Analysis
-
max time kernel
71s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
fae4c9474d595c71200a3a99ada243d9_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fae4c9474d595c71200a3a99ada243d9_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fae4c9474d595c71200a3a99ada243d9_JaffaCakes118.html
-
Size
23KB
-
MD5
fae4c9474d595c71200a3a99ada243d9
-
SHA1
8b9501f8b76ce8f03f8440b48edcbb702eb576df
-
SHA256
9dc3abe9bc8dc205fbf8f09e094c84486131c663fe2e05ec5627a993ab659a32
-
SHA512
09de9884bc47d793de3ea84ddcb23a33c39f9174f791fc741a0594079e24e732e2a4c78e9b80494258df82e25471bbc0fc39c53a7056938d30bf21bf84056345
-
SSDEEP
192:uwfGb5n0SnQjxn5Q/3nQieeNnbnQOkEnthpnQTbn1nQZGLnLnQtQqMB+qnYnQ7t0:jQ/BG5Un
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000004f862b6b42a7ccf0f8a693fd7e14fc3955c64cbfc9e30a7122a38b2e7f04035b000000000e8000000002000020000000b32757cd5be01ea0f97383eb55bfaf1a866c82b946303c0e5751bfed9e09d2f920000000263431163365ba72a65ed9bda8f118deed0622c62956aaa14eff4fea04b84a84400000006b67e3339a8403aed57e202e38c0bc4aa635e07ff9c7a8c393b747905610a0ec831215453ba3ca5f6f15ecc46c594c2db006c18f101c644bc1488c4d1e9f0f50 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a1e0891f11db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433632325" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7646A91-7D12-11EF-A4F8-F6F033B50202} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000a043c27c109edae748107bd1c360310ad62149902d3bdd1b5f8a6c6d48bddfe0000000000e80000000020000200000000924a24c82730aa406f5a510e376ce09c65c3dafa243c5e560019fe07676b5c29000000097e88fd01e72917481fd271e975984894d62b9613c5eba2c3d9daf6cc84620707d5029a0d114562ecd95a5643cbfeb6c733a34e388f42867b7dfacc38573ff4b95c6d9751df5a034bb79a35a7abf22cabd9515edbc4b7de057f61fc132cee69cbd95811d2a1801698b01a2c2df8ad9b69f66c7aa88e95099901045b970583a5e1f3317f4c1952fb32500452fd63d510340000000c25c3df363e4b86f966348df050d9cc4b2fd63a6c6f5dfb3972d0845089bb506469eb831feb35b18b5c09054a64839d51ef5c4030c54db127d34936bf339e9dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2540 iexplore.exe 2540 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2300 2540 iexplore.exe 29 PID 2540 wrote to memory of 2300 2540 iexplore.exe 29 PID 2540 wrote to memory of 2300 2540 iexplore.exe 29 PID 2540 wrote to memory of 2300 2540 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fae4c9474d595c71200a3a99ada243d9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5166252efb4adef5c16e06d74d95cc673
SHA167c07bb20d6e5e7235a1bc4bf47c6ab7ead764b9
SHA2566dd9a031c46f44aefc9ded9723f5ba50e6be8f29633ea5f035399b9ed0a114ed
SHA512ee710da86a6aa23e83b1880b7af875ec95765b060dfffdc3c8467c080fc0f77e20188c3c64fa879c2bdd8a36b6ca8b3f8b61ab4f749e05214164f30edc3bc053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539d1250e8ba15796c9ecce6f7df59546
SHA16659549f43b058f5b90d87958d31c28480f9734d
SHA25683217b0284225c5b8581d55d5ca592f752d34f0e90408009e7293e4a66734fa6
SHA512bf957de4f54dce687c37f68eb39a1caec35152ed1cec2fd6f618f1a36d0de991bec2dcfaeb354014df77bb33313343a9015d63fa7d63c5618b22e53b22f5b129
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510b2b88bd3fe6116dcfc594746273859
SHA1d6ec741f6a41623e66b0a4bc3f9006151af3e895
SHA2566e7ee5861b5ca6bf81e17f9d4b7ffe0a66963dea58520aa2709331163fdc4dc7
