Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 15:36
Static task
static1
Behavioral task
behavioral1
Sample
e07d5fcadec125feeec8799e6fada595_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e07d5fcadec125feeec8799e6fada595_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
e07d5fcadec125feeec8799e6fada595_JaffaCakes118.html
-
Size
78KB
-
MD5
e07d5fcadec125feeec8799e6fada595
-
SHA1
f904ebcac4ccfbf60830b8a7e15fcf2e281132ce
-
SHA256
20d5b46bddd5a771a580cfd50ab8505fa70e4e1716fd65bf56f7f47dcca43af1
-
SHA512
86dcfc9d4fb6e20e3afb6942f7e4372097eb868f1b7cf8a736093ff1f3b92101b8babde0864f79b8aa48dba1b473d007c1586ae7a7c422e0ab81d2d3970a2010
-
SSDEEP
768:C7h7ye2sH/DXgyRCKoBfuS/7iIuKzNyGsaMWxS+ujsRA:C7h2basu
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80fc1e0bbc06db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432490087" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C7CC381-72AF-11EF-AAC7-FE6EB537C9A6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000006f50f71321b36e0607743ea2276cc1f70e2fd6bb1f6760267b505ec0b3cb7c26000000000e8000000002000020000000193729d673211d0e2536d042b420d780c7ffac4de8cd7c3cd412a810a6b956a79000000003be7ae8a8db347f1be37f8eda6b86cf2eb7ef1b7c6c47868c3aed2002d6e814d7fc8f8e0a1919ab483ffe498c0983bc9cfb1994f990c20dbf01bf1ccc887dfa57ad96fba9eba6fcd962bf3e21afc7cf534f7769536509679e1940875ea7bf76fb7bb0b9d7073a5b9b86c690e22d8aca9e19547966bd43e7d84cf9ebaa003fef186691abac3fb7b0db41f27fc40e6c2e40000000c5c7cd1467334de05042495353c3deb1a4dc52d35a10601225350a5a1902f4539f374d14f594b8dbf317198fd3bafad177a805e3fe2c839ea64d630590e5196d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000754feef64c7f9dbb27834d9b66e4e3592b603664160a16b4f8e21e431871a5c2000000000e8000000002000020000000abe24e709acea14cfdc567325ef6b6c8d993cba152b5ee55f5a13f3395ea3c56200000005924d9db2a47bacdca5541af8bcb972c479ad78bd299b57c8e42f4badd3f3701400000002c9cb4b7d114385991bd23b01779998efc9bfa11c87ca0763b4926e8cc71c807dd8899ceb5832b3655f75fa7567c0ee86231b8b6ad20878462aacc00ef10cbb7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2328 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1908 iexplore.exe 1908 iexplore.exe 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE 2328 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2328 1908 iexplore.exe 30 PID 1908 wrote to memory of 2328 1908 iexplore.exe 30 PID 1908 wrote to memory of 2328 1908 iexplore.exe 30 PID 1908 wrote to memory of 2328 1908 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e07d5fcadec125feeec8799e6fada595_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1c85d0c5c20c5381bc2edabee125b56
SHA1781d41a3577d5352c2db67252dbbc34e955f1384
SHA256708ba40c1b74ce6834976f3efadc76665fe7583a512d04aaa74680bf7860e286
SHA5128a896fd9a9e8b714a3056d68aa148722c72257d522806eee68963ff30325db820b21c4f8f5def73541e9080774470dc2f68cecdc8e465e65d780a05db7dc3630
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5deb03537d2e86eea5e721da16ebd6f1e
SHA1f750756ea2f43940f7252948ec5a8099604751e6
SHA256ea91d583d398957bfdac3f182aa73631ba5234389b1f5ee97d2410cea0b5b1f9
SHA512584114e6a974cfd7f61afde8e11d627e4a4a0b4d2d61c475154a8210c011dd553dd13358f1ad2d111de01dfdbb0b60c2273376b32b19d08f952b60851a100950
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af8fbe81e39032b8f3230eda8ee9b6ed
SHA1c93cd83095030eb31e0ad4c6e99986df68b05e5e
SHA256b1a14a3ed0275a8015d7f3c69658912e1bb3de4cab2fe271a8b9b187d0d17a40
SHA512011300a520a7fd17bab3ad75c5546e41fd9b4c50f0974e6ab4ede3e7754a0b2a1d5abf3db19d164fd15387f7ba42e3da05d703ff3ad8c08dcb8dd4a23392ac8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5516c41be55271262d81956f5b65789f1
SHA1ea112e64c2857d6486a81d93faff905ebffaacf6
SHA25620670b2f668459be82e7f2e5c103a0626a40ac1941a044432fc9c6766272ffd2
SHA51261b30d5ed2a783e530ae215234dbd2f26868e6705b1221ac0d5a86367baff6471f6bbef143275417c831fc8b8865df015f3a70c7efa09b6a5b653093d7b72d89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f55bd6b0ac0b1890c413c52b84a9e15a
SHA1aa436cbb2a85954abd1bfbe865406f6397ae7222
SHA256a04732fe7a4bbb653aad33add51343e6af99748b4100bbcc78d3fb636d971723
