Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 05:43
Static task
static1
Behavioral task
behavioral1
Sample
ddc8cd4d862ddfd9cf652e08c428c4f7_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ddc8cd4d862ddfd9cf652e08c428c4f7_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ddc8cd4d862ddfd9cf652e08c428c4f7_JaffaCakes118.html
-
Size
14KB
-
MD5
ddc8cd4d862ddfd9cf652e08c428c4f7
-
SHA1
e185eeb16d73f712188fb3bc39a2be2899c7e69d
-
SHA256
19757f254cd4f7d03677eec25dcdb66d86ec95f4d54929bcd2509a4f744079c4
-
SHA512
26ddc921757c012ce03c5d9a59b0a36f80afc0a4b230f215f6a56863c9bee0b1e7b65edaa7d8d037d2f1bc1f7f159dc6697409af9f8dfa0e056a5c41c699b97c
-
SSDEEP
192:9cXNhgRauyBnOjX6bC9Y1QruX/VB4cVBoBy58Z4GNwU8PKmtoXUaHo0UP3556lVZ:9cXU0nOC30B6UqPKmtQDI0U/LG/7
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a03c09e89f05db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C5A9181-7193-11EF-837F-E61828AB23DD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000005c91d1b460c9e812606cf9237218f64e54f371a8a87cc86e8dad55eeef49b5b6000000000e8000000002000020000000768721b0108ea1d628b7ae6a302c019f554b8b60fdb2d0940d9ba2f239efc4e390000000c5465b5038f6abaa8c852560f8534373102e3430c88d2957624fb832aa11f6338e725230a676e1b8ad1f9990256b30f36e1306e21e27caaab8b4b623ee7c6a2ffac0169caaeaf3d8fa8dd40f5317ccc0a93c81406d731bc000681bbf0f042d5677ef28715fa353a79ffb6b3eb58bb5125396e4c1b63fa35f224f57a02db32a7ea7fb48639f48d5ca75a74bf9890c85524000000098b9f3db3a449ec7561a5872a6cfa3f7c4650d638ec8475fc59b3e94975a29e6e0e29cc3050882d78be86f24d3b712e2886cb5131cd0db9226e75db042f189c0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000000e04e1a23484d7bff31bcce8d150f2777c975995b860e91b6e4d47b413193d6d000000000e8000000002000020000000f0bd3140696d3e0617ce8a9ecf30ff2764e31852acd4b028ab327bdd1ca9bf2e2000000041fed4ea581ead8a39b0ebc150a8fc265efb25a842fa96aefea392fe6c35353b40000000905ddb2dd41d428b2096dab82a9a04f113ef21314e0d33f34b73b0f0e1e2d666eabd87ba835fec2dc6cce30daa59de7b36ad2c968ec4ede5a86c31387f1d6527 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432368052" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2060 iexplore.exe 2060 iexplore.exe 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 1060 2060 iexplore.exe 31 PID 2060 wrote to memory of 1060 2060 iexplore.exe 31 PID 2060 wrote to memory of 1060 2060 iexplore.exe 31 PID 2060 wrote to memory of 1060 2060 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ddc8cd4d862ddfd9cf652e08c428c4f7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5985bf11cf697b1b374d97a6102a0f9b1
SHA11b482f77c790276b33a17c1bfa080e0e5c566993
SHA256eba73292e0f8d30a53bdad48262d5c8469825384accd2afe9d60251123570540
SHA5125727ec1acf5c017337896fa39ea606cd6bf70bf62452b0c5de708876fae3a1237d8417b17a89a6217701b63e964099f4b4ea89da2e324b4db12d3cfae82aa81e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537a071bd92256c6d6852c59c5a65ecf3
SHA1a73d6ea7866352bc887f10ce6993b5dad8af0d96
SHA25635456e9ffd861d3894438a386b75290e9f73d9cc49d54189cc408a6277712dff
SHA512184e248df7e701786532985973af0da4f20f93379e992d39b2d94539663d712ccc849e3c4b567f655ad8c4ebbcb44e34283d61b6511215ba1624be134cbab9a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc3571f62cc7a367407db30cdea82d4a
SHA12f9f1b9780ce6be4aef251e3efc6fb779a385af2
SHA2560fbd335719ed0f075c2c4ac2991afadb77135becb0d4f8eeeb280ac300c6b755
SHA512af8a36e94ae5609d741ddf7eccd41f494caa6148bfad2dc7c43bc31ca276b6b3e8417f177662722bbbd12ad3d0f20d055f17bda09bb0d2d58e59b0e72588f615
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c4cb2146f8fdb2bc69939b17f5128db
SHA1f98c6c770a7850dce9e94fd62613ed3a08bbb51a
SHA25693c113978f51000d0851305dd5a0c576a009b6c17b0f38f686f3c072db74add7
SHA512fd12ab357699b570c65f6a393fef0dd5bef16e5186e43143d01bed8f164fe9aad1e0cac590b5b6c7a347f92dd52ce75c0a31930a72bf7f4626f318e0bf8776d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8d1259ad65e527c28112e4425acafbe
SHA1075f4d164b5b5fcb752f7684e5a24203b856eca7
SHA256f737dd5e3c3be9cf711c9624f9d738a7752870548f1630ee2d874f09998e194b
SHA512b932fee693e9348c9956810271796de8c9607a32366cdc43be8840d2a92691d3fcff4027e8f608bf668f5bef227b66784885737f86030deb4169b5275cf416bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581ad50cd1c3c2c59a2008b6a6ff24f87
SHA18f7540dcf9a8e765c4f37792ad621e8860a133a2
