Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
eb37445e99d22b40ce843841a56a45cf_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
eb37445e99d22b40ce843841a56a45cf_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eb37445e99d22b40ce843841a56a45cf_JaffaCakes118.html
-
Size
2KB
-
MD5
eb37445e99d22b40ce843841a56a45cf
-
SHA1
a2c4e1a0462141d55c158dcbf3c4d39435d17bf9
-
SHA256
d46cce1aa45de6a147ed9db7751975ce0a9524899ad2ab4205953807ec789167
-
SHA512
3848e82dc788512e4d754488558ad3c274cac2fcdad8ca797d147e02571be7ad43c91a4dc99774d2c6f5935f6cfcc8e500cfd118ea9d2392994b5d89a39950b0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f4054f850adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000003116f8d64e54ebb3187ec0460f97f96b42739d5e6a3975b1af70290603585011000000000e80000000020000200000008491e2a68ad27f528f79d35d68cfcf2cac8e2ab59f4a9ae3d1d33e7edf12273c900000008b8edd68ae1be5c296ff2f58e6968fde081f4cf8fe9e03c26d83b77ac33177b4fc113b55b29268584cd4104cb05c22f9699b8b5ed6224163ef2a7734a985c8a8ac4f4fdcd36a15fd09863ff870c25d5f2753cb80edea1580e860f43117fa0d090a3c58151b8035a938b9f7356ed409aced9d3828c129ef277c21b9b5a994014e77ba2f03532719f2f440c3ac23394983400000005e89f7a9e607d43ab83b88971855fc975641f88b9b2bf82ff0b09c0ed2429adba19799350853778dd207460b3d91e27c10ef93667c190a1bebbdc3da0e6e765f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{762A6E21-7678-11EF-8BEB-4E219E925542} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000f8dde2cd97c4be30aad2ae81dae0bb2ed72621e96a04a1f5c6938861f8cf7a60000000000e800000000200002000000076edf07b3bafd89830e0cdb71487e9ede1a867492cbda2cfd39d6e20736e37cf20000000f05ea3140c4d831b6938014c34f0581c280dcc9169c5d204168022efb7013e68400000000220e767e755087a3bd66eb8dec120fddf09cf256964d9f6add6efd794a85423c2258ff8c6d310cdbabf7dd4782006d390509d4cf8639b20d520ceeb39a6f3f1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432906389" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2264 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2264 iexplore.exe 2264 iexplore.exe 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2200 2264 iexplore.exe 30 PID 2264 wrote to memory of 2200 2264 iexplore.exe 30 PID 2264 wrote to memory of 2200 2264 iexplore.exe 30 PID 2264 wrote to memory of 2200 2264 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb37445e99d22b40ce843841a56a45cf_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b4bc58e7af376c5bf2d861c3e2c23ec
SHA13b2a83541f80c96c0b3c40ae17f007736ec6f28d
SHA256df825a1171f6c18f76f35367f65e29872ea51ae800433950885926f8102eacde
SHA512d3c4dbd678382d1ef5d2857485f3ba32e40b4b1e489eefc32db6d3624ef058d122b141884f657f3b12bf41433af04cc9341b957d4a012ea4ab4d6f5a30ceed8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59fd55ade99d663b17bbafc68f7454377
SHA18614dacc94350cc93360d965c5ebb47be9a08604
SHA256ab9ac1500544748a2c23b72d26ca156fae675005341826598bff1f5213b2bc4f
