Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
f5d26807ef24ca3c5a476a4652f50e7f_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f5d26807ef24ca3c5a476a4652f50e7f_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f5d26807ef24ca3c5a476a4652f50e7f_JaffaCakes118.html
-
Size
2KB
-
MD5
f5d26807ef24ca3c5a476a4652f50e7f
-
SHA1
9cc7e10547ae8f9dd8770d679cd852a200e76aed
-
SHA256
9be9fa7c003927d7ac9d2119668ea98defcf10493b6adf20ece2e81b3153176b
-
SHA512
d50709d7ea035e5621f5d5872e1a335c3e80286aac4111610d4481ddc74d13ea99f6cf1f57279ee3d3146056a638cd1253d51b5bd6ba78c1c9493cdf9edeae9a
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5035e733370fdb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DB47871-7B2A-11EF-9CB9-62CAC36041A9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000a85ebb57f804d053eff890956383d1e030903ff7b11bcdde8d1a7fadaa5242a6000000000e80000000020000200000001e8a3b0eb010e7bea5e32a6bdcd8c0620559b710bc36b075cb0388c0ab06bcb720000000bd53f9d0fe25e6d6c491885546a2e984ece9ade8f62b729725ab85704155d6a340000000c573546062e57848cbae6fb0abc384be6fd4cf095efab3e297f5dfd79b1706f075c327bbd1ebd9aaad14bc05ec7310efa495d6b134f2eed94b0af0bbd6c4a65f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000285429448b13b05972270aad65291bb85cb6833cabacc9ae1ad154cb95a3c95d000000000e80000000020000200000005be94a9b2e1113b4ee6925eb79ca182b1a5aec848472bc4a78ecaff0dbd4438290000000751b70c7b2c75f0f4ce783f4b22dd5e9a147ff3473b32ee7a0b147ba62f45b4425825a1b100a60485d726e05eb004ab750013108e198bbeb48ef93dfc665fa4b455fe01a020a6011641cbb1682797b03af20e43056a80ac655f2899f1d7e5498ef9043d9c489de6af34f032ff7b427a50aa1da53adaaa19d2b8094a43cb5ca586cb6e2584f51b22be882bc44d9e57c74400000008e1b7c5eabbccd96014d16f54983d7e5499bfdd88538311ddbc6866c6cd6aa321115d8cbe0dd13e116561cf4a42f1490d18471650a2407c57a31e46c683710d2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433422604" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2388 2112 iexplore.exe 30 PID 2112 wrote to memory of 2388 2112 iexplore.exe 30 PID 2112 wrote to memory of 2388 2112 iexplore.exe 30 PID 2112 wrote to memory of 2388 2112 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f5d26807ef24ca3c5a476a4652f50e7f_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f314fbaa8bd716a4830ca1bfb76e73b1
SHA1a6cc210bca5a033a178fef2befb985880481ccf7
SHA2564c2bf1af52f56ceb0f7812ae78109d9f1ff5b8166dea7f502f6b5b6324f99571
SHA512f12ca16d1f1e72eb5a9204146c6f39cc68c3580f709d7c8d694ec285a33204a02cd1619d880b31a0da31ec31b17cab3a89334c939225acf63ec6e8fef8905235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5400f7699d405004bb49fe7108196be02
SHA10f929d2d3ea3c1cee17efb4de18271c82cccec50
SHA256ed1bb004e63eba07661a23fa548032887084fad34255a440dabde23226be7465
SHA5120f7aba93042869561c03414afef8d3174748de2670e08f206d7ace3319b8e890a3457988b306d47d2f44f33a41138b263339c0bee66f21727788265a81f8cf69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59d81f11d9f07bb3fb1da1eb42025b2c0
