Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 02:33
Static task
static1
Behavioral task
behavioral1
Sample
f98b8c7c7cccbb757aca041adc9a4253_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f98b8c7c7cccbb757aca041adc9a4253_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f98b8c7c7cccbb757aca041adc9a4253_JaffaCakes118.html
-
Size
357B
-
MD5
f98b8c7c7cccbb757aca041adc9a4253
-
SHA1
6d57badb056324c962483b4bd54eb69a9283d2ad
-
SHA256
d4575940b34b8ebb1e7256f10745e6043d8ca254781525db4f0ed603fa532007
-
SHA512
09101d1aae0acedf98df669108b7393a54d700ab55368c76d0519ebfb01277fb3d30b4d9de8475238db196eeb42c0af64174c5104efed455264963ef06f17c99
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000061857678a795fd2529e3ad91ed48f037978a1e6021a71232ce3ed22d806fb6c2000000000e8000000002000020000000e7eedd82ebd3cae6d4bbe78e3bbab5abf05192a39c815516e20ac003bc2965fa90000000eb7691c7b015c28f7142bb996d750050941b53d3715a2c9180b8f3c6b64153c441e279b06a8868c461f26336c725756a399c8edd72a34be3a4c148ed1cdc5c90bf8a2e432c04b3f042a1e9d31c00bead3448564cc362eae87df6d3012973594f02c50adec04fd38e0a0de7c4f422d2c7c5c6df4174764664cf22964bd21b2ecfbea62294d416efb8efdb2858d195a828400000006f872be43a6919a99bbae3f6c67f297c1322911042bf9ae4feec48c114ea65fed29a442f00d73940391524b6859958f5d2870edb1908c05d4c707acb6963cd9e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECD00431-7C78-11EF-A27C-4A174794FC88} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000168d43f60927e124598fbe0a3de77861c66198c6e072debc5a30cdb0ca386964000000000e8000000002000020000000f17765f8798c5fb101e5c6ba7beeedae4b55d44f7bd9af75267a9593f203324b200000004017e997842373ba43263765b8f7fa23f705dbbdf8a62760954d4d0ad22281e14000000062ce95733c5fe65d493637cd068b155519c0b2dda85e89d1e6887f8bd28426a6adc99920e69866cebfa3c8ae9a9c6712f8bc9acf6e9b8486467e66331c3130da iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304759c18510db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433566295" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1908 iexplore.exe 1908 iexplore.exe 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE 3044 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1908 wrote to memory of 3044 1908 iexplore.exe 30 PID 1908 wrote to memory of 3044 1908 iexplore.exe 30 PID 1908 wrote to memory of 3044 1908 iexplore.exe 30 PID 1908 wrote to memory of 3044 1908 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f98b8c7c7cccbb757aca041adc9a4253_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b257d02eb7b4e0143822f2f5bb72b8ef
SHA1a6e8ab86449f2f487c88906f9f2abc8a91ab3238
SHA256196e8a4f713518fd31c863de0e05434cb23e3c379dc43da1af9141c945b3c688
SHA51276796f4f555a2be70e243acff9caf284bacf111c6c4743b83aa3d364ad792c1bda31fedab558ece54bb633e4760ce8d0e7574affbbe2195005d6717ca15b2934
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5705da6738dfb331426e4d4296b0a59e0
SHA1820075c0aa8756054c045c66c992d380f534d755
SHA256a2b0742a0d074b199b81b221e578287d7aa9cd16da451811bc5ed8bd722796cf
