Analysis
-
max time kernel
132s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 09:38
Static task
static1
Behavioral task
behavioral1
Sample
fa2ae8a159a62b4ffa4c946ef160334a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fa2ae8a159a62b4ffa4c946ef160334a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fa2ae8a159a62b4ffa4c946ef160334a_JaffaCakes118.html
-
Size
985B
-
MD5
fa2ae8a159a62b4ffa4c946ef160334a
-
SHA1
6d928d673b7b52013c6163bf779d1480ab596876
-
SHA256
46222802d8077c3d908336f68e1d66d9c3c107f15ba0ca0a7a1195465aa3ae2e
-
SHA512
269f00d1ec2e73294cd0e8e70e3e8644282eb0ae303176ed9ffc6e7160024cc99c9bfd45195fc4b31e149459f511438c4662a3a05abe486b5a23cdd9d4b023f6
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433591761" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9013980bc110db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000002cf3968c3c8c5f75f464f16cf4d3efa9ac9bba8a9e465f1dc9fc105c62e4c370000000000e80000000020000200000002e4453022ab2708762313ef3a92ebf2cd8898c3cbe032f5b1402f3f4cc7d597920000000966706c7f77102922bb51b70cc1d6855f6fabd8ce363f2e7a2451711af77a0524000000011d1236537504d089269e6284f5a93d85b422507e5d9d563dd8d9a8e12ac03d8eee22937f669caec4e5fb367d0b4f06cb3e440c61df9866e140a60400bea9c77 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000cc028801de92a21a25f019cf151175da7fc8411f8aaa9527ab8222f18254724e000000000e8000000002000020000000e33570e1f527b7bd136b45283670aa0fd551863683a0cff2b076c9199eeb36329000000098133e24b5021d53bcfb582f426a4423ad6c8a522393f41d03a6fe35370a9e49a6bcb44657462290c8e58dbe872f7f9d7c595f97b21e4738cc2090c539f659a92047f8c371f2f485f0b1bfffc87aafc6a0336d15a301fc6fafaac0d7274f3fa5f6b4df099834baa4e332283f07ba14abffcbeab6ba6390e8215f5157f5b699f79ebb1523d6f5c598b5f23de7c1acbcd4400000005d4d7fdff7bfd511e8d654da76a7c2d4df0466b53b8c621c3f80e3fb60723a74b54cd13f1c704441076c62b063a435e79f870c312982be3f5c9b1e650ad4f896 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{371D2871-7CB4-11EF-9584-DA9ECB958399} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2720 2292 iexplore.exe 30 PID 2292 wrote to memory of 2720 2292 iexplore.exe 30 PID 2292 wrote to memory of 2720 2292 iexplore.exe 30 PID 2292 wrote to memory of 2720 2292 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa2ae8a159a62b4ffa4c946ef160334a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7d273139032d2e2681086e83379afa6
SHA1eaa37b3b25b938193e0e1c0650de7274068eb05d
SHA2565d5c306bd200d035b51485a2e4f4ede954435b555c5fd7db3ad749c1df8aa194
SHA51297d3671b9c74bd4680234beda577d5374a91ad4325aa0575fc26c142cb801f2e2e98792b7bee79e6091caae535543d6fb9bbd6047887342e30b73771d57361c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4d1efbd7a351d4a79441539ae7238c6
SHA12d9c9763afd9bbcae4f4a3c4026c82de88bcc6b3
SHA256dfb1a9ff6e6f083a3a6f279086593f0ad4f7670b2058ea9a2ff49dc275e1c3d5
SHA5122becadf176734fc8ea433bd69ef4a035bb1a07d938b78c039d7d9ebe1704bdc7cabe5a257f116b15f4d0e834f321fa00356822a3f599c28a6ee46c0dec792915
