e6ba042d5fef5b10857b6165995183f67072d934f33652e98fabb5feb52046b1170729ae6bd2c25511562427ceba7a0e6e6a5f12d168232446adb3c67ecb0c6a485f3aab835d5ba93071f05c03f394068ca11013fe9e72c4000000074c0331729dcba57dabece2726d2f9ae5a16506e4d789057d9adaad9cdbe18832b6dc16085f53876881807c4eb89f60b8a275f17f0713b8b5cb37a64bf3bb95a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06ddd623804db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8BC53AB1-702B-11EF-A087-5EE01BAFE073} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2344 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2344 iexplore.exe 2344 iexplore.exe 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE 2100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2100 2344 iexplore.exe 30 PID 2344 wrote to memory of 2100 2344 iexplore.exe 30 PID 2344 wrote to memory of 2100 2344 iexplore.exe 30 PID 2344 wrote to memory of 2100 2344 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\da2de70b0aecc337b99660b6a2422dac_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b49edafcc9ef0770617da9c7b0eafdf
SHA17fbfafb9de2ab874f18a2b316f902c428a4d2c74
SHA25637385a8d3d0c63600741f4aa88df7c089255f0fcbd7a7a81633c5394bb6b0737
SHA512c0238e8ac302156ea222b1459c3c81b5d5c7a2ab41a40532689856c830be80ebe32048b23f9617af8445c2d8f932b6fc884b55602b2b53fa1e9d389a0c78a898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bada008c0da855af7d5a3feb14344e99
SHA177ae50d9a5ecafa725b8b564bdf465034691485b
SHA256d3b1f740fdc8f698f8954306a88a9b9abae758d872d04f9e07389d4214b00e55
SHA512befec286f0832551ee258834da261eb2f8cf4722abeda2243863cdc059256fe7297b71c0d34480feb5956261bdf1ff15f3ac1f8e8ac17b9a6ac54d84fed2a671
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5585f783b0b952ffd702e7cc8236672db
SHA104775c6eafab759108da058b437e6bd8cdb63d33
SHA25678bdbfc0c136611bc4d716433dfd3f5c73a32ecf7ad4704feeb40e850b109a02
SHA512f4561949c707f6e23adcf277353da6d5452e0d1d87354660d2d6745363b3ede9876aa2599ff2038fe1a425f09a94f366827cb29429a284f74ddbabb2554dca68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5121dcf2c93c89425c81cf41f26562690
SHA19244c5fd7af7868aad080323bdda9074516d6812
SHA25695268a8595a125ed3b806d9569905cc94e5bcd4aa56d5c34cd00d7039b229677
SHA5125925fb17211b72d38bb6b2c45a905212c7a7d418bd005055b52b0f8d44f00d2076ab597901e7e0ef0dc0abf65a62ba1438db859a65e0b5800f0e1eda3e90f950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a4b5d5de5ae878f94739576c010266b
SHA19f963ef45bd474b8ff7c4f99beabeea01679d36e
SHA256c125f985266dac1a3821af2561b1bae14d191cc9f2b996f34e27b8cfcc84ce0e
SHA51270a1d396716337ff76cd0adf320095da289b90f9677107996f94aa4c9a3674a3f0829afad8db21ea57141619b44fcd4e3e57f291510e7113c58971829ac16d4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1bc55cb8202bb8da265772851a023b7
SHA1a3a9b435b6e90e210a845431def995f4e542160f
SHA256477ff88ae1689f595d10958bba5fb41ac13b2cb9cdc101b13824b0636a4dff2a
SHA512e3a8b4449cf3c22aa7ca469dba6d003d502b3bb649218941803dd626bce8bf2f2bd6bc4f468d8009aa02c8d464a78335ef402061e74ef9940f284a04c79b1327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599c77225628f7639c56be526b7db674c
SHA12e609eea1e7a8f070e6328f2ef044ce93ffc7528
SHA256d761154eea988c92606c55b59c8566b3919fcaf237ee916d1182975334b03776
SHA5128d01c92c83963e832d787e5c452b5a17e7d5450eaf916baa10b58b37674fab500c6ab6868c5fb2264fb7351212ee2fd654488503eea512c539eeecba70e579aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569ce1182124914fbcbae96f4e28daee2
SHA1a422ba08e4b18cc8f2f229b360efba343b3b92a3
SHA256d7d3621e9f7fc51522cd13f2eda8ec93b6ab210fa4b7abf39422548f1d3bd2e4
