Analysis
-
max time kernel
113s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
ec08d8d1f68b2aa531060bca84a794b3_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ec08d8d1f68b2aa531060bca84a794b3_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ec08d8d1f68b2aa531060bca84a794b3_JaffaCakes118.html
-
Size
461KB
-
MD5
ec08d8d1f68b2aa531060bca84a794b3
-
SHA1
e84b36fe7ac0aaefd81f173e950a2ad2e222f3ce
-
SHA256
d8bf967cadf7b45ed357003f8d62e1028270b3ec682923ae386101fd48e29e26
-
SHA512
fbdd71353744275cf79f6d7886e008e5e2a099a04fbb16f3fc44be3f0184f689546c94a43c3d3f4ec91fa00a2fc921e1f8bc837d3c9a87416628464451a65265
-
SSDEEP
6144:SRsMYod+X3oI+YIsMYod+X3oI+YWQsMYod+X3oI+YLsMYod+X3oI+YQ:e5d+X3Y5d+X3F5d+X315d+X3+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02347701-76BD-11EF-86DF-7A9F8CACAEA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002864dbc90adb01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000000436739b402c123c255c7f97afdc200f4ea5cde5faefdecd6b8fa249db343df6000000000e8000000002000020000000d1871250548a0ee7dff530c329c40362a7d808cf7f047211b28b58410b71b398200000003690f0c7363af6884c8890c40a3ff0691e874e9951f4f509527bd4975db20d4040000000fc179e7366aaa82b02581833ed75e6f25bca9ff565b09587145890360bd1856ee9fa10ddb25d1abf88a4f3e7146aea14916d05bf097db0defdc54f3fc4bb7079 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432935832" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000001f39dee9a1dd6dd8df7ebaffa433fa12b9f7109bc7b0a8ea1c44f44707113b3c000000000e8000000002000020000000a5d20bb4d77cabe578875a336f56c124ced4572affbda3b363040ccd49ee48569000000046f85bec204374bcc18f61514620d416472f10580a5f9957c964ee2cc9a7ff32f50601f87f65d7b35046228818e2ae69c2ccce702d8999312288c307ea16d30426c7b9820ef01a2f7b0da0b68d57f17f02e1cb99662652b0fc32bddb69201f7a8b70e40a6cf27ef47755be1af29bcc4375802753626774415d7c89ca0bebfd6de8bd7601257f3434e097ca5402659ec2400000008169d5cd35bcea283ac74e098c6e69319af9a2f5e15a80fb1a56e6eb1780acf838890dad5876a9a7d212eda2b8e2c8102a8ef2eae0bd19cb5445af16c5254404 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2536 2364 iexplore.exe 29 PID 2364 wrote to memory of 2536 2364 iexplore.exe 29 PID 2364 wrote to memory of 2536 2364 iexplore.exe 29 PID 2364 wrote to memory of 2536 2364 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ec08d8d1f68b2aa531060bca84a794b3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506ba14423d5c0f5fe198a99abe43d04f
SHA1d496e4bc19da90345671e1af7104bf56bdee3699
SHA256c01f4cf0d6b9c14e8e10ade66e86d15113a18b201de266ac004ffb4e9650beb5
SHA512852323d8686a0895e6af1e0aa683f30d3bb993a3a0e7f076e33381045fce79ba54f85715eef88cd18e7606d7afbd48bbe47d6cda7506b10fe55c3f6cfcde048c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a27a9e6afd5aa32ee2e82644fdee520
SHA1814e59b427b2a235d2fc15b7d2550104c882444a
SHA256fa30456b316f650c6c6da663cebb42019bb1a5ede2db81c7cdbab0707a60ae9f
SHA512df549ab4efff7e74b1ac678ab8325547ddd9e17e43ec1c57a7ddd5a8a8f7bc50506aaedbfd2bcb20bae8d0c8166fafe98122a3813b69806a8371ff990275682a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517d57ac560cc86925a6e5dff7bfc1aec
SHA11d8285d01275c390f5dc998e55ab32d84e3fd932
SHA2562b9c8277138bf82cd3277e74b818cbb20ec549e82e2589cfd9350fc25c76da94
SHA512d1e01c95242a18595c640415c86d8d23e3dca14529cf49cdde748d8f36c65bfe7ce21e02dba8fff6963862eca2af5dd04a8f1a122965e8b725dee248978fa4dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c10177986cf4858a586eafb3b3024228
SHA141189caf207885959736f71e2b1fcc4792e3cb45
SHA2564e6878558c52be74a9e72a22a017e59ded639f2f74ef3c162ef758701065baf7
SHA512a64ead81e43e4d4d7f5c7453ae339b167bed940b4330b61fc7cbd8b86011ef51d7a22b1a9281df0c0a73cd3cf93eb0658ed46ac74431333b52177eb8b9c6df22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547683549c0726f2ad64271667092a9f5
SHA1664692db136fbc75fd9f5bf894d03d4f8ad65c90
SHA2563ef5e88921ae059e26d616f4655daaf24f60bf400031eda24505ef084677cea0
SHA51216085c1ee92867ff67cf4754ac5a8abca02586e89a50a6e9d773d108b9cba3e0afbb8a163b3ad6b67c1afa831258d10f46ee419f2de773041d7a85df698cf1ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3621743f0df789c18cb921957a1a47a
