Analysis
-
max time kernel
118s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:00
Static task
static1
Behavioral task
behavioral1
Sample
eab7a1cb7c85ceba352a12f2d84e0bb8_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eab7a1cb7c85ceba352a12f2d84e0bb8_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eab7a1cb7c85ceba352a12f2d84e0bb8_JaffaCakes118.html
-
Size
68KB
-
MD5
eab7a1cb7c85ceba352a12f2d84e0bb8
-
SHA1
ef1c9f2003d6a2392eef8693d302797377b162e2
-
SHA256
2067ec020492941befb5a2010e5de1aa0b2641cfc6a530c6260b6aec8353f805
-
SHA512
3334893cb44b20af7230e2acf4aafd4742f0a4c4155d8e478d843ad9abfb53149d573bf0d7f293b65803968d3eddd16439b1983c3e3651740bd8acd053622e3d
-
SSDEEP
768:JiZgcMsSZ8tN99OIs0mMWoT2SqQCZkoTnMdtbBnfBgN8/oygcRWQFVGys//IjkKc:J3WHTEPec0tbrga6crNnz8PJ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000005a175d52df4f599458c34fc8ee65be98b156053dff2b9620f3d9949c7b9f9814000000000e8000000002000020000000b6802d6de1dfa8463e8a76a837b9ed564648f615e7566876f04880a068cd7666200000000a2797d93e377579e499590ce2775f7585204b56d35a9bcc455e08bac68417f540000000498746727d987836d2189daea216f5e31c64c44a9f8ca1b2e498c2afc55ba1f485b88772e1ea189c9f6fa492e6fd738cc3d09c4e4c46b51e64f64bb08a253d74 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000c18b6a955ecf592b273cf01584f504dc48562d66ab18b7052c909e99f4ec1118000000000e8000000002000020000000c2ab95b4817da8e94dfeb8273b016ef60f37cc845b9dffc58ee6e68ca99de82090000000fc9103b7d1fd0266fa3cb1cde4a08cad328cf62ab1aeb4e5a19890615fdfbe1c3b0cfd0ca7724d082b84339515c72214b2995926a8ee7229bf12b8c22719df13fd3d01d99c8dd6caad0fd4759bf8eda03721265683fe577d75a140edb6ba663cca110f8a4bd8cd1c42a9926069f57403d89e5595a7a80303d53b4328d9f9383e4e8414f7e24ad28ea46c3eebab2d6d67400000007fb98301303b69fea37d5ca0838e2c0a04de833fa98971e041dbb4566cfa41ba1fc8e178e022745a31f33d8a342fe7f6d11a6402f06e72d7ab6361c138e0d175 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8858CDC1-764C-11EF-A7B5-EAF82BEC9AF0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ff955d590adb01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432887524" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 1044 IEXPLORE.EXE 1044 IEXPLORE.EXE 1044 IEXPLORE.EXE 1044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1044 1992 iexplore.exe 30 PID 1992 wrote to memory of 1044 1992 iexplore.exe 30 PID 1992 wrote to memory of 1044 1992 iexplore.exe 30 PID 1992 wrote to memory of 1044 1992 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eab7a1cb7c85ceba352a12f2d84e0bb8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547abc261e0a31aea5d7d1b321739f4a2
SHA15b3d93305908d414449a69b1544c5f958b821fb1
SHA256cb6659cabdc7db943b6931bcd7f141858ed6b3b39688e7a8a029ec34ef601d6a
SHA512c0277398b725c4ab33cefd331219d279ee23d7c09cb428af3cc3c2ad9c798334e3f174f9a8f3f4c6fea1e44e6fea2f3e85bca744f438d46e999d8c4be7aa93c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5ee31642cb12ba5778f4a1d5e5ccf76
SHA13dbaccf76e0a5a79df4b17449d296994a24ae8e0
SHA25694a06e71679a55d92105db9233b50abea1b1859cce43a8e988e5665e54be5ddf
SHA5123a29826ed584963ad3c909e259a6a3650c1128b36792d683596563c08297a3a7992678dd619fca4ffa31d6604ec327afe29b29406b8cb24f4c71a52a9d996014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d430687c25fa4503486648eb9f67ea09
SHA137f425cb88001dc5963d4cd2356db34685f93716
SHA2568c2f2f1b0fc87f8cedb32bd9cbb32f4e2f4ca938662eb14fbec5045a9f5f4c3d
SHA512cbd0cf4c556ade9983f41f7641a1d3d98842b72a531057ba8c4bb888818cde3c71fe0aadf645d2ac35e90e5e5c52dd89546b2fb801f1775f13d48dd6dbc4193b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c354a47d3867a7be66362ffb571eca8e
SHA195241da9a6eacc9455e1acee4c468c06a31f9233
SHA25694ef70d1c15205d2ab78a66890db33654016d0913aab864ee192cd30c9aaca53
SHA512555afd30e95546dda0874c6f83b4b5a1e5d7af4699261bf9a61ac4c0c1e910558c413b05ed300044f21f7ac64696d46eba0bd711bcf5876acf18a49ef5b80c76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531f46f0648219b7ba2718a591145fb61
SHA188cbcf62bc97d72abdbc78f64856ed146aafdabd
SHA256c0eec4c4970d055e3967fa947ed28ecb942c5920a0fe17d9c83d355abf71fb5b
