Analysis
-
max time kernel
133s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 02:25
Static task
static1
Behavioral task
behavioral1
Sample
dd7b0ced86400152f66cd0ff01eaa600_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
dd7b0ced86400152f66cd0ff01eaa600_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
dd7b0ced86400152f66cd0ff01eaa600_JaffaCakes118.html
-
Size
2KB
-
MD5
dd7b0ced86400152f66cd0ff01eaa600
-
SHA1
13aff1a67aa73621ac1944bfefa55bf35cb05189
-
SHA256
dd012f52490e0653fdce23e255ef603ea7b733252bcadd5f345fa4935459f314
-
SHA512
589155c0b7bc1e42f696a326cef544f9b7cec2c9daa4f1d29428b4de6fd9186f161c8eb97e95d5c604a2577417e90c0764f982635a39b9036306238a1c96c066
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000691cecd38f96e8eb3adc1ee68197afd2b63e50c4f0b34f3169a2da5ac88ce5ca000000000e80000000020000200000002a5c0c37b778997b7222c0080fab97a8447334cfb3ed7a2cb3af30485fffe33720000000e56795693447456203f2720f15388a732429f9152bc23a1e08bd43564ab723de40000000a46558ab7916ed699b9c9bbcb736ba48eaf0f8c169ce7d6ecb4598919169ac76062806e989714bc297bf7a33253625a9df9ce8857438ebe938c0342316317441 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000406fbc530de4f87d46439de37d489184930af31716d948ad8f51b413eb83d371000000000e80000000020000200000000c81f94e45bdb5180491829224c9866936221ac5f6bb351316f1e4e9794b4f1690000000c526aac2c03de32e7834782e698ef12b0df0fcafc6ae4b5f7b65e870aa84d80df5c707564962e9b2f102a6c395a07c1d525a96665877ba344c03b295b5e58cbcc50fe102994d0bdbc984e9908a403fbd161606d2f0993a899a08d13010ad3d78e726e082181749ec44e8bbae1f860e5433a8cf18deae18053954ee3971a9ea352f0a6d1fd8c302cd098b06494305bbae4000000024dbe4186acb3c516c01e98d3460ba31b44311078e1492551c1eaac837179a05506adab309dbba5fa27c96d81bc56f98ce3ddf0c4cbc8b1fecfc56a000231f9b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432356207" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77965AE1-7177-11EF-9188-62D153EDECD4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4036f24e8405db01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2704 iexplore.exe 2704 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2700 2704 iexplore.exe 30 PID 2704 wrote to memory of 2700 2704 iexplore.exe 30 PID 2704 wrote to memory of 2700 2704 iexplore.exe 30 PID 2704 wrote to memory of 2700 2704 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dd7b0ced86400152f66cd0ff01eaa600_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ad5640069a97baaf81c03878adbb5cb
SHA1642c04812231bd7ece203997a21138afb707e1cf
SHA25625e3b3ab87224e6dee029364d9f6769f2f391c3fe934faa494ee068a5f22ba78
SHA51211d8f0a219102df8565a862f81be77deb0c6b8fdd63ee817c83f0cf90599b315ed7c77d9ebd978d614dca6a0265ce5e7aed5bfbca65847fe5cf0d73c58aaec9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ae5497e8e61cde121bc1f6590af4972
SHA145254a1d4e5e5c486a3a4c34e47aa624ce006129
SHA256e196894afca8d0f95133eb7fa5a84b67f7e63071918fdd4ceaf6c53b8b40df8f