SHA51262bbad9366c5d21b4b036b266648bf8ef470df10aa3eadf5bddcc0ebc6d1f649ab257ec190b7a6ad833db44df49e762dca5fb9c38a86408e4f544d03314b0e92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5147b1bb1803c8b2d737b658236c2f9af
SHA1b3d0dc2c3176bb0b0415169a50f6bba3bb5b6180
SHA25685ea347285335f7d14779ae831036b3daccba9e279299ad193f342346ba64d39
SHA51274b9e0302a18b119447f5f1f9d3877169e10231c1d7b336c180d99cda9c0ddb0d9f0819c1b841c0de249d1a9188134eb4ebdade6304be12cafe6e940e85296a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f64903c21cb41141803e6c3a621705bd
SHA1cfdb7b6018d50222743caa1e26b644e517799d7f
SHA256db75433acefa9c6dde05fd93ff8e1a3e34b48d1afd186fdc8da049ce9a095ece
SHA5127d81f3d1638816c72897867880c23d5c20cda4eba94e392f8801a94daef6262c9a8a4c83bee830ba324a704d40af1ee84b2dad11cdd47fa7eae1fa90faca79cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5819a40c8f1ce3bc4f26b0c1b07a0d309
SHA1b7529f60e4506f83ab30688a5cead1949a0cf11a
SHA256b98ab6bb56828a96d6c077f0fb904f8c7c5ac6efadca260ea853935a5c1c2696
SHA5127348665a8cac9c540a9f5ee53a4dfad4808e233a9f7c0eda27e4217ad5b21c593ed2fe9c678211e9d235c60cdc691ee6180f91585fdfb3a2791ed120f59e0bcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebdad3dc35328cb6e3d62be25537dd34
SHA1d23677f7aa9cc8023b23cc980a5b6ba4e337c880
SHA256b67d23b1e7da59dd4cf2baf423bd915532fd905436a12ea0f618fa0c92faccc4
SHA5124b84d8459b3f5ff7084c8446d1a9f22bc7cf8f474a632e75fbd48af837c940c9a8b3ccb29e9fe4a17dcb7ca942ac54c39e3b6d09b6e2f1708cd1863acf8d4686
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa5f6e0284ed4deab902e41ead211638
SHA12fc7eb1d628b96d11e79745214f150b24c3246d6
SHA25627aec768bc8c1a2c590d00ecccddb1117ab5849ab149eeb880c305ff876994de
SHA512764f211d46173afd185519036c13267a28611a2c6936fc288de363188ec6fe272b094dd412f9d6599ea68e460dcbd44e1159382bf160604a353896afb129340b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5274140bbce137dd24058bfc12f22e4d2
SHA1d0467e5689851ad35fa1ecf4a8e15fb86d096ef9
SHA2563bc3bc95148307a4262a87c4de363dd6208ac7d246dd16ef9e8cd5b58b9f32d7
SHA512142a11989b1e3d6be1f8e846f7b6a9f0b460400f7dc07bc94df89bf416c56bd020c8ddef1c9a04e5575a469a4a693c0fbfdb2bfa70e092a3ed4d8154894e3869
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590fa671c7c32517e84f613a4f782cfe5
SHA1afa57ba68f8fbd63fd289015752564674aaad0cc
SHA256bb52e3fe5f94b8f1500164c8aa336bbdafa4f60b5291e324368db6dfdc38a6ff
SHA5124e445c5afa091788b7b75ec8f7bf11af9c0afc09f31ce82408be1011fa45abf8b76a03211c41d4bc9681f3a31e483d4339036b60903703751fd7168d386cad82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a320742dcb8798139250e601854cd33b
SHA181212ef9b7724d05aa97351fde28b252f1802c01
SHA25689382bd2d54d9c947f01ac5a3d059c974f004afff1fea3ba0ffaf80ced3b587b
SHA5120acbc7216da10bff47baf50336f2056ad329765b6affc71786c7d26d934ef1822d4bed71771f65ab4065290be0fcc2befae76dd454f3745aca85ed5e92d9bc5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f38c8b2cd29b1abde80fa97a3ce35505
SHA18ae01798158710993bfed57c94fad88871386cfe