SHA512837b125c8b0b3a77bed4bb89c1cf020d402c374039b8ef96a5d407c77a72139590aae049964ece8eaf2f69ef4c017946ba85bab9cea46281b82d1917ce27b13a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5908e4053b65fb4730c97ad8faba440fa
SHA1f0901f1618fa561eef9474589ca2e67545a91b72
SHA256eafe24c88b85e4aa566bf9e264f9c3942f6961760cf0e6b0aea16667203310a2
SHA512e7e0f302197b09ab563047d32643359d9d4b03d82d8d9d394c7bad6bf02b49b6d57342a7f7877e638f4881db6ea02452c834782713f94578d92c637a02318f07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5542717c528015d5e0215d237f67eef5a
SHA1d348632e88d323945426b5ebbc9e942319aa8bc3
SHA25638250d61f59bc216351fcd8c49f810b7691261d71afe6b7ffa51992355f586df
SHA51262ccef80ccb4aee26524e75ef2d25bfc61bd4ebe887487eb46eb6586fd49d49006bdc7967bfe33bbfb6be263aaa3f9bd168cbfe0f151690e89d3fcbb898c0e79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58be4fd5c33427aa9be13dd2899926d7a
SHA173653c63ed22d27ba2cdfdbc3ebc2b1b506362bf
SHA2561a3d7f3e2695078c85186c80333115e44470cf2671b96c521e4b6ba5d6e395c5
SHA512183ba907ff605180965737e716b604dad861eda6212e9dd788949c30d874febcf553b8a945aeb05e03e01e7562c2b6b2c2f6eadf099090bb7cb881b57641fbaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5492cbb0c88ab1f7d7961d39f8d4d2d92
SHA17eb4d3e555e94e3db20ad25a884a7cac6a9520b0
SHA2569d696f0bf5e375f5485b189e6532fa18909367d1c1c53e482057df2de5bfa709
SHA51211e63eb1c7225ed74d42367191a424ef7ba07dce5ce150df7323c61a987770126fba6dde8ad9f0fc30689acb0edee20d6253bb42ec867beb77357331c2754aa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531fa41959ffa1da1e98f1b3b6da49cde
SHA130ff3a738f39100e6add21a522efb70303a91b16
SHA256ce06a1d7d3a1f2dd0da0b671a1fdc1eb2d9b0aacc84b3a65f22096036ba64c67
SHA512bfbefb8262ae1a67d54b86b604adc295c2d9534027792c40d0a173209ba2658d9b4a9f8eca974c4f701fe2068b1545f08bc8449363fbfd3d1e3c3251482b559d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5098cb3d67b64dd6ec526667bb3670559
SHA1bd4bdbbaeace4f4f3052bc4177ea46e851af70cc
SHA2569b5f0355b24659a144ad1c2a135d374e9cfbe8b6189c39b009c9178e297d451f
SHA5122af7046f4560ad3cdc677249ef4a10b1646faede92cda94fe9479fb575fe4af7a80d1387ea3aad84eb5a2c5d8650e1202bd8a6ac9fe9c3e8d9045d3c8892bd11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b48eee990b74d3687b74e889eb681c74
SHA1298471d101640a0412a79ad4bdcd213f913b0b0a
SHA25649d57d142d624bf8b033f2c134116c91604afbdcaf564e98e21827b1a57f93a8
SHA512880f0221f3c4b094ab4c2c669c64c114130bef033121f32afa8b10e89d058e0dba3e5061954b9d120a6d42942d43d51bf2fd4a5628a666932454e5b257bd7898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54849ee2abfa644fdd311bb185dcc5418
SHA190d86820aca154df1ccb237d52635eef8f2c5ae1
SHA25608800888ea0738e0a35a405dd49e2b619b5d777c98c915bc10510205e8756bfc
SHA5121956d2d263ca5bac0a448af5e9ed390fa3030b4229dd976b56d0aae188db76ada50f80f17274a0b6e77cb8580d450dd2a3f91340794285f2c2658d094ee39060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c971c67e8c5bae7e632b5993da5347f7
SHA1fc3cb7b3c113027e4f9d308146b124b4d5bb3af7