SHA512a12e2815b93205c49d9b72d041685ddf7b5ba8f18c835459e8a8fe24f5348285a8c89c8b34020335dc7d41c3b014343d23ce35d413258d88a2ed314b5816d282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f28ba556bd9c71a9e8da6a08e6acf588
SHA1fa3e3f8a07f413c52d3787e81918826eece9dd8e
SHA256b955ce910a7567d786d4f1f128e49350c35d886c488641cb66d3bb797128a682
SHA512167d2092a51562a67d95e0ac70d41d334d1db6fb09bdb697416a1f4749e9924a54768856f4cdaccff4e21e940a6273620a8d07475c25f0700e768ec0ce5589bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ec1adfdea7e564bd411c6ecccbc74ae
SHA15154eb3e35bd8c46995d37352e3c7bdc777ddb4c
SHA256f7f0fe980d535c95cd66f095c9c0072ef2dc0d7e569e6e9a0780b20955d6581a
SHA512a2409b00a297988420c916efbbee877095a2ef0e4b2751535a5b535192f4b40d31026b2839c3ae375426d9df53003a48d8554b0e8c909399d1825a74e1ec850e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dad4b8fc71b9e97aa169118eb5819fa6
SHA14d7e8607a52a77c99bff3ea8b48be86006888f3d
SHA2565a5ed86450e63c3cf4887b0b226bb26a591b3933640aff7db94b932038e2f392
SHA5128882d52b585fe71f66c27ce01adb404e240c6983bd6ccd3a51f2565049416655a2d1ccc5723d521eb9bdaeebf170b1418da91ecd5da08f9c9c6c46093807add4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a606d1e1cbb8212cdb333b6d09f4db68
SHA14d81bd79046d53f5434b7537c6e6631c211cc32b
SHA25654b824b4d1103995f6f595c8b55fbd4d669d468a698b096756d372408f8f41dd
SHA512440e4a8228751073757de6650c24faad7167b9b9eecd17afaa35b32c1352c82ff0ec6a2fcb83fac4c520bb2984aa3d5b370fec21962bffa53a91a028354d5d97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae6b67b91234a8f0a3e9f0196323de7b
SHA196405964413d318c95134bcd343d6acb9c7506b1
SHA256d792e6c09d5d87a4e8a36134cb6299d3aa63b686584cfcbbe77ab30ab8cd60fc
SHA512e44c3a94bf99d3c4b1890a86071dd1b7fe35fd4a07b81f7c23cb288f1d07da2a9517b55b3fcf904dc19f412e63a43e8f95d6a8b62c79484ca6bd99bd7135debc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae087b2e78dff5517425edbe96b87b71
SHA19d8cd199cee50355d253d491b2947635905ab085
SHA256a6f489b9dbe6434ba89e7bbee06b127e8793175502e87437c2e4c38a445dcc9c
SHA51237e8a2243b92a2581e9e53fd6d42ad374729bb16c2d1cc5c727d869bca439048a9df14e06c170d3db75522db5932e6000bba2ca0a8daaeee3e4e2b134f3d5ab3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5172e135f7eddb68444ff642660072ab9
SHA14517f646ef13b7e1051ec2d02df8e2335219b75f
SHA256fdb9a303e0e100c1cf87e3032dd836d3f6093a2b1280b92c59e92a19ecf56bac
SHA512ace8e3fb43656d643eaf25e2ba0f927225888ff6cba65bee4233196736898eba69247926bf24b7c871fadcd38b1e2a41c6519eda03a52367b746fb038b59d196
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca9dd643a36ecb41247ed16a3458f76c
SHA1c71283f5ed23480299ea16ef55151a735c330e58
SHA256aed6de35ffd01928eff61465e4720164baab83a6b0d7f48fed757f5d9ad592bd
SHA51258e460cf9aaf08776f98d6545ec4ec45af6b428723c950cae747b7c0621a009ad5c4e01d41be4d7be6ecaa207780e386a32036327e7181e412752fd39719ab15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a61aeac9590c8f8e87558d78e8cc080
SHA12f15d598edbc4be6f570862e0dfa9daf83ccadf9
SHA25627eed96b224ceea167a9db8111d08489c896f7c4677f53be7e9e73d42e2a0d2b
SHA51285c8e9820b10c6def33885fc07f2efafd743ba947280915a596fadbdd76b60df312deec4d5779b4ec95897f8c7388b465d11a853b014552fe83672b3da57f466
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c44855c09db65ed2e48e2e3f9f67a87a
SHA1bf6a708d0d9ad1d08f83b842e4cdfe2a8e3b0bc7
SHA2567ab008802ea4c47d31974283abd997ffbf699a73b3d0135f545a16d22fa493a8
SHA512a3f3fa147ed3a0381a78a25cd63561b437cb7554f4e275d09322a1233db977fa04e61774380aaeab0c1b490da6ec52535bdeabf9c76d66f3b5a7324cd1f0b632
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e95eff568ae4066a8b605e04c9566b88
SHA1e92d700f1cc0af33f157a41710bcee0bb5308f78
SHA256d2cca5860352424f387b6a2664e8d91fda0113dd3a08ba4c3133fbe241535c8a
SHA5126f491789a247a4fabc4158f30889f6bdf433d40b31df0c5ae6e3a4ccd9fcdaf3644c59dafce0237b52422e771e61d81f09b4347fe779bfbe93fdd3ba12a67b30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d54ee3916aad786c51c8e8ea9b8eda53
SHA1f656a3042766c74a098d8a01e9bd21e585293821
SHA25618c025124fab3518c4ccb63a41c4705d92546e400eeaefeb0cea6713b828503d
SHA51221ccae20f759c8d509cc5175e937d060b3c900587e0dc315a7c710151daac56b8627b592512048bf5371eb11f3fc217f4b483efae7041e902dd1d2984bfe7e97
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b