Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
fb5bf50a7d9b790e11bc515ab3c78713_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fb5bf50a7d9b790e11bc515ab3c78713_JaffaCakes118.html
Resource
win10v2004-20240910-en
General
-
Target
fb5bf50a7d9b790e11bc515ab3c78713_JaffaCakes118.html
-
Size
2KB
-
MD5
fb5bf50a7d9b790e11bc515ab3c78713
-
SHA1
70d68a33d0ba60e11d4c610547991b76236e582f
-
SHA256
2f9235f6226e22b48d17572e5241edc1325ea95f09d85da94bb274f31b1704dd
-
SHA512
1aebfc38b43e43f8f9c2fb09776f8b4c1d01fb8cbe2b98c81451ac838224fecdb127f8e82e4f01dd45150ed5056526de679e389556f0d7f4b9827c4238217138
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433653721" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AC76A01-7D44-11EF-991F-EE9D5ADBD8E3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000002f6164aaa9b95da126d966499ff8d60f44802a47528fac5419da62a645401a0f000000000e8000000002000020000000fa4d2b382e1c5cf65ca88d657bd09398451b2503ff52237f0f7ef63a986bf1d890000000f56f1bf39dc336b5145d5700cf9165e231abc6650df93bb64a63e0a464f9b92ef40927c4e3a8ed956696c94d6e237062de770130de0e56ee1f55938af0d84a3badbedd976b378b86dae7d293ea43a3e96bdf31e2275a2b3753e37b0c63216ac3d050fc5fe61ffb90d37c32147a8b0144214542389b8c3e575b1002718e7a3b7eb44efbbb11984a036ff741ec200a2ea340000000470bbc75502b59977715a4fc4ec2e71d9a7ad1c9b08c9ae5bf0400bc43f18e272214f1016e9cb9bc351204039259d6844fab38524ef8e13b127aea0e524547ff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0546d4f5111db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000014b1c413982235d683b1bca918f43beebd30d35793ee8d485269bd7089c0aeee000000000e8000000002000020000000e2d485a35bf14113674669ae67de215429bd56336f8338ccf08d1d96fe9ca1b120000000a6438af07391a0b86fcd5f2d43c116e3d1cbfd1c542a19aae64bf5c1dfc015a9400000006bacf9b9514b52ca9bf167d2c28161a6da6b213fbee8476bbff527691f55b5b073d4ddb995cc26512b46ca473b6a5faecff72087be59e5f7ada5dcb6103a9b08 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2860 2316 iexplore.exe 30 PID 2316 wrote to memory of 2860 2316 iexplore.exe 30 PID 2316 wrote to memory of 2860 2316 iexplore.exe 30 PID 2316 wrote to memory of 2860 2316 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb5bf50a7d9b790e11bc515ab3c78713_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc003aa43f448669f06e2bcf1cb5e0db
SHA126f6e307157ca10d3c5d7ef316826e3ed0193d1b
SHA25673e95ff6814357fe59d7504b4214d15b549279e99abb2a4f7984135e0bc21737
SHA512a33e9d37d4ec3cb0013dc77390d4a7ebec1e53683f912ad462bc71f8ffcf85d41dff34222f459d9c3a888305b23649ea8b8d329352501e4a2df0b1284debaab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58123a0109cfa072e225c72033cfc0086
SHA153214261e1c3a3bdf4d6c08e3de0f9b7f43906b2
SHA256d72b90dee77c64d8c530b20a45c1ac5105370d29604535d52a06a19358d436f4
SHA512a1a3bb5d894cd012b32a52c246b9966f3b3681a34d8cc741f8ef66fdb6a285ab6c53087d6cef3e826596081df998049bb0317e5c94fe2686a944245f78a3675d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8b6041b93d729bb752d18e90d11a70c
