Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28-09-2024 04:06
Static task
static1
Behavioral task
behavioral1
Sample
fb7816ca200324d91a015ddf85483964_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fb7816ca200324d91a015ddf85483964_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fb7816ca200324d91a015ddf85483964_JaffaCakes118.html
-
Size
460KB
-
MD5
fb7816ca200324d91a015ddf85483964
-
SHA1
b245c1b0598bdd06ea6bf542ca75b4b502cadca0
-
SHA256
79c38d71074900a18d1c66a03b9207450846cf1a518da7a48861edc828b8adab
-
SHA512
dc34543d2dc37bd7a7be5461aa91b4f4323ea873f1973e72eb843af3b8bb2e74a0483abfd8eb600046cace9e9791d51d500bdaf77fbe640efed7d77da678b7ad
-
SSDEEP
6144:SOsMYod+X3oI+YwzQRsMYod+X3oI+YAsMYod+X3oI+YLsMYod+X3oI+YQ:h5d+X3qw5d+X3U5d+X315d+X3+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000bfc0c7fef195ef8e454d9d6453767171e6cdb1371d82065ecc48b8352969c36f000000000e8000000002000020000000471e1493637cacd6b3b404fedd87735caa05f6989c428bd5080d79e17496f9fa20000000124f45c6e4679df258bbfac17a501a5b5745cddf1fba15f24f9fce0224fde4fc40000000a9336d7ace49228c7e8e0601ff17b4151c62f2d1734a2321d2e021f87b6ee85dd8c43fc36cd8435ed30f6fc25e55479622460e755dbf9b3e5834580f5716e3d9 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102af7e85b11db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{106A9EB1-7D4F-11EF-85F9-DEBA79BDEBEA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000004ea4045aefc674fded4d54bfb080592d452dbb62ddc0efd1be6866fc44288bcb000000000e8000000002000020000000a138846ecac309aff4c6610d1e95517049b213dff433144ccd29c885d748b225900000006e7b7323d51e6d2a6d7506dc6d6b4e79ae76ad52d8321bd60ce242148d4230c197e0b553e792596ccd101008ca88e372ab27de4e498bb32c493666ac031f8578046dda70d85f3792749dbe0931466655a4fb8e32d72b3365886b8eea519ca0f491f48b0c4554d876e43b79ea77472f944fca45e99713fa693b27fe51cb1db798fec4549211f16626dd5762f736f111c340000000ce9b9a66a361ece4e577fd67248db422530a1ab5ab4711d9ba5861fdf67c610e796203ab7cf0213285adbda2ecfa309656e4c79219b300ab49b786347426c82e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433658268" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2188 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2188 iexplore.exe 2188 iexplore.exe 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2732 2188 iexplore.exe 30 PID 2188 wrote to memory of 2732 2188 iexplore.exe 30 PID 2188 wrote to memory of 2732 2188 iexplore.exe 30 PID 2188 wrote to memory of 2732 2188 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb7816ca200324d91a015ddf85483964_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3b55a5f589351bd4db23fcd9b8587f2
SHA1c6640c239dfb9f277be76e84f5c80ca06d57732d
SHA25630a9ea27713f5e81f17ad3e7cd56f3bad8554e39c7d8538f5e6528ef27ed529e
SHA512b0f7b58b3d848b933067c96913432a3b240db499bc70c9123a2f755c40aaba4f677b51d5eb76b26cd9a93d6788c6c9cea8a21cb6faaff639379e7434b9f94ca3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547ec18e95f5fde29f0a1a0cc69359d69
SHA11264118b829e82917e6b41a4c99721daef993126
SHA256ec7296e1871f1bebaaee8b1b5bf4c067b53d13f725b7b68b5498b2cd0e611bce
SHA5126a1602401e37f7c94e4592abd7319fdac40f26aa6ff63140525f182982a307a5111c550d2a29c2c86941802afccd56bf512d023512557d58ce55fe8652c4cd09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a399a975896debc35d8f3b1d08af6e79
SHA1e83c8343c0a7b1aa014e5003b6291a0bfd94e676
SHA256932a52fd4750bd4cc24b13e643751f3ef15e2a3faed83a4a914758dd22ade9f1
SHA512bc5d19dfd921a9f3bb30326af35fd47a9f1c1c71bc48d63a629c1ba5fda38078b39dc47669f6b32f5d9e0a4a0f2bb714a9d22c3a591bfe83ee259c9d174e4ae8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5817c1641ec97968d6098cec5940c9c81
SHA198efd9ec3a8fadfad4a41804a4cbcb29a6269f8d
SHA256ef8f4a659bdd70b71fba84a7c8ed7105f496cf8e72de43644135008434445fae
SHA5121e77901f5be2e8d57df55ab167a7137210b3bcf858f324123decd6dfc1708ba7c5af6db825a517b641df15af76a429f352e831759e277f8adab9fa77db83bac9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c45fce5d5eb3586fac2653d7e9af3817
SHA19668195df823cd849c671fbb2783246e62d3700d
SHA256b546fbb0260b68efa3dc1ed8cc5664994978550d4c4bf53ec7da49ed9ece8980
SHA5125e3f7a1be1cbbc38f2be2ed2050854eadfb98405057be8d56c117764ebff4c6eabe8b25e66ce50b92b5a5687d7ba4391e741b131de4f33523760785652ae2353
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7a08db4e272a5205ec4c21548c8aeab
SHA1da7b6fffa6ffec2e9ab450444efbb02fcf36efda