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8637c3ef4da5d1a8680035673979752
SHA14b596989025270eeef1b7fc68ef626124f987f99
SHA256427527f7d9a1fcafd8438544524c40ca50c690fc78f554fbfce8a9d5e84c2094
SHA512aaca2e6f7b080d2eb66abf3435b8433d7c0c854c26ee42aeecb48e1549a9b220c9a82509dbc3c6460bd3d39170aeb074d24563938a2917b59ecc31fa3190c850
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597f81d89d47db4c18c28a4bcafd1a733
SHA13363879663f7ff553dfda1bf6bdefc9fad058792
SHA256dbecc556d3bb0e67b4d9bfddee78f1269781587a6eeaccc79352119a4a32ff51
SHA5128d730b74e89c05b01f55062868e9f7cb8a9f291f6155c8a1d228cfcbbf132a9b7f95050a7b883fa10865162290312558c29913712dcc0039d546719d907eb18c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5616f98de86fc5876b62abc85b1a9c4a1
SHA1f327b41c28cef2b19b6bcc52f7ecd51bebe0808a
SHA2560addb255398befd1830c85c89504a6fc6da731dc0af278de535520f5c6884fb4
SHA51274e073889100e4fc8695b46a11c55e4f75018ce691740f6ca6ce0f300abd8920544d28ae82975182697fb5afa3d6ab19085437ed5be979081a7f39ee3f22942f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d869d10f1079171c81eb31d55bf92203
SHA1f42d183568488638f93a71f11ce824e3a9b926db
SHA256d479554685302e6d3c5da663a8601d68af005582f841ee2959312d2a9a82b0a2
SHA5126bb6543aac03938c0797f68e210895fe2289db056936c5505ab03a135973a480276cfe8d13cadfc8c53eafa1c407244759f31845739cc1811db9bdd82f2dbdff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bdaaea8d0038d679750cf0d8906307c
SHA11049db10043e69eaa0c79bb1c2bf93b0d4f1a2b5
SHA256a6e645e3c561a8bca7dda34d23cc15e8b54d9a1e229844cbad259ebd7a20728e
SHA5128d8359d3d7d5bcc8eaf5186ea20e4ef152b3baea1b882f11fcc48b08d4ab7376c12c781c4ab1ce6ab1edea8327445ed3f540248d22f0535d9480f5df22807531
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e5611b62472652a656c28fa9a4bd5f5
SHA186c2aff0e8b874df4d897fb4c814a90db733f246
SHA2564772497c11685cafd9ee7a683ae574a6d4834999aa0a54b38b350028dd232150
SHA5124a11ef87b6f52c6b70f527bb1e0b95fdf3c0afef32c2dab831e1cee90cc2f5d215468308f699f1ef50c83fb58528780a16d62f0e2d482ac004194c89083f58bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e261b4b84d4185a8428750a8951d23a6
SHA1b40e6d23ecdcdbb47f3f2f4e662002a452a4b92c
SHA2569ddfb92c00b9bd133d376d3afefba82188bf12baeeeb26acc53e39982411bfca
SHA5128361e28c2149ac17c9435becf46e28d0630e2d2704c708eca9bb4957b743de696911f7b5b0314d00c0506cdd298a3abbd4ca3d187c85a22953bb6370fbecdd12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdb2499e2fd47f85ecec2ac632f775ec
SHA17612e7828aa1976a35d0f7e50ece2f2cf85a674d
SHA2560adf3f904e3acaa3385b9e3108a8c60845367652ddcbecc96151e7eaf80edb95
SHA5128d811b748875cb0c106fa85d620be2af36613cec3bdc055c97fe2ed535d647411b818077eceed3c0ec40f75079939503b3801307cb4be2381d522fbc9dee3a56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d6b464c5513c28b5c1016e4704e2066
SHA156fbf7170c6af04f509b705424a0095b6c870124
SHA25666f572479ec63bb922af18d0132c3d830a401aff04ddac34538158f786aa2418
