Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
ebb8ad57b6858329efb7bf2d78566d44_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ebb8ad57b6858329efb7bf2d78566d44_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ebb8ad57b6858329efb7bf2d78566d44_JaffaCakes118.html
-
Size
2KB
-
MD5
ebb8ad57b6858329efb7bf2d78566d44
-
SHA1
b6cd780fe56a86be7b07dcbb1a8890f7fa149387
-
SHA256
456ec84ef20f12316ea634cf66137a5dc32f7262723b649e382c8df343620c3d
-
SHA512
af8f644ffb828f9b26774834bebfe590646f3330c03d0b464be36dd5d6137a03dd451a3532334d1cc56bbc0c32d922c1228efb11dca9953f922b0d4328d7c3e2
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000040b4e6f3ba4f9cb783f6cc8886840a82c73c4969425878cf0c2aac3d7928dc2f000000000e8000000002000020000000155e046ee9ac08a3ffc68a7c524563bc6af11923ceec497321977f09ae760df0200000003f092675d97ab8b50ab3778e1df5c24be3f11668f1f81b93e6ce0d517726a99b400000002c2b2f1e6384f8de948a67e5cb564b13a2cf1616ec9dfe02ad7c93da9607c1b5a27a89b5f353a614c643b1481e39a7c39a582025537f77d7c873d632dccd224a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80272afbaf0adb01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000c8c6af5d50ddcc1cbef01d98a1e6fb7d456ddffee829c8a8e805ce00a3469885000000000e8000000002000020000000207019f61ff55daf7c68c28224095a67d074714ec38e2ba90e5f6ec3373c645890000000fed540fda215ec519cf456030f1a315a6882e46f918e8d1379b34abbb3070deb7ff67e9a1cc618e152503e0771c1f93747c1c1635a071ba0d724388edb97ead77470188c153d19ebd7817ec12d56fbd697045b00d1e9b3ccab0f2587b87de199f104368cbecebedd2210983649e1d68854e83e2cc1623b33816e70d0f8fce3c1eb0d744f094d7e4ec2fbea36eb86d1db40000000816165c4ea8e58ba50e294cb9f99ac4b97331488dc817f6305ae0e31d9a43a161d8686769c6f34d5e951a5d6daf8eb436096c789378c42ccae295953e0fe1349 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432924724" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26ACA451-76A3-11EF-AA6E-5A85C185DB3E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3044 iexplore.exe 3044 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3044 wrote to memory of 3012 3044 iexplore.exe 30 PID 3044 wrote to memory of 3012 3044 iexplore.exe 30 PID 3044 wrote to memory of 3012 3044 iexplore.exe 30 PID 3044 wrote to memory of 3012 3044 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ebb8ad57b6858329efb7bf2d78566d44_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5433dc115025ad69d6d3ca96785b827dc
SHA1897523c6f3b5369eb56b6e9926ab152900123664
SHA25689648f57f00c83cc69d2bc773a929e81211be0b5a4705e5cafa9d2772eac73a1
SHA51236d2453188480b082ab9ed828afe4f0bf50058419fe202dd2857f05f593cfec8bbb58c897322b0a5ff5d4c356c282d3ad2d92eb365763722c7ae9be97c8154f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8506b924b80b87d49854ab428024734
SHA166b5acb317ddc1e39cdd567c9d295c25934a8390
SHA2568284cacc18d5b9d406d420f110d2dfd6571b72f14af9787280251d1d2dcc1172
SHA512419a5a40dcd723fb21feb8f87130d7307149ac0ba7e5260e2c58442b1948a1577d32a1c28d25824cbd0c1b1487a94a9d12706e031b5ecef51edfc52f62b85f85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc0fb46084dd600d21afe0ea56ae93a5
SHA183cead58a42cc21986e7da71432b5789c1e3fcc0
SHA256c6bb4cdbe87bc42afe874a6afe6ac86dc2c244ede0a8f4185ad9f477da527532
SHA51238ba481f0e8f8c44b39bc623d97eae65ed2a885be57f78b127f0b9541a190d40e5db82f847d8193b0ed07fcee3cb113330b3dfd8fd8b077b45b7ae8d48f64f33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c4c508cc2bb58dff5a2bf1565ee2fdf
SHA13b9329e2fdf5a5ac43850da025a0bfa1b6fca454
SHA256c3d03270e211c2c1349f6779752a5cfac20951993bc778534294e22bdb61c097
SHA512adbbffc703a48cce79d0afe00f33dd44086d38d0eb6ed0739167315e7dfa702011d2b598d5086db738bad1f5f2bf86e8caa15a5567d1462c7c22acae0e40a108
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c6f854cc9914c51975172e4783e2459
SHA1a902954ccc76c6ca76f6fbb6ca8458d6d4aab826
SHA256eb8a21bdaf56d3d652a593bddb0a2ef6ba00260d00e06d0237892ac36b6a5b4b
SHA5123f967045ba9cdcf7a6e7d1ad5c4acc000f53b6aa39460099dc48e6f7959c94c683b7d7c9462caea8c597349901627851fc064681ede615e0fe66f5d56d37620d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513788c8b385fa0ae1f7642ad61d2b6cf
SHA119d032cc955ce5a19ea2cb4fd34a23e6887553d0
SHA2564aec0bdd5b036c9ad822a51e6595bbf74647255f2b1f591b9fa6fabadd0c738a
