Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
dbaa58306102db54d36899d8662addfa_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dbaa58306102db54d36899d8662addfa_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
dbaa58306102db54d36899d8662addfa_JaffaCakes118.html
-
Size
10KB
-
MD5
dbaa58306102db54d36899d8662addfa
-
SHA1
d821cec77f5bd687e3498d9cdfb11ce376ba097f
-
SHA256
c831450eeb9fc317f754ed383b4586e450f7018612f0c2d8ad066b6c408550d9
-
SHA512
c61827f4b0b3a89e2929bd48c429f5cb1da2ef42c9710700debaf31caf58ace62ce7004dcdef2d8c99614262cdc9a91409eb56e1bc5befa8e67cdf02be2d353e
-
SSDEEP
96:uzVs+ux7o7dLLY1k9o84d12ef7CSTUBGT/kz+pDSrlxUTl9UNRlGlVHcEZ7ru7f:csz7o7dAYS/IwDSrlAluRlGPHb76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06495941-70B0-11EF-8D6F-62CAC36041A9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000001dfd26b6e942e2a30cd209db38d6e6559fc7de091b66cd1fd54ef14fd4d96507000000000e8000000002000020000000009349f3f3574989665f86b42d655ca98c6b6e3ac354e008a6d475cbbbbcb30720000000f399a4262877d0debb6ab3909148cba8c63558509d88ae10c96bfc5669821d0b40000000db6bc70b381bf8b9b3bfeece86d0d635f2e3f66dec152dfa58b0a049501c15f65a5a90dbab9bdf03907ae9c9449a80c0f1421c2a5d082deb3fdd17795376ed71 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000082883d2b79c43592e73a89fbf1ab681372397622dcb6d0b1ee2a1c6f03ca4b43000000000e80000000020000200000004fa1328969cd8ebf18da366cf62959365f28999499b42934b4266420bfd59c9d9000000077ac313edb856934962de1ca3800621d40ac008eaf13dd178956450e0c297728924e49588ccc7dc10f157603e78327f3e0c749aa3f626d3810594d64e06d40756668486aac565f50b51bb57b3675376f981f10db403bbe755fa38ea46a3049d3f074775581f203ad905bedc36039841cc40fe45892c1f26140f64144e1f91a51ddc60f49661b1864a918de1a90681c7240000000057b40cd8536799455067593da42e4634537f593a885e3eeff8c1f252d00fc7e02e169cc06dca629e04dbb73c2e6a4cce42b77204ff8b21b3fc5941ff67cfb1c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432270547" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e045d7dcbc04db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2312 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2312 iexplore.exe 2312 iexplore.exe 644 IEXPLORE.EXE 644 IEXPLORE.EXE 644 IEXPLORE.EXE 644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2312 wrote to memory of 644 2312 iexplore.exe 31 PID 2312 wrote to memory of 644 2312 iexplore.exe 31 PID 2312 wrote to memory of 644 2312 iexplore.exe 31 PID 2312 wrote to memory of 644 2312 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dbaa58306102db54d36899d8662addfa_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4576ca9696ca4d2afacecb80b0562cb
SHA1d8a0c0b0e71528b215c9e6ac96b014054384ad48
SHA256392cec918d2aeedd9c982a5c333fa4558fb0a977e6ef58a61af41538bda73a77
SHA512d6aa9159cb298c388b193dbd331b78fb402d44734a0915af4251919af8787be0e4ed2bdf2bf3903895c8b003e826c7aeec4f47b023a9f447a1d2fe5ea8fa56ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543a7af826afb5274d00226c8ca6f5828
SHA1c4fd5b7dd3153ebb9135d0022edbeb931674b3cc
SHA25641ada9d4730b3280beabb6fc11f229e1df3dc218dffefea75462243f8ceaea27
SHA512caf71ab7bae461f40fd73ae96ae11fb2696a65004e9e07c4a272f3b53462031cff1dbae098089b870c67680c3e85fb30c26828fe5d216aa601a0f4e7c5afb5b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cabb9985bf69dfb7e8e7743cfc6b8af
SHA18555a4ac640a3a2596ff6158f3745970a58fe6e6
SHA2562b2d6d6fa314fe0207690b13ca9fe84bed9aed3ee8535c5ba48af8d1ca9fcda8
SHA512cb8a362a66469ee93b43685773619822a601bb9e569d2a1b64e4c5f81186447c6568ae931a960721b68f13831ccc9655510ad67db0afee31b9a00467b6f19f57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd1ddc147eb7b3065dc3e97f36f123b6
SHA15ce95d26f1b76a9d285a96c4e625b94f8864290e
SHA256c9b2a50a645c17748b1e2fbbb83282e4f3194c7f14ffaf9ef623a86bb1491264
SHA5120eb468f68058f588d1e5f0653e32baedaf0f5483a7a44336b704b509098d6083857887fe9550387cc575dc375206b50c1400e920f9b2943cc4b9c03d210bf604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a82a423d7983a835dfc547d0fb4bf0d5
SHA1458b13cbe81bc80f3d7daf9153ca0648bc7881c1
SHA2566cf3e4fbdfe97097d8d9467de97a58bb7ff69539cba223c9050a36033994b56a