SHA512c1cdda09e4b3b2dd0cca3dc7a51a5e8b1ec398f9c0840d40f406e69879a1649ca7cebabcdc42c7eab4c7802fca1bcb6bd80fea5b5ec9b04edf9318bd1943d235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c319cf8e05e4efd07c819743c8f477c
SHA101399f9169a0b00b2135a0195fc2ccdf9e85a73c
SHA2569dfaa716253e0d921b0a5c2dbf93aa42f9c5abd88118daaecfe7431430b9deb5
SHA512df2640854d173f1d604ecae9824aa9e8a71969d4110bc1cb09d8e495c121592b051bc00ac47f123e8fa31fb5e4dc745040670611fe8f86ce6cf40f026ee24947
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca45e813bc2e2ac06e666096dc8a7ad4
SHA15dc90d70d2f4496527c50554816b0372b6f594b1
SHA2560dcc7f4e3dac70dab9df654d662da5e91b8cce009ead32e94c94001719dbc9fe
SHA51277113d60046bbca709b21ccd0193288ea53554818f5a40d8a90fe8653c1dd7a42ecf1988106bca2be3dbd7d9cb32032ddadb75d1ef850de5b0c673cc6ce0512c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9af3e8ed561c476ebf9d900f42c86a4
SHA1d8099b03bc832dfeae6846f529d25390eb71a285
SHA256943c897da7135a09f4688672b82341ce4fbac16146c33f745fb8f72583a54a5b
SHA512918f74c2977825cd564b79641b9312dc7dfa1e2ea184f37d8085465fe8b68d7e29cca71f762a581544592109e9c72ab0316ecccba408a61b7fa078657217be44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5df2a3faeaa5d9b6b55b6b9502849a7
SHA1150143bb45cedae963a55b1ac5bcf929fd129c1d
SHA256e3c4b5355f253fa47d74818c3caa572676d25e1cbe5a3345abdc955e7f381599
SHA5127d22b5c3f27e6c02ae56dc87439dc7810d0f4111c461b81dc8e535ce05a0ed16de9ef0a218e761cc6c38f3dfba6807f75ef72b2130b7e1b481f6a9d04e90f83f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af1a089846b359512e6281949ae309ea
SHA199e270a27a9f0fbe419a8078ec56150be6c86fe1
SHA256857b45c4d35302fd0b925a21c3b09575b19e0b0a407e18518b7d0854bd8d9817
SHA512afbb6a5cad00e4b9155e549c288bf976c8cf6f22c2786dfbdda1c157df60ed71035be9510d6b51158ea33a2c0e0b66e7ce01b396e3d56eb28355200bcacec465
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ec3322d48e78dd3f4e78dd5719d9a6c
SHA136ba4761aabfead2fe4615f3045296944181274f
SHA2565af20e98b073c0fe381d9016f527a0c5c695449d7cea5ed50bcd111c5a9772d1
SHA51207b1be3d7492a5161094cffb650abfbbd87abc0aab97924c0ca79929346d9eea57648bbf57147a0d095cdf93eae6ac86da5b14991fb9e98859c290046dc6362f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd5abfda61c5073290d06252b888bb97
SHA1bc9970711f6a56efb1608fe1bcd2dbf7ab8d69df
SHA256224d5b230fe8fc5b6ec2abbf84c4c7a8f59aedddbca36048e4a729cde4d37077
SHA5122e2b904f9f504d6035f409075d8387c44d00131c2d3fd09ff690587ac5b68246cd67df907d7241010549a6083011339db0609be9e920d4022865fbe8d5a23185
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5134c9125c2cb2af6382cef8f03694d71
SHA14a86db2b789bdf7811f812136bff5519306563a3
SHA256e3f2f65ddc60cac19bb720d377469bb4eaf35558b76c0dd6a33a9bdbe3fd89c6
SHA512a0964b20da29fb45aef1600df8458f746c9f912e1633ea0f5cc029eb311f36a0a11ef0c2b9e57e31768cbda7f9f2e9e406d394b15bb5777ca86cb0bff517e386
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2fb74f89ec16f09b70283a8b4c051be
SHA1b88a64f70dba98e5146d3079103c85c600db709f
SHA256e2f73bd4e6e70cf3adb1a74f38e42fe8f018a5204cefbb67c1800cb2f9e4e9a1
SHA512cb5c766de8e06243205d9e8c900618b185c2fc4608190b246663fde390a81abff2738623d99826f0f223065e502ed4da49d1eb346b6adfd8eda4caa63b209d49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a166631e0426f21b43923b67ef0a993c
SHA1dd61a43efd74eacf58bf001f8df52d811877bb77
SHA256e04df215bd1b6bb846f69e1e2d650aace3563ec0123106c6b3904ec29b063ffb
SHA512fe44e037bcac7b06d5a6d98c14bc97579cfdcb1715634853b3301265122113146863dfd169d9cacb866e0b558f5699325a5836038d67660bf6984f6f8eec71ad
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b