Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
f019aec5f44bc41ce59af70203a8bf6e_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f019aec5f44bc41ce59af70203a8bf6e_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f019aec5f44bc41ce59af70203a8bf6e_JaffaCakes118.html
-
Size
3KB
-
MD5
f019aec5f44bc41ce59af70203a8bf6e
-
SHA1
ff8a50e8ba28f90b7e63842ef99128fa438c0900
-
SHA256
eaf5e967f06a5b2d06dc2344dc135f90a192f59323776c9c789f71d3f671117f
-
SHA512
23f59cc0ba3ff15725d3111f32284957fc6b656875cbec92fb2ca47f5ccd03d6567d9c53c00e4042b2b706562c6c804c2271956050c92d5e1123d44efbb80e42
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0010adaf3b0cdb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9640C01-782E-11EF-B578-7A9F8CACAEA3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000ea179680bb85aa19a93ab3c3851a07d62db2636b39baa3de746a5c9afdeabc07000000000e800000000200002000000058504b5d33ed9abfcaec25f3274cf7b3d466960556e0099b080283bc5a0dc00c9000000020f24dc4314a999044f8586b66167b06f3cd7c43c09a5240490bc66aa9e3ac4f8f7e45ff77a2aa4bd8aa60b41e35068861fc55f343030011dc25ecefd204f54fa1a011fd49c7ad37c7efefc6e736d286ee57cb714538fd6845f5cd369c2c765ac1016692ce6f94943a3a16bdc12acdd9b491ead4a084bb7e324ebf85fcc997368f8353e6c009e6ade0619b226e8e481240000000628eba21782367847855fb1f281c8efeb12018c4c5c90dd1fa8c57baf577a41f8c84018a56a63d01b5e9dd2652a657006b249194539e718e1b061b3e49a89059 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433094676" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000046486bd37f1611ddfc1d99357b2688e8b3d7192e41cbd8f208d70eb73e3631de000000000e8000000002000020000000b5b3721ecd6cb58fc3a4cf6b5cd47e7834243076d0eeb6e7dbb6cc766467901620000000c03e257083e68d779ae119650a724fcbb950e8e3d2c7c384d7e55b72cbaaa47f400000005b98240b695f044efe8a18b0ff1c0b1dd9140ac670773fe00197351bb25ffdb0a873f594a18b0511b35f309aed137d68236400e4f83eb7f5d05c84224ee63555 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2120 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2120 iexplore.exe 2120 iexplore.exe 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 1932 2120 iexplore.exe 30 PID 2120 wrote to memory of 1932 2120 iexplore.exe 30 PID 2120 wrote to memory of 1932 2120 iexplore.exe 30 PID 2120 wrote to memory of 1932 2120 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f019aec5f44bc41ce59af70203a8bf6e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557c34a83cc457b18562f46ee47acb0db
SHA12e5260c6075e10bf9e781d8a0735666fffff63e1
SHA256f2671e48a0d4f50e70ab6c48d7d10ba49020379554cdc4e42c19a17a64cab979
SHA512bcd59b53c752b649f4353d3d760ba2d38dc35778035051b21fd8368e24742f1eddd75ed1b7ac1e4307366763bf8bb45b143d18df0ba0e85fda655227972cc8e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ff5793f96ab71d139bb7ae208939454
SHA1d17cf86313ea2e2cb4797029a04e1198d4c54caf
SHA256fe74948abe6b116f7e9e97b8551c934c763fbacd9ffe84623351523c1455c0f4
SHA512aaa316b38479d362ba0bd2c6f21d34feecd759ed63ff3796c75fe5e03c0d27663bbcdeeb4265e34b89414149e6164c68563b452b58d498b1784c2bd26cdfd1d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ebdb40ebbf4bdfbe883b1ace6419aef
SHA1a752854cbcec9640c9453709748615ac3ce83b27
SHA25681cf33b4ed195fad80ba1f56d546a9a2463ac65469b7556bc015392dffaf8237
SHA51285e687f03e08623c307c49e2ec3f934c71e7d9d9cbdc911c2cf6971115246384edaa1a8e20ccfffc2cf597f316e9cb4933dabba8e83ac6574c6c4e3e164c9ae9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a9c99b0fdd191c623be49aad28512f9
SHA123970a74633e3472f4cf979caf2f11a3b73b2f28
SHA256df11a7c53cabc5a5843b4f716cfbf96948a0ccec3dbc73152682cf623e811241
SHA512002449ddc13ca1f9152392b4ecbf469ef93553d5023026de73c2d6345966d8e8bb412765177160f15d89a467f14dd815f86dc3ac1b99fd71efd2b6f0a57de501
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d8b789f708d94a16fb89e2582096918
SHA129218e56adade4b6e54917936c38462483080337
SHA25689ee60362e6dcbbe90ec0a13130a4df34ba06a8ebf8cb4e2cb661b39971ff49b
SHA5129696640f9d7316e58e12e0f1349b09a886ae40a05a2c9c8300bfce24f6642dced2302bca84a68a57cd45d1c8cd22a34f97e1d81c3b96bc7914969b4795ec1bfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560b6230acc16c2b3a1bfc483bc36f60b
SHA135f96971780539846298285b6ff42612966cc574
SHA256092e60a9dfa70335746b711d00b48503dac4bfc85a910a3e51599b61bbbd3fca
