Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
f62c97dabed986d12d370db2b36ebceb_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f62c97dabed986d12d370db2b36ebceb_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f62c97dabed986d12d370db2b36ebceb_JaffaCakes118.html
-
Size
2KB
-
MD5
f62c97dabed986d12d370db2b36ebceb
-
SHA1
2c60c3ebe422300e2b69ff4b2c4ea0158aa75a9b
-
SHA256
d3f5d50ff53a1ccdd4f25556e449b191bc05fe048af102570ed4b239abd09e36
-
SHA512
dfece8cc157ca1d7d53cf4f2e6648b9413da957676edd745f24e6e3e0aac7cece3c34650a7ec5f3a774379257715e03d0889e7cd964001aeacb7d6d5174a9e72
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f003dd02540fdb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E6721E1-7B47-11EF-A27C-4A174794FC88} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000afbf2bbedc5762a0c6c62c20f86a47758d2f8fbe240085c069b6c79acfd38a4f000000000e8000000002000020000000876a50e3d9c71f58f517173797284160e425aeeb2e6ab9ef78bd2b7b25039a1120000000352a794a9e151fe3c9e27d59d286b20f1e5329ba23615953f21dfdfa4351ce90400000005689291e436fa9550e1a47ae64d33e98d057a4d55093cd9d9df112413498c8da9bfe4ef2ff23ec57fe45bf1d5f0509a73cd251f50c1c0d3c9fa350dbf073a7a1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000b96bad823fb9da3f485e864b158aaeaea6cd8573664a96f006600dbcda9c8e25000000000e80000000020000200000004d530c9b609d5a489854983ed911da1f66c5af05ad11cd6173e5142453da34a790000000ec71ce192c6c327b02ebcb95040dbdc40b9b796726e10c0d1e312aa8f51d66cf841f4d6aa464beeb54f14ebb4b15c3911df377aa1dd9d1650fb71f0808e73e792aaf0d1aec27450af4da480babf1049a44e030debc437839e1967286ddd64b88e1f9dd97ded87915a6188e45b6f20dbae7965faa5b53e4bf0db81053063f650e980634434726e02a2d54c2ed3d6891a7400000006cf34ba4069434e5d7cf7e7d318212a2f9e303d7b2be9d79d9abf99c935bfa4388d2c8dbe01152e7b4afa74fcd0dc741ffdf3227ae59c41d14d129d3ac1c6d94 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433434979" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2544 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1800 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1800 iexplore.exe 1800 iexplore.exe 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2544 1800 iexplore.exe 30 PID 1800 wrote to memory of 2544 1800 iexplore.exe 30 PID 1800 wrote to memory of 2544 1800 iexplore.exe 30 PID 1800 wrote to memory of 2544 1800 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f62c97dabed986d12d370db2b36ebceb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504778a776d1bb0cf8b02bf92f9dafb57
SHA17212e0bb1687d8cae083af8b26653932e4319aba
SHA2564478ccbe227027f229253f5352608f04737a157fd23176d5d6c6c410b7f5fd65
SHA5126e4e6c7d9e3a3d399b23f187794b9eb110ed620f0f0fbdcc0c2d4e5635c9f2a97f5766dde4e20b3cdab60bbe6b633d4ccb7c1d45406b58412d5fbebee2e8ae72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577d8190636170a75d367f70f4f110d31
SHA10e64ef957fe8064fd8214cae6a92579a0ec8254a
SHA256f1a8115bbc2b1b44e6b44a62dd1c04edd9dc8fac2a910854546efcff5b9fdb3b
SHA5128e0f39ce03df50851f59d72c7eddaf3508ce23352b67dc8c0c17f513092cc6074f00ea65a18588bd05bfce4827a3d9dfdc153f413d77120e52520ba34c3f8d52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a148bc576f50718ac62db8d6f652b5f8