SHA5121133005442dcbb4cf232d926e17b8d8ddbab5c99cf743031333e0f1951676fd09e305f50dcc8185a302ddfd403709eb71312ba52824437d7c52a38fcdbbf14fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec78053170f14da3525654c6122e1e47
SHA1f3a5aa71fed3af1ef3fae352ffcdcd8c8c7148a3
SHA25651bbb51a136cd597fdaa014275665f01ad6ab41c1bdbe04c169840a923df3cda
SHA5128649e0d58c1f747e2dc54d949c847466057be368d8ee1d87ba0693bfbacc134c3d318fafb82d552ed2eb43ea924dcfc21c628586440b75c28900d65741fc105b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537cf21a6d83a12e37a88696efd0ca672
SHA164d44d1364d012f776e001773e1f1ef9b692efa9
SHA2565726e8cb2dffc184eb6d9b160c55626de3a2adad06a1f137b8590a13e377e08b
SHA512d680fe04f4a1c87d0b48c44cc5a1585f5ad40b6a1fd48c8dbbec067777d6a68a7a4b3487c0bc9c40e9d876b822bf5a6e6cbc6f07c8de769193f00b13b9074616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ca3ff0ca8e32d4fc7fad6a7e63118a3
SHA1b9ef1e65262da08e0da5ec2de7b38ba4d5c84bd2
SHA256143248b738b6717c9eba7f47cc6651790a78795a5df0423a5a723c72d5086d71
SHA5122fee2981f8f475b57a6a5e0900b8b4ddb4ae7a6f5772c81c58f31ea43ebb7bf1acad27d9df95b30e2693cd16b01c52c8e552a70a97a176fb49c63f0032642bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d178cede3ff99d118f2d76d552d10652
SHA1b300d6a3b3363b624958d4216a7c730b5c9f954d
SHA256697c80a95128b45e686fb9bfb54965647da9af63cfe989dc796da1fccd2ec923
SHA512c9480f34be7476edef205ea9ca0f11b9416181e25b99b8cd190c7a038fcfaba96dc018f6504c9c855de03db7de01bc14beda4045d179af1191230c881bf2f2d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db8f24bcbe0afca7f1afa1d6cb5e91e1
SHA12eb3b8f9eae8de03d7a878e554784bea6476ab18
SHA2565d2cdc67a782999058a71f68cd4c4ecaca53bd5931df0c356ab3afd75f435ed5
SHA5128106f49333258cb20af36136e3f84af884073fcd74ec7a8cbadfd2fa3ffba21def948ab35e1e0d7d470b06c15e0832b643f308fa6fe952ec01c076f3aa2f642b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a2249014e044b26feb21076e9e879ff
SHA1e0f0e9b438a80e749528f24f10549b46b5fa5708
SHA256be8fa516ab76658685a47f461f7741d4169ecd766b827cb3e17b63d11722e119
SHA512d4aaa0856a10ec4f6a873597280224fa381f33cb05fb031d6470bec02f3c07be2de48f139345752434616924c801f2fba3f8b028230c857b05887c0c4e782d85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5213216b09ab931cb7579ea5ce2c1a027
SHA10cabbd20a79e74e1887e5ab97d50e64dbc8e61cf
SHA256882419852d63ef172f4ebb14459f5970c91414f6015fc112787db46661863006
SHA5126a4230b91f722b89bdc3ca7447e7be5f34fc80f436f2782849e282f7c1e41cb263b49fc21d79852bb9f2179f975ef53b3295d4ad31a6a79d2f0758f9d0320e79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590194ba1844764fa29a56e7b03ac7307
SHA12d83e469fabc8a650c774fa7fba357c2c7df5aec
SHA25619a7066d58a21c63d6f35c1f5066c9f8b6f534e8db05dc84aaaa8e10d4914808
SHA512b7caf69fe3a9764fb6d7826236c36ba144a12409e4fb138f12205f71f4c52b403309c2d6f495bc8ad77fe8b740c5f8e89168b1999f1e8200cb3d9fc7e776798a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51af6b7280aa5b9f781c302a8c292bdd9
SHA144c9091ea064fa30b9b71532d3494b85d07c635c