SHA256c357d79d97cefdc8763c6488f37d69d9bcaba009f5563da1255465ad727b8eed
SHA5125b8a245adfd2cc17248de00fd7c3eb1e42859453a705e0a6f2a132daa7e998adc4e6d574076a866498424ea59e83cdca1b11d497d7cbd49e8222ed1fdde6b989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a21732b8d8eeb7cbc3d741a072c196f8
SHA1faf0462ff8cb701b6a98db9ae8d59687032933ea
SHA256a6834957b4a13be8aee55fcb2573a0bc26ffaba1cbd038fc8db05ba7f242c9e3
SHA512a979198c96c408848183608a7a946527b5cb1ee607335b3a6e0a325ecfe4513df0294255cb62953d567a1bdafa47d60576d53f35a17664df49306a0fc8983a2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7d1cfe27a74a07af5edd59683cb97c0
SHA1c521b54e5d1eafee47b93c7e28b0173465a7c7c3
SHA256e5ee4c2c243f99ebc543a81621587444f0409fa64e8929603419f3e28a351550
SHA512699b6c45f3027dc663fbbc2a8afa47c40f5a795777b8a7097c8f383483e2670589a6992dee55dde725033cbcab92d629d14939181ab3fe4d14a74306d79acf35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b0dcb5d9850a69b723eb46c404f496e
SHA1920a9de50b6297138d1f7b6576f792077e5ad6b2
SHA256a3dc1490450aecaba2ca47b8a75b4cfcb09c1a24413a05b5f19835402bcd3b22
SHA51208422e7611ba0eb84dfdb2d3c6b5ebb726f90de0536387c9c8d0b1691ffe7650ef95c238682af2a970a0f89e00709428a0a353b9107659becd2687a8d2a87544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6ca5470f6d294e71e82fa983260b283
SHA1ca317477251bcc0d57485ef88cec58e996e6b011
SHA25603358f98c0bf2d9aadacb20d1f78effed020c7f13b70e54302711b4652448799
SHA512882f9d24f081427ace2766e5b7b2d8aca39b3fabb486fe27766093eb2fa7eb3dc48d71014740c27ceaaa7298381af4c7dab375b61ab73479393b75323e52c8be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4bdf0de20f861d069dde1a3cab1ed46
SHA1bacad84d8b94cca09ab2f9e6d6aa6eebc2881ae5
SHA256b8e94a1f4dbd94ab488a8e1c5610dc5b8373c62ffdf6e4dadbd0563e0a1a0598
SHA512e923be8ea0bad43252d38325c66863e8c307889b3e7168019b4823f567d98783ae9e2842342d0526039d44944ec148f98dc6056cd0bb5743ebf361e18da51d05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583320f1f9eb9ad4c0160aeba5dae531c
SHA1672d471355338bd331a0dc66f6645ec928dafa0d
SHA2564207ab4b1cd31cccfe646621b444af660379f77a9a62b6ea3288eb3293a0fd80
SHA512078a2041ae219b3d7406097e2ffa00be735c845eacbffda8005a991d86f7e4ca357d5ef78dda8ba9438fc94854f3f5c2d5334e673fa8f5c8f840a760f39907d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56de54485ac2475c70082897bf9f779b4
SHA19f793be14b171d19d3daee9b0642502a04b4d236
SHA25669bc6e936299abd74b10bed4aef8863d2722113a6656f5c7a0e1c03e8a1aa5b3
SHA512e577792f73ed2907c6a6a0ab335c25324e9b97083a8ea4cc022469b56ac5aaa89b81d7a2f71c332e03bb5cc46d05d4bc48bf1e60e66a1c7a6002496dfa0f0598
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e42723c0658364b489c9698112f0c61e
SHA1e25546c6c5711adedb59a07437e3ef8771e7b996
SHA25665081f527b79ab6c92f89e7f1a3279dd08014d4010b3340608de957a1cc7d23e
SHA512ab22ffea7dd33bc806ddb78c2bd81ba38116eaeb1fcf0f80d44ef33f6c38d8ba1af8d6d7baea7c84feb617431ec0615fef96e579bf43c01305467c460eb5d99b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db645e3bb13bf54dda2684c4af3034eb
SHA1bd718d496c38a20e0a1846b546096db52f3f3fd5
SHA256ed680a1a143560b3c3370952e3370e667c918cdedb8422d80150bb07ebc54a93
SHA512039d13c9c495b7a640609ef44274c92f07938ddc8b8fa923bd55a8a9776d64553d389841c87c51c8ca9c3e5904fb01078dd34923d484b7f7d59fe3d3cb69942f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e17b3a05b982ddd50ce7c1a63d65068
SHA179478f74c95c8c8f5ed178a8a2a1987dac883e86
SHA256e78e9d85c6f8c6e1a6e48232c67cc38b39a982440166a5fea61ba2137119860c
SHA512afcf38c03511ffe8647c24e673ca09817fabc2019a0b3c455a4d21fd6fcbfc07dc6fe77393f524fd440392d14bb1b446fa89b62342130e601e30439522e21b08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a3976204af38b2d82cf2d3b3b6deb26
SHA119e019a77515eb512a84ac6d31bf225f9d142ef4
SHA256bd8a8674f3be792e24b941d56bb831b133b74e586146aaa3873982ecf62ad755
SHA51213c83aeee7504dbe601b3b516d31b458f172ed86c7568456f76825102bd9821f6ea3430252196dd54365bda038315e8ed6fcd6e177bd405dd2b83b0a77d646ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ed03ed1b10d0e535a4f566b94c7ad4b
SHA1741cd5f34bd5bb3297a10394cf833f27bd769ec4
SHA2568b13ce00fc26b0b7928fd9fee21a03c7f4039dfa3c5237eb54cb642228c39bef
SHA512d3d46d2391ceb3ad83c26c35f0ef65172f82afe8b909c5ab2c37b620d3144da14ef42c15f42e90d1ab1efb70a05ca72d2140e886eb4676bc154c24352248dbab
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b