SHA2564b193abab8c2178b59d80736b8968c7cc3ac9dd2d586541592567ed592336db3
SHA51252e7ae368ab9f66b950be0ec76bf3d4b876776585497d1170fa5baa1c0ed16f6760417c613a42fa7002f451eae2d1440553fc5a9b0a5031019bad18bf6444fc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544fcb41c848bd2ce9eaad65b2c09c4b8
SHA1ae0cccd0a5a737cb88dc767e1cc27a726a47f63e
SHA2568d760d16c085a6f2b5c0642adfecbd0dc02dbe6787cb07308bf12aa77aadba94
SHA512ec517ec4e7f6d4dc3f506ab2ad7e8482066a4071f1b0d1d9d30c2c910fb0d3ceab953d424c2edf35f82985ee47b99a011a705f3ddf09321074f9f38fb61f4d03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa8f9c7861c845ff55c6d32b4757a07e
SHA12a9247992b8e556aba1f60239d45d28e32558b56
SHA2561404241c657a4a64cdf1f60e17b3a206327be0bf7524a572e3aeb738e1fcabdb
SHA51289c9103df379609c4cc7528734af8d944353e4fb8d2b5240cb03c7e9b5c5b6080f0ad8759c3299f0239031f84a1a71201887c5143319dda2356d993d566e34f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ffc0b680d73c8a4776b916ebec51dc5
SHA109f9509ecb36be0e5039e162f980c08c186b0f55
SHA256fb85161124be7e58a23f6a29eb304ad14420d6c422bec2b0614902acb3ced908
SHA512496f07599685199b4332cb343644fa71f2804d4fc19f0681aded02c313b974f59c080d5ccf415bced2159fb5a1808d8c3eaf29e7604e965667d9931a887d56a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5234f34a3530d597ae5ea63af5314d543
SHA1bd51eb7dd330b5e83c62a6184cc25133808096dd
SHA25609b4810ca429b490a2f466e78547199fe42ace43d7f8ac8621b74cec425ba8b4
SHA5129685db05c0ed311eaeef1b0168a8d92545aaeaad8419804a3ad1a0a1395e7468145055fead8600cc6a2d30c2a5e39ec8c33a571a806334e9dfc96960da362cd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502b9c56c2eb2ce0487fe0d3c91ac39da
SHA1b65148d845772992f63dcc7b4c8408ba2238fa42
SHA256619b61873bbb8c18592751953a833fbe5dd6c341b2dbd906382667fa0a0dcd2d
SHA5125407e26f7ee72304386c53f16f8c09916338c4d3bf09eb4c52685efb4e4b9d7a4802534e815f03b560a3686add22f1aaff4fa35edbc7b51c42edef9d7e2c8b56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7012c114c9af32dbe82e07a5bd56252
SHA135546fab82c9946d51fa8f32f5c38a0d28169631
SHA256c52e11479e1d5968bb72748da3a232a3c4468dbc7a08707e25f66f2c78ce003d
SHA512d0d8e1c62c3c6a6221249fbbefc3abfc3f07ee678b67bf0ce2b747b9e3d6c15c7fdec556373e17c0775d38477822eac6c1e0d278703576d622cfe77510405a97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58664ee3a3f213754362bea6c1d3dfa7a
SHA14e6a06e009f9a092f80a5415bcd6b9ddb4eaafe1
SHA25654f6216148a945d5bc6d5fce642e3b51e8f48abaf191069c02335ef42ef39352
SHA51220834093314aeb1d8a01cdde5d1570a5d741edf1c18f1a4ee07bb6ba41653fe12134e0e0ea91cbe86ca8af8ffe9c5321abb6990949d917b9050b0eb3b09cac24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c008bdbf184555fb528c40ab5b92af78
SHA1573e2f3b66dbb4cd22b798601f5414f4585baa11
SHA256338ff003652d37bc0e3f1f4b00b323650be0cdabfe951e20dce710a042f69460
SHA51287bfbee2c12db614b2021f23fd62a1232b1821c8f8e7f190f98dc6cf9c26f2b2dcee8bfc8bc5721ab49930442ed90edda6f92d1c65bf1bb7e7939a4fe6fcef33
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b