SHA2569b92b86deae33a14973ed23f75475829f9266bd2a148017cb23ec86cff3b26d5
SHA5129425beac642c3a280f77ce552f182ab103ba8e53c35c1bc3eecded25d931fcf54562d4a7728e55bdf2d401eb0f6af8aa098d39e23060dc39c656ff403fb1acb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f05568ee7801938d38c2d7451252c55
SHA1db5d17f0bc424d4fb73a257464f99d16d69f7753
SHA25660da3b16fe3a390c8f9f8ac6dddee75093dcefe64d4cae2e969ed7607bb87111
SHA5121f9c0ea1d5f90355f463800fdb2f673fb29482442a7cec5725f6c3b059add671537d3c366469d62503f5e68216b40c57968503d05da0b23ed0119d2b43d2c7fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dfce644088bca9db13b3684e6852db8
SHA1d272f8538030a5cab7eb83f1d5175336e25c9a67
SHA256ddb9b610102d7ec02232a92499db980eedbc6cd0e93166d116f14dfcdc4ba8bd
SHA5121b871ab4f599b7678930f46a8e8df72c44b1c9551b231d9a3887c8ed000b56a912710a272e0b834e0ad096d114161efb749029055fd18124840cd5eff4854f4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af23e492f4da4d082db7f89f2d53deeb
SHA135d46763a8a6fc87f8a0d132d2ea0310a15757d9
SHA256f71fc5ffdaa26691e777e2a6de040a906b57aa7909f8de99fa7ef56cca1ce9a8
SHA5127db653926f0e3640dd14cdf8004023a4cba63f855044f8b9351ebb4a12138ba6ee00401b0d7f399b2b2a6151d77439ce230f3eeacecb2f3dbec17fa7a953e580
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56517bffd4e74c9fa9f8a7c85902460a8
SHA134f7c13f8c2dee27c13c54f6302516b0bb5cca0c
SHA2566aee220e1069b42a0b3015f7ca4e10d103c15065490598c57fd614dc2367ad0e
SHA51248a9be92de08d19855f4c2f0b19a8f0f737c586bcb690b33ed1613708841d4077fd5623c1dce4a71f1df31a3d5c005675abd4f502c52b9f593205c339d737ae0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d77fd3706c2082c135a2e6b823dc53ea
SHA117ad13c089a7fed6f435558a64828183700c7aa9
SHA256b4672871b5905f77644203038cbe233ea080c13aab1c7e3b6740182f8321252a
SHA512b5acd618103f1aa6f718c27bb2e4c793999ccc296bd19cb34b9a1890d1f587de31233e7bb5276865d5c207fc617da0935df42fddd0dc71da2ad9526ac46e6354
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce90fc2014815092f2534f20e96126ce
SHA16db6afc97b7c8ef4e949f9827d7e70116cbc2284
SHA2561218420ff5a13c008548e3e57a7f4ee32ab35e836a36e830e29c303173b28472
SHA512b656b98d32fed110b7f6bc55036e756de9c5e48ecb595511e255ed6ffcfa4b85945194d60c598cb008b1f065bca30afd533ead2601f18974105f64f24bb4bc76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1b1589f9d40c185ea321cd77a2d87d6
SHA18cf059ab1a7261ee5c9c3efa19a59c800755531a
SHA256d07b4de4b131cf69be35cd9d71d089e4d1819d151657424e6c72e3df2360324f
SHA5124ea371a5465e5a0e79813b99821b03de530e90c103de43fdb929425bc14e6036691c0d878bf6148765caa519656b6bf58d33dd29a6867013df295e1122ef1a10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583fcca0647d29badede06b34bffd94c9
SHA1e0730538e0f55c1964483ce6f2ccd5d5abf97c64
SHA2567b6bff6b36bc512dda111887c2622668b15e778792067047e8f0043cd0d87be4
SHA512e6beaf6e7f99c5e74b534e85fffd3c515691b0c0331182fff159cacccfeeaf6460d707850cad14b45d2c6c76778b520fa458d2c6c75677897a7808a0a77bea27
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b