SHA2564f74d180b7287bad8637c3f8d8a3c8cc09c62ccd8163684426f2985436bb370d
SHA512be2e1efd4002d8d1de803fd7a8624f8e3b348e32d79eacea3e64090a536e80d63aa54e0ee7b930700dd65a526ad91d369122b58b000a678a87bb5520ef4c350f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508eea63ac4ffade4631b2ad896ad5f79
SHA15e7e82ad803f691bbfe67d2721b7a938f6873421
SHA2561521211d5db20aec089c689e10bb2cc65c2a07170a775b50a9fac2bc56b2d96e
SHA5127cb6d01cc9965d781ed35effe349489457cfa6706b55e981d2ca0674a49670230aba7060e9e2fecf6e4d7e5403275ccdf1a61c7425e23ac603bc0246351e59a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3e524f093a6b240ee7b6e5c092b5ff1
SHA10d5573f07014294a2da1630624721e92adde80ad
SHA256e9357da86699bfc46edfdf45459ee07a3973d1ee90a9652028c917e646070546
SHA5125ab88d8df354ee937b6ed53c60a5518c76ec4d5237ea3b8c026c60488decef9073eb8fb87da5da04958fe1cc95e7cc2146f73213768988d43627216a12c53a12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d449b37e930e1cbdf219bd2e60225941
SHA16c14f7e3a9f82b5918f342632110fbf6b8f77d0d
SHA25676c3b23f65b0c412186667dd787ba3b37786440c417c899f5370cfcfe1d6b547
SHA512ede0229ce162f43801a0795fe671e0cc4940b462dee556624e725df4a505823ab5584c8554dc8e32b4f4940bcb9cf339f906d4e5ca6136ea7b153674ab26efe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543d7f3f405ac1b2c18ac843eb95c4085
SHA1f385b1d695a7ef951505d54c76c448ebdbde71fa
SHA2560f09dfbd824abb67ad43ab08ea4a43819df463ebf9b8a34c64a8ee951ddc5c94
SHA512849e8fa5bc02f7996a88e3a235548e73c11c1cbde9a46b9e97c23fc53b50e9bb2e9576a56f82aabdaa8812b6fb1a544bceb6a5eaf35ebab825b4605834fef9aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a0ee40e0ac66825fe9ae2e66460a22b
SHA108ad194109d8fd911fb47138c381ee431194d0f0
SHA2569d486481b8c0053ae1b0b5edeedef4ee16f64b672d5ebc8f420892c9002425f9
SHA51264986965e30b8dd29f2e437234828c2d53a6702eefecae4bc3c409e9df0db4d2a14ba6e7db189fe4380015a590cda2b89e6bc9f1e8525932870f32beb20101be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e2d5262f9f9befd6878b9785f29747c
SHA1efb4c3a833451b3f39bc2dd9c6752f99bf3a4fa6
SHA25611ffb8663e4c782a16ffd89879ae213363d0aa0739f6538168bf64441d3be284
SHA5125d22aa9029d4796855e555079eefd43875e9fd8c028b20a85b391144c316e77ed1a8950ae37f5eb1e7cf1987a3e5802ce3a68127c6202c0b3947cfbd710b12b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a6a144771f62ce12fafd014c2e803b7
SHA127200f80ca503707ee64c5df3b893cbeede399b3
SHA2568bd64ffb051a1ff088c898b9d4d6b5936facadc5af3f75c45a31d242c9d1fa81
SHA512e3701e8b45e5317acfbf9109eaa7032bb5b8bff4b57fdc11f3d147c05341f4cdec25d5c66902cf3ac59980784dd75796692ea683988ca6149780d1bd26c0c291
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cc8533282250866fc11bc0d58297b1d
SHA1b92353ae383f93627d8097532a67f0edb86f716d
SHA256388ca07c7629836ae197617e02ac7552f95b73867a2e03e6e8ca26461e1bc735
SHA512d17742a3e9be40de8287170755aee96d61be56f69396015905e69433e29fa9aaca5a7b62daee3c08c2d8ccfd4529e7867ef864f8e7c4ab8bc388c990bd089fd3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b