SHA1a19acb837dc744a7c9e978d5f7c1ded316b792b8
SHA256f6e06186d2506195fb3ebc7a3080a18a573025fc274585b866ffdc786037759d
SHA5123fd9316e4f14777c6b4d9641bc5938a3bb49b78c26297485d17e9650c16b40f0bba2fcb191e99a94149d3678b4e6593acea00879b9ebaf3001766f6183fbaf02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59120b7f62c0025f51f09e2c9b037f0b4
SHA1e649fde6f7ace329ee3aaa72b4cd8b3d469c8dd7
SHA256c7a663090f7c5787aadc40e0868b7f10b1feec3a19d5943a593ad05ed3f4abff
SHA5124287713e1498c6fc023efee9b0deda6480187b60be31e966da80dbd3238617471a392937af7ce28c6bf4fb602867f5315ec3265a55f04bc32f194f8260ab19a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ee38661ba6c8d4f2d78307dcb5190f6
SHA18178d88b83c39374b442549f7fa091ed914ad546
SHA2565e58b6781de32816c0c9e4f13d3a18c2863e7d44b7481dcbc239fa13f6e0a235
SHA512a5813841d3fab0126deae15d9fa1d8af45f66afbaecd55515f08766746d2e0e57911190f4d7207ccfc927c4e8889c0c032b70444856757d5d100a007f4ffc943
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528f95026f47c4919677cc859848031ff
SHA191b5606748838f4fb618e7c05405f568bb5df21f
SHA256207405012903aa00016dbae1896cb75747c8daf63949f88fb38d30c494c79bdc
SHA512847f008a022174a08a621ff73fff74373346e4527914d93ef7287c9ef8b9be01180bb68e11732c469de6508459f2ad545f76f97e41dc3c1a5c428999cb40e7d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521bf81a80d21d5160444ee189d0f27f4
SHA10322238465f209e7fb2bc52a05361c5cf5c0d0f8
SHA25692484b86f0b27c0f767578ff0ea5ab4e953fb79aded89b193b84183cda367cc2
SHA51296eb7fa294e15ac52fcef9396b1446f5e88f664328a1c51ad61d68977b57f225163d5ea89b2d249f347987466cd4be8bd77332ff9874039539522937c5d1fc4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562b646f93e2aec7e2bb9a8345d48a391
SHA1bea84f74d7c29fd7e02b7d4b97bd3b176bf40e87
SHA25691700177ba14b07b4b5f3c65f35502d1d6697266f72297985b9fae2d6ca39610
SHA51267d672296bb7836a719232385774f8ec6b803700230755d577207aac73c51455702570b8e076c2a03123dd47d5ffacb38f81f41b44dd236931497a1e23bfa1f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543015914adaa944a796685ee1c3a81f0
SHA154360e0484f09b72271fb15c9b2f1d156790ca6b
SHA256e9a55e9c4b75de2be6b79490f9e3f227d421c902fca641f2cd0a5bc6b75a49a3
SHA512fe2c8dbefe01b3d6c0ef9cec6539aee114e00751e0ac7ddd5eb8b70cc4f6828cd60a43a2b3f2535f1bd09c60b0e039efe10e12292b81e654357e4ef44c317278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585e3d02eeda0969107b4ff432a0703b2
SHA1ccd26f168e3f68ae1edf1e3737ec959fce98f027
SHA25679d3c113985f8eb0922dec0bfdfde9888445822def0f8f811e9d2cfdd2b16d95
SHA512c14fcdc86f94b80077600012abb6e53ba6c602d5d7313b7506cec88e2a197186ee9038312751b3e022b281861df72d07bee793c40cc1564df2aa617fb6988b44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7d39e38af69f70855ba4bbdcb7b8caf
SHA1465d32c1cac61191b2025809e17d1256d4fc2ed9
SHA256f0e6ad1ecf7bec9c22d9bd81f60177fb520913c159f6b280b980c7042e596dd9