SHA14997bc0b51e86c0e89ef480a17af6ab9170a8f1e
SHA2563269c080e61f4d1399a985520e7e14a91bb1dc58208e3e10af0f8184f46072a5
SHA512d5bcf843c5fae1c99f25107bfb120dfb2bb5eba253f0bff8c464816b11e07d63a2577363a5129cd724438bc98dd74aa7d01ef95b84f19ea5d28fed5aa5410c82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50506674990b99693831cbd1946cf2eb2
SHA120044ce2f6936628c17b55c24b6c462eb75be0ea
SHA256757018a4088208673f703b7c558628473598fa24bdf450862bb778fc3369c7e9
SHA5127f83b1d8e76167015ca199390ef9ea773d33245880fb2e38036c75fe7941eda91847cb454a91885a74967423a46f33b39e882877898cdbf5bbb916b9392e9bfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519ed230e5cb7da8f3663233ed978a20b
SHA13fa7d0004cbedc40b0a465cc8f55d8790bda684f
SHA2567f29ac53328d168ba82bada5cda6373699491ea793609cd5d012de8279d21134
SHA5127562b47b7023a6cfc3546c90ad5d4d2e21a325f09e7a041a706e622b427d7e2ae466c158a9a178978ea25958ddb666bf139abc63912368ad6daf29757772623c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56caf27002d930ad42004e0206d2dd26f
SHA165d111b3fb3815bc944e17520973901ef65a1687
SHA256d32bc183793ba58791471618420ba26e9849a9a87ac615f8929117fdc1679c33
SHA512978d310122c476f931f51ee253f6b8d11a4ab4a1f2ec9b84639d617011a5af364c326458a61e1e395ddfa0526ea31c60e8dbd1b7e7ae8730d6449663dce67f84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de23d2e5694a4938a35354bf990606c9
SHA1df2e966d24becad10c5422f3b48f5617e16c3f93
SHA256afa79c26d66c305a4a6e3ae241e4b7e57d836dc101d6afbe2bebdcb3074673aa
SHA51219af00e7813006164381451f013f05e2a7384ef078cf3ed1ae8ca00d7525e1250ba0bbbd9121b49b8e39f7ddaf1c289623a7f7a53764971d64fe7f163bc293dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537162e227883e04ca5dbcf1b42093132
SHA13aaa780a4e1e569a9f8088d605d5a0c370d1ac68
SHA256d34723ab8ac8e8f8e659e0ba3f0d36c481652f7defa384fc2d91481ab52ef8b4
SHA512f3f46c60b882ca697ecc0f338b93fb100cb06e11e15168b6b62a6383b549f8668ac136465c92df13da027ad960ef97386ceda9dfd5216d5793b84968fdf3efc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2bd03ec8169f6a956f781f0be1c7f94
SHA1bbb0cd3e07afccfdb29ff43ff04db932545ce444
SHA256c1cd3bb3b25d5b33379fd85f56e9e96c2abbeec5a52ede76ea7c63b5a9f2d16a
SHA5125bc308f3475a8554afadf048a6e9ad9e65dbce6e5ce4de70bf11e771f6cbb21ea6f45f5517e5efa9b51b8d0470c39952796ca5743fbf409eea6d5d6da0e6d3af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c683e7ab12bb9c29ea46bcb232e41d0
SHA1f503b0633e5cd239210bf95b0b3fec0d990301a0
SHA256c7e4ec3f764b57ba12a724015473e5e5fb0202136e3572604a36667128f2c383
SHA512fc0d3a423d51db0389b3f5626c942712ba1ceff3611febf23f76bfe26f4a665a4621482cea3c2c15fb7a5508767ad0119f56e40b9ad443ee2714e384f81605e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a7baa9c8ba40dab6e0c14e6c7386057
SHA12ed40c0157ef492c195aa486d8f50f2005677675
SHA25651481559499aba35b1e85b16391a418ab439bdca32465d6bdaea99b6c93156dc