SHA512c4423cc32d16737ab361f5736352a9dc929d16ab6711a0371c0a2b3d921ef80a3f3d6efeb8efe9f92b016664b7c3ab4a18daf26ad8850e38aa0b44ee1bf93b23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5232e26f3af1f20fe25b41d47b11cc8e7
SHA148a1bd8fcd5d5733d07c0fcac5bc0f2e9d2f5654
SHA256911b99c73cb373fc539983670a4f335653af6a993c68660c774bb2f247b7989d
SHA5124de4048daf356b786fde39acc4facbd096a6de84bb88917426f4c75ff25a43a63a429f6ab3992555da204f13abae48cfe1acea9ae172ab24a1350039058991ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8589ca5ce34861d0696f1fa408bdd51
SHA1aadb7e8c9b69d894fd37a41feaaa977b8c529eff
SHA256c0472047f88d0d3c5ac7080a44962077dd6467a96f75987f7932b1beca1309c4
SHA5125f60ce1fd6bea98555264303ffceaafdf234bd7f2fbd83f9fff4713f8db9d48a20fb1e0a3d911f4600787a0809b5b8c6a912874f0cc814532302488981d7a126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55be7a6b5be8211b2ac4e080455de7201
SHA1467a8ad4e4b7c86461145f9fd5c3c6e001334b21
SHA25661deccad045877d45b908df7d5cb64cf19a41180ee52b022e67eb328dd0156d5
SHA512ccb166471c8e35be3a6e8b766a5adbd4cd5a9470792d856b554930504f2a8317d145812733b1ab28995290b723a80442d20a245831104a53993cd36aa0a81e65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f24795a70a1fe2e1cfe41729d01f0ba1
SHA101c75585196b1fe5e3e2c7386ace863a832c956d
SHA2562d97438149a8191e94188d391d195105849c60889f947b9aafb53e1e641c1e7b
SHA5121a6600e199b4af5b34e980f70b67b6c3bad2e488703a4a69433aa7197f0adc09ab0d9c6278d5adfe3310e93049842a5501f030c095fe3f3ec937daa35a1c80c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc60d68efe5367974c5f27f59d9da931
SHA18244b4a1e4275c3ac90ccf63ae65c3472b43dcd9
SHA2569a1206a933c5bd4ba9bddcc3b594edafd6c5993d3ed8e81ff0562cc405835527
SHA512776980213633792a786ebafd79f2febe3a94729dd752c14252ef9442f9bcc63871e92f52678d8051a788a1c22cd62eb1daa73f26a294fbb664096175b8222266
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5169b65fe2b7924b89986a5d24fd76988
SHA1bd1f479d6be77ffdb8aca707bbff97b60d23d759
SHA25611dbca4d54a44952b9a44134a520a76bacebb9478bcf92dd093c2f93ab9963f4
SHA512e464528096f2844db7093f7a795637f22856208e7e64fd911c08b05904f94738068b3bd6a99da69001c6e3459f4642191a858749ba12670707d1a13ffbf8e518
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56caefbd1dee9867dad7779a422038791
SHA182625dbbd252b890514979e2e85cc6d7c30024a5
SHA256c0e499808862cbd6f4677b1f111e46a89ae590a198c8a1be3fde4a7c6a52fa9c
SHA512cf5eb6fbcf5c7817ebcd49485efbb7dd2637b8560fa2a79758165d52ab338b62915daaa6a12f538ae19454ed0b6096b3afd9ee04071ea34f135ea065237b5799
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ce36b49a37f29e5c243ee14a51944e1
SHA1b26bf2f8ed1a1a7350cfda279f28c0f54ba8e138
SHA25621b23c2a3a4b0555244669815437c6be47cb2c4c8539c1918d90661f57610ab3
SHA5125efc2d351fc0a52adff8e92468d469f08460f5c6bcbc6c2ea04124fc310ffe0d65a35102f5137c6bdff8c3188fa2eb7d882d7669bb2d41aae4a1f7816f7b30ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5263f2d520b64660eebf270d408c6c779
SHA1639f8b3e86ce7cf77c97b57a1165bc4c96773337
SHA256e4f1a6918fa4ccbc79c1bd77eccec7d551ed45f1c3433b0cc77eedd439d818e5
SHA51217db4b32c0e3aa6277e4034ff234509fc41354c341192767041dc84f6172565887f3208a90ae4593d30889dabab37341a64466b369d85708c5131fda0dd12ccc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5698a71ed0109ef292bde738616e488e6
SHA145a07de9d1f97e9b00db7a0309e5aaf2304c7dff
SHA256d386dfde82b530f2d8296c94be8970ecac4f075aae39c564d8dc4e92007006ee
SHA512f1ab85ce6f993729200a47c5e1c5952d6d4596e051573730187119a50033ed9f265e37bc2d3d017337d334e553dd4e419365ae06bbc25fab7d748d02e1d4e498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d46dd86a3e26888b1e06b06c233b3bfc
SHA10c49616b23ec3c8ec4134c68023216cba993f8cc
SHA2568331a2e3e219101491d2e1db1c5f1f8e8a8604b694d994225c4f1d36f31eda17
SHA5121e302a29949c10a15f50c5475d73fa8f63381b16125da386825e2d2348d5d0da3c20e8d2da20cb4403a2ca6b66c5222aa51674d6b242c7f5d244d9f84be88691
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da6f0ca7538fbe0502e6c42efa1d9a72
SHA170b275d499fae0ce05c10420a616060c88d1bddb
SHA2564a487432d0d29dc3440f54cbebac6f3d8e585bbfb0a890dae33187404637d4d8
SHA5123763c05170747a4dc0884e57010a50c7bf5dec873699472f4a29e8c6607a9ebe68cf7138bde33f18784ba0857ee6611d6ad82e0bd2a3779446d3a834e7cd034b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b