SHA512b9675c5c94b47825c05cb158b0f2c6551581a6450c2adee9a09b471e676eca9ea1428d4df4f07780e4694445d546e33e8715b3d838d624d637a6d9d5b4f67824
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552c7adbd8b1d3e0c52865d3f05db474e
SHA1e1bd7348092b422576468158499e900a6b648450
SHA2568eb0edec23d5eca8e349ab6b69343b7fb530ae05f6ad3572697954f7fc24fab0
SHA512d222413638d1e39ba51de8d6882f91e478aa95fd2b90af09d4a795b91d575f45954599c2b6547b1da189e0207ea6c267ed9ace6f24b6caa46d04975c2e4d496a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c09c49891ca66df33f3d9820de9a5b4f
SHA126b6c9704104d764f1a47cff70b4b53bb74fdd3a
SHA256d9a49862e222abfd21e1a723ba2f17f89a07f9853bdca0f5d1611429c60df286
SHA51222957893ca516902d2e0f8bf6f3734f257abdbd63ff8ab3b54a2bb0c05a7fd034256aef72f4ba9d7299bfc7c44741d680bb54dca2720b6ac7c319356112e3743
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bdebcb28c47d29e1636a69bd5a6237a8
SHA144004714b75cd6c69411b8cdd955dea8ddebb1c7
SHA25675171469e1a04af214e00591dd98827845a4e01648dedc592877950f0e401d2e
SHA512c3f28af9c335d2f191af297ede486bdc751f98b665caf8f68512a65b1e0a968e8cb7ebce38c299e2355f600c2b6931f0486adb23d92e8046d172bae40d53e4c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a86558bb082a754958ad07bff9941c3c
SHA16ce1ce625edaf47851dd9c0c21b75efd7dc2dc31
SHA2567ee528f6432e5cab9e39fa30bce8746659267e48747b2999becfb92206e9ee08
SHA5121c4bf71244ab2ad5e751eeeb80c1cfa7a6c7cc9c00b62330c24a11bcf282bedb1cdd049fe0b8f560bcaa1529e28592ab6c9678e67ebdcb0aa0c3a4645dad94b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b760e31a6ab4ce3d52a0736f3036b589
SHA145d374b32152096cb60bb681e6acfde4a05bba2a
SHA256bf28f61c028111b89a12ac519771dfbdc98552160dfad0e755e84707150b8837
SHA512806ba762c266b649de40ccc1446b5d50bb2f62d56bebe895bbcce40315c45a51173aa446793ba216d822228f2dd837f16894e4317d778f646a9fd66d26c032d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d5c24fdcd7bc0760b349c5ceb4a2c16
SHA15615b7276aac01ec0ef887bf584418b145994064
SHA2568c9dada248f5ba303644e03380ede5ed94f71f7c2e7e3e435c7545a3964a1fc2
SHA51238bf3ed3168b1578ed9456350e517f89ddaba31a90b7b4c6b3757e4af59846145fb5c2ce0797e3718a96ac9106d1999dda160b3b0a8c5b412d62dd5812211924
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5357dd6e3df23a3e2014f821f96bdba9b
SHA1fc45a66d5fdefe72c5413a0b7b067ad824a6b68c
SHA256c8d95f2996f8e54284ed54d1fd398a4e35126a0842e66bc1aaf96208e6baca62
SHA512a8fdd8851d187faecff2ac57cff1753c7f407dd89cf99940aa199c104ed25e9def7e7046360d3234a0c322b7e03c0c59bd79c48c42587f4a4d68d8da636a581f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c532c407c22dedc66b74226f04c95ec
SHA1b35cac1640cfe3821de139f8f683a8ed7b860ce5
SHA2565ca7ca5748fce3851d9533714b2b0feeae610299a5be2692541154b7b2425eeb
SHA512603014419a37a921f1b0cdfafd1085031e8ed8e91c25aef16d02a2c75da9a81d7e6871ad3a0b56be20cc28002061babf8c7999ec59cbe6ed204e7626047b68da
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b