SHA173aa40dad1234ba58402b7bffe88089a68e241b7
SHA256f88faf2fa5667fb72a1bd81d473e07c0c75415adc106b2164d39ad80888c13be
SHA512bd4e8eba704bd71c05cb2688211e47dc0c2cccb34dc59900e4dda7406329d557945093ed2d54f2d582e864e24634039e8fd93d5e118de4ab0c31beb942112fc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8e9cdfc4aaa3749459db297dc4eb973
SHA1f0b8c2ef7b91f970765e97da075f1e0cce69699b
SHA256fb9eb60fb96d52cd805d09d040afcaa22e265a117ac9610d13788935ee0e2622
SHA5129427a37a804aa9e9ed65c31547bc48100e3edb33af711620a348b7c01f4cbd42ff6ba3b14c097951e288b0f71fbdb0fe77b5057c5c43336f2d10aac7c80bbbd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b66fce4ce928d65092d9decc9da31f6a
SHA18c3b94a83ac69df2d22ad23a3ac9614370aba986
SHA256e1041f26bf50b3fc1592d48804f852b33692789d1bba64db443d3453723aa7d2
SHA5129df6bf420c3b18d5a8a7f6392aa05498beebc8afbfb1b5fe1f3d8d5b37c3cdc00483017204743253ecd55c9e07a9ebb761f64f7a67a79f5315450c6ee5dc483a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54678737f913506f933406429c985d51c
SHA148a73b697ce2818c4852481080c5d5d67d1bb289
SHA2562b991bac6c464dddebd637a2ba94d3170b42316bf5890205aed44c900ef1b97b
SHA512d441ef7e4693fa4520043173611e33e01254ed197995e508c65c09a9a95f6562bac34baa6b37ec835189b36d640e90f9bc3dfa14eae6e780121f84346ba3579a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5617a0c2295502d695f16666be59fdaaf
SHA134d545ca47e577c5cdec7313a75dcb582d968455
SHA2564aeec84d8377cdc8078bd1aba052d9f3577198d06fa250711e160ebd24d652ad
SHA5120708a4553b1bf5a148f7aa76b7e28dbbcd06b8a11ae1842326e4fc92ebbf50775abe74e7aba3f5444f62c77a96e0b1758ddd58b754301e72b1bc65c18a1f3b44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c78523c890843e19b97ed3613a3f020
SHA1e9998cec659a3d2ff837fe0ae865f8cbddedf044
SHA256077248109c521d89333b05e0ae7f4e623dccf52f7250856b689a235b7926f376
SHA5129c868521261a01b0c640633932d2341c38407ec1206f4296a0e6d0650355a162f7ccab583e57f1ad08a3fd2f71796e67629996f4e0c03ddb5a1b138134e36d2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568bb185859a136a17914c7f63219c5b4
SHA1de60bf7d20159edb97afbd0ed778fd129d133b9a
SHA256a64223afd8d6816a2916b3acf851364e52083fe8af51db3a6a1b9ea86018c656
SHA5122fe725501f919d1b004e259ff9a0e45cef2e9c2fb74bbf5c6d525217bb652b1d8f701f179f46523b6b5e4bb5db743aa981cfc5a9d823234e1958a3d88a39830b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be7b8a2a391ac7641df23aa8db63f7f7
SHA14319e486d151425294f1309498ee17c021556ccf
SHA2565a774c68319975aee57663a3e201e183cfe73b9e3e428fe82af3dcc17a91dd09
SHA5124666d81889a66481c2eebf83a6a1a3eeebb5d51b7a043940286fccbc2fbb915898a9fc4cb17cccc9a8355d89724bcd37557645cc6dc5e63efba97185dfb701c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5343996a02aac7f51b2be8f9379855f28
SHA1b4f81eeb93039484ab8b72a97b993d8ca5c7d0c5
SHA256d7255a7ab1ccae10dc1ce5be857dd1e5de1a3c3bbc205d409aef7964aca8e63b
SHA512b5b4197e270960472e7660b5cc479d7e1699de447c34fb463830a79edb66c576b1cf7ba4d924fd5235466be69b8eb7668a52cc29719867eff68fa7cd58c9f722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5171cbafcb30296603205ae8fc8390b05
SHA1188a595534710000f7e409beafae39cabe81ce7e
SHA2560cb326df1feb813ee3ac16681ad8cce0a95b48e40a43edf419c78d34c68dd572
SHA51299cc8cb8d4f4c4f70c23ddf01fe712ee7a285541aa93aa1bbf5f4c71df4213f1fe8ce873039bafcadb3d4f06ccb446ec5aeaf915fbb8684252a86f371dc7bba1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574793458643a8e8643b7924b00453763
SHA17afe8e48e30c3862d4e52462091cde51e2cc8f35
SHA256e8660081fe00431c4914aa039799b4b30b30fedaf9929f58ade9ec3aa4a33ad7
SHA512b19828bde8c9c175a618c8289742cfedadf21ff9c84a85ed5b24ff0760abebede9d6b649f128b7a8d34b609b8a5586f2967c350343c64b71309e917015fa079a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f095ca8a356f374b1960af5ac88aa2c
SHA17c96f5975de0fbe6bf72da1a80f355e77d770674
SHA256b71a7ecea75c0fdee2d0934f05cc79c090335487218a00c15e711808afcf3a8f
SHA51256eea7367fbf068305119c3eeb92a4cad154f9729318e7762ece9f17f38ae8748da404bab0a54419feb305473b01a233ab9fe5fd10b8cd451ac64a1952dd3760
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b