SHA2567001ce3eed33339b7ad373a45875b074f956a38207a5cb08b7989bce0f1efeb4
SHA51289cdf4078ca6ac7a7a30981fb0c1f51c83349d6652117ddae36d5316e954ab1c71ce383e2ee653d575f5f76d4b3e90a3c760120f5976876cd76619c6005a1aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589df4a4c8b5e695553a8f94aa26f543f
SHA198e94bda3160f0de1a09c1efa2e4f764fc25a7e8
SHA256bf2bac08d795a934a47ee0ce45c5f6226b90ab8831cec65d8b5c0da19d97b742
SHA512f16be3eb228c6d24fef60bc55d4944b9fb92a2889116bdd7174fbcbeef78c0a2204093e8b522318f1a434ea18bfdb7713710b40fe785deb19a03db0567990e6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e4f76e9aa5347353e2f001ed6695f7f
SHA1d90c74aa174d6478e020624a486457a475fa3098
SHA2563028fb30a2a487b2894739b7199ff04f3d86cfaf100d3c641d135d78a58d7b75
SHA5126c554ea9d45d66fdb49c3639b5b11a82764897606b78592bf94031f72e0473a09b43f8f06a08f6c3a4eadcbab5204726aa233d00044f8304dc21825d8ba7de42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581385009e5b42baff072fe9e7685ac07
SHA1225ada8c7efee2e07a53bb9270dbec36aa71785b
SHA256496954fa94243300e3bc88df119bc6a272f8e4bb8565ca94e0fc93c8c86e506c
SHA5129afe14cf123903d3038ee78fcdf9adfa64ba38c8506854e5b05e03bf677483c198af05c340b73def64d93b4a09a1a317ab6f7428409a1389a9e9e8e87b3196fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579009b93e2702d11cebd866cf438a83b
SHA17c8ad1b1b4d663602b8980a55c9a66c2c1d03bc3
SHA2567fdb8cfffa129de1e654d596ec75253469be817a93e9c47e4966a217948fa3f7
SHA5124172acea7a4d6c41dd9e2bb343aef92fec2d61d42c31a01742d6743835c6a9dfec4e425520f9a3e3926e478cc33df449dba90943dfe2d5c420a59cf09073f56b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5042a81327a2f816d2fd0ab20e86e8eb9
SHA133f0d7eac04597ba332a20306a5620195ba8499c
SHA25697c8249b5d51e7f1e8f5e435e6ea2999c1af3370ebcf41f0ef3a3af5fa395473
SHA512ee2895e40f39271b673e12186e01eba1c4c1bce079e40f78d51a2a64de9065e9e43b32d03927ca8df8734d36b37b785fde0fa6a67310649750dd21149df338f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e26e20cddaeec1cb5c57a869871ea86
SHA11e6d97ac6e4e019ec5c772b9ca9811e2d80d7c83
SHA256db5ae2f9b96049cf179910ba884d0b7ccd9b8c7ea953d3e2951662f1eb9c674d
SHA51236609114ff5207e3c92b77507a880b6c7e0b84f7fbc6e018b308d2aa55e5bf4e229c3a2d37f8309a8889d2a9f2794865d299a19463d150541cc9e5de9a71ce98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52db3b1a1984833b03f07607676050467
SHA1cb84ee944c92bb7b764fbc304847009e7336de64
SHA256350c4655660e858eb4e9af78cfe79c3f605035f0418675c901b155ad3f09180b
SHA512d61a836a26b69c9b2b63a030d7b228ca346ac7765aacfe2382777358566483ee62af640caac5cddcd6f4d74722d347161b409b8cfbd72065a446ab85dc655088
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5165aeab5793a3d30fe29360ec03382be
SHA18a56e70c5429ba1422ea2812a77c5fbd42a4dbb1
SHA2568183f316eae9fd31d3356cffaa609fd0b66075403f5d3e120eb7774e3dc483bc
SHA51260b3541c63abb411563f1c41b81b6686a0fba2cc51751e23208402429a393527a0269b8218f4c8bf3b8ac2a40ab3da6d9c7e890e86b5dd916f69772351001fb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac15e3d9d8314d287468653231df9ad3
SHA154a86afd33271b7115cf75d0744f136afaa7d3f6
SHA25633ca76c5adb79c4163bfc1402b29dc51bbd598852c89cc8f9cace8dfdfa38e35
SHA5121f878ae87896b45d2219f131d541844b03293905573659b9fcc1f9e56e6a13ecd52dab1a785952c76d2a78089f050cded4188b10532de3a7d0ee52d5d46975e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ff78f707f2d593f8b0d0dcca10b5245
SHA18db62002aae62d3658628876d89cc7aac41f74af
SHA25670b9069bf2251001643ffdcd2fe106d80a1db4c5f5004a708579183d4e26dc1c
SHA512f7e339e11f0cb13a59d2bd23c0682960d0df000a99591f0fd53d28d8401886ad88f34e7ba520ea613641a88a12bc1db335ffb43e02603cd41a4c39a441e00c62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567df4d4ea72a2a11e310c55cd7fb5f27
SHA146c0fd65caa138cc0f70be475646a5d9790d98cd
SHA2561a03784648a112aeedbf36f2c99240c4754d5cfdd89aa1bb132f8689f3f7c592
SHA512c9fdec946f8f179283eb998db315535a0b10a22a3c07794ebe9db131d8a70d1da05fa8ebace760289d76224953cc85a5cf5fc02923e108532e63dd7af4c49992
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5502d631bfde72a8da48a01278be1c579
SHA13b31e271ed0b1604ae8ea6d40faa7d71a6cce8cb
SHA256cbb3dada04beed2b87d44f34292b90c8e99da26f5e48216f1a8b464e236a34a5
SHA5125c0a208bde40020b023520447d38b91cdac7ceb87dba9b155a111981261318bcca9788482e2f568676adb9e1296483de325cca71468e2c1b13096ae1a8a18886
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b