SHA51210fadabe65ef8a790bce1c453f9fb734f5568a272b8bb5e8e27c57f4de340a990c5df5442a8114fb3e193f9c7d75cfea688a4e3d995b2773e3ee035c01c043a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e55ac9eb8cb65bfc4324b26451d4d323
SHA19dc0e6154438954dfbaa31f3f1fac1943ea2ab8f
SHA2561a47ba8e20456c213b2bd5988799565aacef75e1d850a1821153c523cf0f5cdd
SHA5125f11d40d0b764e5e71dfa517292cdd929fdb41242779d65445b8ae08ff53335a772224d0a275c4b42354d7a2101b039e30723a2b7f81e57a509d9f8846f075c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b111881c79ffb3e3d984f90e3e6a28b
SHA1927da54cbe2e3914ed4210163f58d20020107736
SHA2569cd3b0a522a14d0cc33d044dcbd233acfcca765c201fb5d1e92da877f950cfbf
SHA5121700e6a0d606934d678cd98d1192b444032f0cbba19f02611b305082a34391c775f355fe7fd89aec507e47495698ec342bb5282eb9df43ba9cff35abd4af125c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfc4c08d8d555cb19cfc7ceb20f41f85
SHA106868adfc9f26ea9406e0b89c1a72de25f819462
SHA256f0841b746cb3b202e15c3ad1fc1212d3784b63d188b217ddd4b35f6a57895d9e
SHA5128faae56e58f8226b68be66c8d3b2be7e2caff158ec5a41696373992527110be2012f848c3c5b20c5c35b36200b94e75edd4cf6fa5ef4b76e0c9822a82f935629
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9a01087f31795402f8e2366bcf69055
SHA14aee93e3b20abbeacac931bb273c41316038c4b4
SHA2566fa69feabd8d401acbf745ed761e56ce578acba9528186c48e1bb8944d43ed35
SHA5124b65902f99674a3b59fd8f3f33457502088abcd6d6b47dbbafdc75a17f160676c0ff69d57796161adeb0353691e42210873d6bbcbfb8c79baec4db24fe9d600b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521538336e34fabf0b10aee6efe2ad53d
SHA1b8f641f5c8d6a867a43d9d50b80f6394f1767e00
SHA2565d7d1cf6d987cdc4c4f1242fccf48a57b1083e73dd99134f1afe954e5229fa7f
SHA512ff9e79c6cd2eb54a3ac5561c1583a575712801b5925a08952ba96440b0c2eb9795c134e0fffaacd7ea072b0d97e318713bab468fb442ea4b24fdcae9ab32f31b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5237ebcbe13cbe79c284bee2f8be91f7a
SHA1d1f24bc740ab54cd25f61f081415caa78648a039
SHA256d04882e7844b06de8066bedea7db9535ff51702b4e5e8fa77315b49f78b5322d
SHA512856224df99cf32e2f6ed834d772b623ae6e311953972bad65a3e1aea844944057c43e2ba6dc5b5c0b37cc5238af03b94594c067ae020eced35b391ec090c6ec6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e265917e8177ca87b790a9367a77179a
SHA1022edff797c006916686dfd24892d5d19f38adf5
SHA256e86a1ccd928b466755d4d4783640f8a69fe096feff24d008805a4416a3bb5eb9
SHA512b12fc83af01a98ed3e5c8af0bfdb6c69c00e2fd8f2211ca40d94f34cdf891f5b51d52de23ceb4a8df4df4b1e71997e2c92841b1e42a3d1859677e683a192ab13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdfa76416bf43da14393437eaf2601bb
SHA12fd44aa3065280b2e9c26591e6f19c255ccbe981
SHA2563e2c971f694c38dccc5aee3a9851c01ff6db4ca53014b21547fc6a179b42148e
SHA51287c1435448b69a4a070c516e9c28fccb59ac56f7239ad37a6febaffe22f152327211a6669a966fb8c344540ae896dfb2bd96289b9779804917a90ebb6396ff57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a644b3ab85257717f0948fda6d0b436b
SHA1549fee8d4906e3516981a72f72e35c903691a4d3
SHA256be6a9caaa72383490d4a2c164bad75084157e00626f60caeeed30a82fc60ecc8
SHA51211d1537f51bb5fa16267043a899b3399ce7a5530087d95275bb6b5f94bbd6c50e8517be6b8e696b7c6b8a3590852a15241edcb74bfb2ad288f37e6184bdf7bfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD587068a212f575f5cf950f84ab3005f0f
SHA17f4bbb5481aea88941b7adcbe94162f447d5b336
SHA25676319026e7dd316b14983f418cb0ed0178ded5ee394bc983a5d1c471c16b14f9
SHA512a29a640a948f63c616cc1ecf5ec74a34c9bd76218f2be9eaff8fb26484aa5061f5fd8bb868321291be73a92172030016b5b5186bad73d194abe6f5200ec9a84f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a634a1b648eb56296af56168fa05a6e
SHA135e3b11069c185474ed53ba8d4e5da7fe6134126
SHA25628de9f3c7b33be120b14699c4a43654ca77258dade8aa4829244f48b7858f591
SHA512b33c63ca6fb3542606796a5f8a1cf57353da278be91e0bb9cd48e9e3d3fe4892c367ecced67f32ea999936e0040df7f0aec42373c02b9c36ca9a6994c456c667
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cea7cc7b6ea84498598656bb66d92572
SHA1af540e4c7b2a85baf530c96878b9cbd242629a3f
SHA256840464a4c8b510c53c1045529a1d751e21a9913f76acc5b6e0c2ba3a2995a945
SHA512d1e93ed29aec13ccecb805a8dd18ad136359f54ed05a57818e81a4cdc53c71f8137174c33a641c9bb635df6343c6df25e79664daf842ba607f165bb2ef8cfa1e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b