SHA512d833beb322dfa7acab4f515f7f547b27020fbc67ef3ea1d3546d4d8b69f68468827c27e54c08e5b7a34e6ad4ac3b4b8f9a7f3fa54be2325178cf40601e8bcf0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ff50c99a0836d818ee5eb896c17cbb3
SHA1dc6d6d798760531ce902e2c9fc6726f1576f85fa
SHA256eecd6da8ea5d963676f2441377f3650538a9715c7edb68b9dd61b688e3fb8733
SHA51270bc9d996f0c5b6b56e40aa1146f44547162d19e95b94793b74ed7aa105722b821610ee8d8435eaad536604c1cb4a909d2a3d02f042939e00a4207240cc26c8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de4d80a916cf08ebc1b34c7b7a2fdd5a
SHA18531184f4cbf1ef00a89fb24ae1f48bcee8db6ea
SHA256a3a7a6ef59a3873faa87007d112c62348b9436d601a461afc1c62d0899b3e77a
SHA512e5fb60d5984e857c3ee3ca344609de0bfec298d7722886ea847dee19eeb1424cd0e4333f13046825b152e9dcf52a2a20c186e8459de734d610a8855ba9cb6a83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51def9cd072d196fcd5edef5572d99931
SHA1927cb0aff67ecdc0171d0266c4221e11a2f457cf
SHA25627c78c92f462f0d12374e1918d4211262182db5ca8e4288354d66c4f296f9c58
SHA512693d44b556b2b3d1a425a2ad0825497b153ccbc99b2c6055469e887a10c1acb01c4ae47d09e9f8ee80e3831729c4e3bde98dd0ff52a521b8bf9d392121844954
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cf02150da46fef712f228fb50c512ce
SHA1199041ac1884345b91538783dec3567bf329b612
SHA256d63bf30d2c1cb6dcc7c7f6183fc9ba22ac6c1a7696f130853768e3f4629937dd
SHA51272bf78f21f84d6eca7c5057cafc40fcde81b7cdb48000f1be948a801413442d7e5ea53f903b413758b4a7ae41718a6718b3e5e52972903dfd9341f80e81af3db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52621ab3498900b3da30615484b2e0bd9
SHA192291fcce51708e16849c8b6340fcdaeb0a2867b
SHA25609f5649199cb40df41d6b0ab39a7050a6f9244789be4d116ffbf63395386e859
SHA51242a935fcfba4404c456973d7b33f7e6bec453757774281cb49ade2447b4c191abc6effebbc060e462dde3700b2f6dfafee9cdcc79a191ae0c58626d8b8d55777
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530ec891519d948f7d0fe1371c0fa8930
SHA19504fe48e17689268e42d150268fb9d319cf83b7
SHA256e6e67524188ee43cbe380b0565506e1cc2ffac9017e0a5a22e4ec3083b716dda
SHA5127aaafec442a0de2713cbe3f208fa44acd5576cf9f1241bebf5cb3691284858b82bcb344e518a1df27692b1ef743e8554aa80be37f660c335fa7dbef155383a48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d578036a580c1020da264cf67714e6f3
SHA1fc3d3089b260968814aad971e9f491918d267bc4
SHA25674f35d9a57ec8f107449d363e69092a995478ef00384e5bca5c51d567b3735b4
SHA5122b48bc6febff0573a0f4c38b4d329e34fe035a1d9855e11137c3ea281deaeef0157f2e98ef9d080b868b854c9c6b7030239677a7e3b05ebfad31ccc8402ff850
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cee9fefdb2dffdf8e7dc07342e893ec
SHA1faa04fda9165b28447842fa280df182b2e75420b
SHA2562f5b6ee16dcf96d7456da6d31028b94409543492b01a7d9763559e5ae2313462
SHA512b47a5f7865fe5e66b7a6f6e33f62018ea27c5fb7194101241efcac660c5fe932fea2b79c0b4dd4a090cd49cee4e0f70d63a6c3bafaa029601d531b02b33530ac
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b