SHA5128fd28c5fea812f5c62bcd492cbcbc686bf080ec3aa5d8c3201673e2945c2384f08cbb8f0d87b4a05bcc48d1b0f75767e565437931865a701c1194a6ade12c5cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597b4e023d33f5a5cdbf5d16160b3bb8f
SHA19126dfb3e8480dfad5a2100904ab039c22b84e86
SHA2565fbe126e886094b4567fc09e1a74c1b3e01dcfece11e9ebd40f4598124093f04
SHA5123fbfb43195fbfb0e613ba6d309309a3f62fbea9caabc8b5f7358d4dddc901ad290e522985617fca52b724963beca751d06ca57447e71fd15acc8b66d939b24dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acbe8848f12e3775ecf9255eeebbe0b8
SHA156ea7abbfa06ce6162a029f8fdd8c661ba5387cd
SHA2567386bc043092dcdae9c4dc97bba8b18143dabcdb3ff1b45978413706b7c13740
SHA51233f00765e3121f4049362b8c7d518787889f89f40b9b4550f80800a1c4043cef8d0e3eaad725bec18bbb4e1f972e095a654ae918c221f91e802c443d91a1dee2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea5d1412b454274f394419229950cad1
SHA10eb50e4defcc5f42137f21b0cc97c264f29edba5
SHA256c666280be3c6dadc5bd9e0c95e7ff27edb0aa6a226111a2ecb73919be014afb5
SHA51296225790a48071515a0d073b0d160faa3c612e6f1a234830ab50a056a03eeceeab9ffed802650cf75dab6a166774af767fb66424d8548715584c9364bdf7a66e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1dcf05af7f9db102b1f14d554bd603a
SHA164926b5bddde243fc40052867b3ba02936d05b91
SHA2568ec52e96453285a390fc0c511453cac8515edbc79c45abb2f6d2f8ccc5511b57
SHA512283c6cd45095cd4f82d31390e73cbff93b93a34db8cc8b37478b4fdc5f34ca6de47c32cd147b0d44e61d5214402ed351f6ce161a2995e46c323cb28b2087fb61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb50bb39475f414a9d465b24d8974613
SHA1457d2220df21b56c592394c79b6b4644ae6e84be
SHA256c6c7f5f385db9982b718a5434be401b6b0b92a58ffc6da26cfe2e6d4fdf82178
SHA512b76fdb0d0fd8e5c5265a7a83a740b46cc6262277b87c6412105634253cfa872862f8cac55a51ce117c602022beb1281333a05b8f94fc2ee61ba1dc10db3a4315
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e47c7537e70d0518fb244eb473583df0
SHA1e477852963a1b8316541e793cbec6dc3018b3c5e
SHA256a7920c256aa4fe57ff2d6991527758974f7e2905bda0ce2ba7edabec01f11cf7
SHA5127e820605e66db346aa80cc48dcbcf373f575f531d285b00499e678f4481310234f1606a5f66f197c455bf65983fb9226166f6ba40702f981ce901216b66f68cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5842d0736716a30c2d941ec47c8f22489
SHA1794d3d61e5bba10d912baad741a78c4a4337c6bf
SHA256971a739bd2ca40e7d92a508f74e1ad634f3d3180662a609eace6f6dc34e9cdd3
SHA5121c32493fb00b7b94584630ed2cf57f5953f5996c5f6e0c738401d76ed23e1d183c186df0c5431ab803eefa34b38038f58370e8eddb99ffd481fdfe29e0d62d88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5febd842608d01dbd7dbd238d57d18c69
SHA129c52992b8aafe2e30f9c136acd8b846e478be06
SHA25629f19f196cac8a5163c085755f406ee82cde6948f3b06115a16320054e9d455c
SHA512b06e57ab953e59afe8c899bb8266815e856c8ccbe1e1a957afa35aca2b5847b77f4d4ae3454b234a4aea0beb815fa5ed5ebaac04ffb54f8a145f5c40e2b2d27c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac84a830b50a0722a1e73d3410cd8f0e
SHA13429875c773c9b3b2695a25c709bf7b73261c7ee
SHA25604d47fde85ef0cce315b4c716ecede81dd5b9db4c15e2458fad0786cc9f4f884
SHA512e16e3bce3a1de8f98d0c9c9cffdebb418351850a4ade18f94f92a6f9184c3da981cfab86d7cc77402d1501eb2f09ac764dd0b75a0ebf48ebe3550e7e7e2b7a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d391c5e132f5049a13a189a1c1eba3c
SHA10d590787ef4cadcee7937315bf274fb7056da226
SHA256b0989292dba31a44642539a956f5f1ef4916bf6aaa6cbb2259e7d4f181b67c69
SHA512933379fc50b731df0f163fbf76a9c9e6d36d4da743275205ddf964dd881e86dc9aca89b11b03649e5783e46597873ef5e767e3adac15165dca7a42e61fb00c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a607f3c86580b4d99c0943d301ca7297
SHA14c5eb4b2beb34e8bb3cff9e167e6f515dd365201
SHA256c98078a91ec0d4188c88442d4da35ef5782125c4a2140653978adf2a8de4f267
SHA512b3e5c51f8608df13735c193c22bdba6fe3cd47705ba734d7898a31c3fdbe45ff665840c0b4c333cc5b8813f674c244ff08cac64707ca4da95ff05022f25e6dc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51816d1c196a3724c53abd7cfde47956f
SHA1cb5d7a004cf0684e7ba5b7d74e6c6c0f4cb0dce8
SHA256cf6cec32dcd989d970b9caca3f77a942d5640fae0ec6dc858ba50e94f4ae3c51
SHA512fb192c223a349c4524ed3ea665e0706f90f8b8a67ceb96a367be7648aed40c1313d547c6beb6adf99dc917901aabbc3687bc24479fca930857d76a8ceb597f3e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b