SHA512fa5ef7b1cabac90581b83fbb97b619f64739bed46ddef1426e5c3e693aab33f98aacf5ef234a25ec7b9685a2efc03bca3c81f1001fac18213533ab9a7452cdad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbab64f203066d01168771719cfb7953
SHA118880b676928531517fbb0d700979dd10ec286f8
SHA256c39f9b17578239fc2934c9d6b86cb13423302b4b6c59ade18a93c071200700e5
SHA51282c72e45adc7298258d93fa92473e3b8767c6c09b84ef18edac2a96a668ea55123a828ed99a32de90a6526cc341689a61008aba051de61205cd5d87c5a262db8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567b74d23a0a95a49beb3e092c069b22c
SHA1174d358666c62305c6bba7055250b71fb4dd9053
SHA256761d8f772c9e3b914e5fdfd6ac88af56497d783c693a638bbed814b36accb72b
SHA512fcede3ebad7ba90e2573cbbb7ab1b613deda307600063dd9338238d3effa16b3f4b5619cef12d0d169983ee810a5b11a5e4469d914b50f8fba7411774bbf0f8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a955a77bf018b15e2f361b45518a974f
SHA1562e6076f23f580d6ba6a2236d6a1b8da0fd8551
SHA25610d082974ccf29a5d2e6e543ad7fc4b4ae88d30bd0447332d989f323bc42e75c
SHA5124ecca5790d2c049beccfea507fa7459d68d486dc6c5d5da6670fc188d52f30cfd73bf3db0ff36923b8c0cf9649a8278b032057a6ddf141ea7f55234c869e8d1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555af4a5ae2a920e8052dbc8a97e84fa4
SHA1e833761de62641cae02a0a604f7951eaca601614
SHA256c092c5f6c159e779df8e0637a46178787c651e575f9cc565c84e089dc500e330
SHA51245b00aa86bcb1c94be67bbe5fbd94bc94e9d2b0b0217676ebe18788a226a199105b48008008d2fd5d841063d7c34a01896f5fde3b2b8230cfbfe1a73b7b32bbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bc6a64966e1ea90901aa228b7e548fd
SHA146bedc3457c2ead6bd309d09bd333b41b520b0e4
SHA25691c052b149a8f52a53bbed73a2af33a72cedc2d2f6cfbef76ede6fa34d16c564
SHA512a89f1d0c853c0034dcae5fe657e3af2daab2727a0b832208a7d2d6935f1e94522ab389b78ab1ae23bfd78ade599af7f9d143895807b729dcb3f8152c683b0690
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5983860b6095663d3f5f2c8d1a870918e
SHA15972bcf6e704eddef1b9330fbdb5f1347cdedf8e
SHA2564805d2b621f9aea61734643a20cc60f733c5c83f898143edbf8d85a87f964c51
SHA512579b02e10f43b6006fc1a128485dcb7e7b289ad118e6b1017002de9d245dd2272c0ad64750c6fc17e887085c07c90ff2bb1e29b1bb326612a17b003c36e5c16f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8588f58915d5212281f179d1f3dea0b
SHA120dac021921107b6c9781a155c93788b822ecaad
SHA2565283d85bf76b94b9a2f6a5b5ee9fb5caed9fcacad1b800206e473d2367297f87
SHA512b0ca83976d6150d7a3d561d0b1fc83accec2d2128783b28b9b37ab3f2a993b49d6fc618b8a3c578eda16701cb6243626d9e6bccaa5cbd2f98017f3bdb1d2402f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fe2ad9744d01fdc74d8ee8ed0a224bd
SHA136532081634e55abdc4ad5ed0e1d0cffbce02f39
SHA25627b7674ad1f5eb9830890413ac0639c922ebf06a18e65db3bf176f86232c94b4
SHA512dd79d2036792ec0674081efd62d360104b5290f9ad2ee78a0ca877bd60d3c6fe27187d0c0c2469f369a9dc581c5909a00d3a871aee9eba2959d55c629990e96b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdeb81b91610da35a6294dae3da2f460
SHA1db2b54ae2c33e60942d86e9bb5393460552be596
SHA2561275146abf91e5577ecb886430e4bf81cccab32ccc2b0dbb8ad5ca486365804a
SHA51231ee50eaea94fdef0f3f3f66bcda4d442f028d5265fd5dd12ccdb25f343b87ad4f9361ea3d18e8af5ab33195e630275941964199b8c503f158e6b5769b252305
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b