SHA512210aaf9e3d3b89b13838c72f3075e093d242ac8b710448d57e9278efe7224b0f320c8f78b951aa4df204c9d3f389a9640cfc304f0fe646da500b0bda46aba45c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5001b3f0ee99344b87df656e0a1eadb74
SHA15c2e72ec889f365f2160d5124b1b802f13ebc202
SHA25638c6cffb7f0f7ba62030c3a9ad669a21cd1b94e06daaadf7edbc5f6e808a8d7c
SHA5121da0daa7e4d3a16ba35be3f476c252ef3783a5a0aac5eb373bf3d2326618d5f9bea6cedb6d9a32bbac0912be9e0316e2b9685ab4571e25dc29039c147064ddfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58545881b9bc0d43963b92627c012ac0e
SHA1e26accd23c42fee0bb2eabee6a33a1ec61bd3062
SHA256100a927153f74a0f692b601fb50e00070058e30e16d9232d25e8a0e588731a57
SHA512b0f20870d6984c96f120e49fe83b6813b2ff70852f84ed2b2203552474e19bae97ea6b5881cc2c75020ee1288d057c2f5dfabea961c8b162c1f41f0d3e30225a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50786cb250a1afde5c864e7fad96e390b
SHA1bdedb114e03d9ea78c1154b5be1649db7bff7db0
SHA256baa25f637407be5e6d51b827c3671d1a0d4deaa71f00f1c18a58328c30c196b9
SHA51268444bd0778eb6f967ca8ad99df32c242ab6ab355a76d9ff43442faadbcd0775f57220ca4c18c25ea5e1203dc41b914cedb636095945c50ddf4fb3e57ef9fc0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54de66beee20b822357db0330ccacb22f
SHA1dcbd207ab87c2ef6c8d672a3ab295deb8fb4940e
SHA256ad9ab3d136f09bd2f061e64d4f58e0b0d02f48dbf8a8ec9eab0fbced52759abd
SHA512548a00dc6f33136ed29b1b7c771e74aca8d6e44e94717d9d3e27de4c679aea764440440bc8bc4b940e666ea413436780a60d480822d6b15b447963dd5d1bb798
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50922d6f5d9f8df04476094f12368bdb5
SHA1a6614471cefa592e4f591a2404b50d90847e9ce1
SHA2562ff8a9221c84c24981f410dae93dd50e4337d21f319bb2141836365a27b3476f
SHA512bbe8102381a0e7605af5451a5c4530c5f18a2711af0eec26eb280feb6ba6126e77269c45de0e6ad9e390664be348df178a7085d425ed5074a09fba3468d16833
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50be5e3864a1e9ad07b77514a9b459482
SHA102c92ded311210c23f8afc032b3c1bf76ef7961c
SHA256c9d6d31968e3bf7f6c3f78381070d8d8d0421f05f1b987cb0bbeff921169687d
SHA512074c8b641f78af291f5a19f8caabe5c3683efc65f76cc5d3ee5b34384d5a0975c59b28b7f598d5cf07ebdcc989ab85316e8d6a64f91d42bf85208b2da20c55c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55176479c933ad1af8cd4ccdbcab5708f
SHA1da6c00fe557483de1d2d9dd38030733baa01af3c
SHA2561d2624a20c8594896fb161e00bfaee48dc5b3b26fda05b389dab7869c99d74ed
SHA5126bb41c78ed5fe024400a0b3ea5be6837aa19d52f030dbf8f4be8a555dadd61c334d87e74cb04e9ee8e66a0f42437d3fc699162c26ada69461d30e6f79999ef2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b81ab48bd287a0fdd1d9422f156e9275
SHA1e823ceec6239c0da43647ccc2922178547f56838
SHA2561501a7cac099bda3d6ebfcea9c4391afee8008bffaf9e860bdd89210715ebf95
SHA5127bb680db4670a18957741d7e53920da028f1888e3e44062a62707d077bb502906b3b99f38f4830152a3bf52393ff722621a85bb5221429bed9f20484b17be961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c3ed6231e6a0be5e71932eee7578bdc
SHA143848969f9cc01d67ae3afc58c448da1f99b9e40
SHA256423e49514ea551c32fdac84980f11ae641bfa82b2c5976d5d70042f6e6ff5a16
SHA5123c5560c782b9aef7a0433d49e7f06e0e0db9c57fecb1a359a7099a5ed7f31150d9dc74e250d3cd4268e24c25dfbe4d11d95fe88cd60d58f29d7946fa8fc5fe75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5975f99ef43ddc8f914cf79d6c92efacc
SHA1882f038e9c24567e379e385152e120ce22a23832
SHA256aca0bc8f6a69988f56814430486541a17ac0dee0ff4c3bf637f6b27a43c2ccd0
SHA5124b01859b5821170cbf31a653fdca0db6b3f989e8c69e9ab45e0f7533cdb5897cd1628af26af6946dfb7da82fa0258d80546c9751ebc7fc3b7557b4e11da18037
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd96a8f71804bb8cc2fa62f9f136b0fd
SHA1d6b1ae0f78c645f01a02c535303fc02d18901170
SHA256e3981e266c72801077df826ca092c5cb89a70da2e7bac87cf42ec89aea692197
SHA512fa9b251f3265aade3bedc83a18885abbadb8bb9aeda036e07f7aaceee22f3bee09898603946ed167ec8a1a19e33f43dbf29c3e0fdfc1f1eba95bef26eda2bfc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b643280dbb312e2985f09f339a7f37e
SHA1f934dfda4e34f7d650fc785897a371c4c08124d9
SHA25635de6e30af054dcb14cf1397a51c288355991f3155369379d7a2c968f23fc72a
SHA5125e8e4f3d1a946d49640346aa355fa9841fd2cc8a00e4ced9a4b521ed3ad4f30c456a8787ea2843945298448c753668646213107aa02d60ab14a3a5817a30f020
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b