SHA51274a5fbe2b57fb0bb9ab2c78cca36f291f790f9fb6ef85da1883b3a4b2e871d48756ad16618ecf784e527c85e76bf61d20d0e56173ed2b82d6b86d6d355f9ddf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586dde61a09de431fca60fafcccac2ffe
SHA126319051f676310eb57cb7d957cae011cc371c66
SHA25670015485722a127bad3defd55b29068cbc2320db557d2181c64382ff54ec3dc0
SHA512e645be87f2c046c02739d1d9d82a6abe505298fd62d03b8704dbd3447f17319f79a69ef62b498689b7f52e988a801d9b7a9c7199aaa34ed967d4fb3f1eee3bbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7ec1f065294f314ccd3210ea9ec1db1
SHA195e46c598d544f5f389d4adb85e803088ea41136
SHA256a86645546ed7bd32c18033afa6ce81466dbfb93321a31b6545b3d71f92d6feda
SHA512f776467ab94d094e0544cee1a9ff08ceb0d2f44f32f9ac6b1b7cce52b7a31ad89bd93c7b6acb0c572f49fd9ae98abf68e7f283780eba197f919e94beb7c51923
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5812547dd91a7af809300846161c2b521
SHA1cb6773684777a499d044f68691aa55ff248cbbd0
SHA256ecd09a3253ad3259300da3a9dbaea933b3e5b80d9144e5e8912603d76248f8e5
SHA51271123e297d2128774b60e961899f482bb21042fafa370a7e6e0bbc61a3509c66bfb94e095e9bace382abb9d1965f1a5f600654e911be9f2ae809e16a7a8dbf87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52977cab3cf18f66fd37ff82f1da81a68
SHA1d089dda6ce5f9f24404d4c8d224b0a6019f7f234
SHA2564a86610189fd707e72a1fb835622326e2d7ffd327af58d1206b8e55d5aa2582b
SHA512073147f0609f84fad4c85b5f378fd2be44d6c0b608b7284b8e5c3494988211038d98001fc731984a83727a26923efbb0df34e82ebbf8f2c5774cef2dffb42f81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acfe0b821f1ad9944528e71d51b1a7ae
SHA1a8ae194bcbcb9f6ca536ef010e3e18f0c8071c93
SHA2562a5e044bb9856cf7ceea476c3004ce82b1467b3e52084a7d2cbbbe06162b5292
SHA512b79baeb27d5a05e14be9e60a2ec91ad80144492b0fedd5b3de7e6a1c89c5f35a2a324d4eb839d80038a6c9473955f13169cd6468a54ba121c0a7fda2514c15ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597b931078639b4a308eb8b8e6853cc42
SHA146fff8035e6d5d6e44f1cd4a94d53c5b9860f324
SHA256bf3bfac3dc0c2f33f4b25348db0bffa4292340e49f774d71b79738f694d91df0
SHA512acb0b179c16c64434b9e11eedb6274d28b53a3c72cbf53d715679981e9891d3c341d4db303e68c1772cb5796b03cf89dc3f4ad574b25c5142f661dba110163f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7f5bef34edc4d8f7f39c719bc7b5f7a
SHA1ad2fc3408f7d208d9abfbc44f4f6ae1534d6a6f6
SHA256e58dd67418b35405f0d5fd7c0428466a9795d63f3cd26726ab2bb3231032dde9
SHA5125046dd9590764d8b1fb19ef3aa01589cfd71f5ab38a6da684effe8ad6e984b571558ccbd3be557cbbc5c95c3aa7b8b2ab183aba899ce72fa57bd543476658cf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5025689e77c1012fcc38b712b7dc3b980
SHA1dfc49ff4f108e528b2f0bf2ef76d0103a0b6ec89
SHA2560d47610ebee3d90c00c3d841832eb6ada361a8fa484b6568d579a88b20f46fba
SHA512a53dcc918cb27bc9df3337419c165b3dea96bbeea0d8798f364c9e36384c0ba72fedf5139c1dbad520a635155eebf7857808f96d5ab2366df124b350f398433e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b