SHA133adee644fedaa8b5844d6d734b306b0b6fc652a
SHA256376f6015244eac0d16a015fac52f08e4dce5e50a989acbf1d2cc3ea54c1d4f0c
SHA5127f0db38789d8c8932e9ac346c4ecd831d0384eda9e32b672f75f6ea291e867dc2875395846511d23b6f4e011a240602c71c06ed08524a5fc7b733ed08548aecb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cd5a5ebc03b34f9734cc58aaf8e97d6
SHA18637d64543532c14216c413816a9f0f95b4f54d9
SHA2561ada57cf515f92dca0219e91181dae077cc5d93e9c0130c6cf22dec86acfe0a4
SHA512ea13e89f5da4bb00cafbd7a6b06cf42830c5aebd7b55473c01fb7559d89246a17d4cf88b82936e9340b40b11ce8c66c527cf76f89094b18fcfc862e71dc4d638
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1057d9327cc33b81ccc9c56f2809604
SHA14034584da003d2837eac05cf46cd10b830415447
SHA25670ff581e9e8fe303fe58e2bde42b20a15c71b28ea8a5051022bbacae63d49b47
SHA51278d95323754d73d43ebf09b19413f611c2329ece3793ecfda78ed163c2d11d960e55c29c14df59a5906c3c9c86d42dc688a45dfebb2df9ae5ba08df555f91014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59523d1b8539911e7f05d508732518e4c
SHA1efb96da6a3c8abbf429d24811e37e5282eeea0a2
SHA256fd32a6aa349d4046b6a6918eb6a58091e12268ff197363aa29abec5e0ca6010e
SHA5125d350cedab915b86aa1b950b785404aeb6645d1c8a1c67878b542d4671a5fcd7190f52c9759d8d01745ccb49ff0225fe811a449a9c1e438989d80367dcc27fff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b278d48473861a7d033c15b3e108584e
SHA14817c18d9e83be714fcb4936e3dd111e3b1b7ef0
SHA256038932c4bdf1ba993a0b924f2515abbb55711c592f65dc72aa3042270ba53996
SHA512c5e6ba80e5b4243921b65cee86ac8ad5f621829ec56f76bad569ac32e845bc05f14dfcb081e3f84208e31ad079f0d3e7bddbe0aa292acba3af3945e456c8c3dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558333a0ee1c3a5fb99048b1ca931252c
SHA19e35d8b7a02a94dff7366809389bff3ca4c9ae36
SHA256ac2f32ebe4cfd65e25f1432cd772f200867f41c61301c52fb0952bfa787234a8
SHA51274e4a92a244b67b728eaf3e5316692baee62c1b60380f1307ccd7008796f9f7f94f2c1d978c0c4d9fbf8a9f43042c54df9f6a27adcbd481ed222c5409fa4fcf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a88802562f986b918825f1140631f20e
SHA17f2ec159fbddb7f73c194105f3f998be1e58e50f
SHA2566dab501bd3ec5589ee75b9eac2b9a3ad98f001d3af423175095dae37a4514a5d
SHA51275413728d4fdd51fe331958931e4a24bcc7a85120757273129e05789a60ab1e7f4907782655a8e01b5dbed58f252c2fac014f0622f7fcee7d7dc178cea26942f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e452cdd22dc01d3007853152051c0530
SHA123acbf334cc38d0154e7a87c91673044e2ba52ee
SHA2565baddbe873417e12276c3ade2833d8d1984a74e017df47d61dd7cea66404954c
SHA51280ce9e36e1a79a33b0692c22637bb4d65af484debb9d47a13c530bcdba52f229b99418031434e717438b05228f1f6fe6406f64c2670b32e5cfd6864a82b31bf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b87f2cd36dcb67748c7e1ec586fc763
SHA1cd6b05fec6718433adadbf8cf3aa938d4110d6f7
SHA2561a66492d39b972bf2af3561aab7bcced8525baec5cf0d774e7656cbb5e658fbc
SHA512453e858decb866fef88b2db22de3c2a804beb400233b606801096704c473661a06357577b9bc754994018894a1d4d347524ea2bd58fa83e74aa8b6fe842d5676
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b