Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 08:49
Static task
static1
Behavioral task
behavioral1
Sample
fbee0941dc6631498e41f2b4fddfeece_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbee0941dc6631498e41f2b4fddfeece_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fbee0941dc6631498e41f2b4fddfeece_JaffaCakes118.html
-
Size
4KB
-
MD5
fbee0941dc6631498e41f2b4fddfeece
-
SHA1
9dc1ebdb28e6d53e9c1cf741558991662efc916c
-
SHA256
3215ee8ed9ebc9bbf92fdbc0784729020f719fdb6c0e9d4444a697f4e66c2ac9
-
SHA512
7cc2f9dacf6c45aea9a13b1fc0ed03f3fce5fc5bcc64ad76cd97d3335902a7a2879ae405eaddb2d0fdd6b57795f197eaa8d3df96c0e25638a99a0399566f6e55
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oqjNovxd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDS
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85A58971-7D76-11EF-AA9E-527E38F5B48B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433675214" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000045d5d37f3dcfe1afdd75e96db0ff80502ee459b3c1e060453c98fb31f8bad7b0000000000e800000000200002000000021eab800f4abbbbd42249d39cbf5c84f8351c209f6d59ae96207192a3c1e5cf190000000b97d37f65073de80126eb3739147616a37f494330d506e822362bf96fccabff7807d0b14a199c566becc266814323e44b654bbe754462952cd3d75ba498bcfd65711211a5c9e08a7a7c43df077187e862665988e1bac1c3d39f24e7170d71767d7f3b5a0d3456fe939f952927058d715076124fca78a2c66685d41ad702123a0197f9624df0f6a57c4acff6f9fbaed6a400000009c40c8607a553447ec92f6002b60dfd82a2007ab6d976642bd81b5edf2570eb1333f669614b351acd005aba5d4c8d6d419909fbf68aeb0238904693b2cea9e29 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000005323ee1553dfacad2de9b60a15bbd8cb5cace7c90b2ea3e4d528e71ee5cc4004000000000e8000000002000020000000199ec1a35c5f656fd5bdde4c703e752b111944b200c39146a8d7fbed094ddf53200000000059ce41b2a335a68cadcf1eea9542c6bb547b4d10ab98a6ff5534762bacb06e4000000065ca29c45e1fc5bc156440626b8fbcbcdffe5293c6b873942c9ee261c6988fdeb09bb33543b977294c35147fe3eb191d5919522b2d5f95fa67a1cd0cf7015b7d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c054245a8311db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2180 iexplore.exe 2180 iexplore.exe 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2740 2180 iexplore.exe 30 PID 2180 wrote to memory of 2740 2180 iexplore.exe 30 PID 2180 wrote to memory of 2740 2180 iexplore.exe 30 PID 2180 wrote to memory of 2740 2180 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fbee0941dc6631498e41f2b4fddfeece_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c32ffdb8f7ba87035c4fe03c08e87b0
SHA1ae38b6cdd09761904820bb8f679eb92f8cd7177f
SHA256de01dc857be25ea1ee561749166fdfdb75f0de587f21a3956fd9bb7883fde40e
SHA512a667d425ec739bff1e1cccf112fcd2813dc8b072d341bf7d7ec1781fdb4b727700987f14c07ce11118965e17fe8d963ce21bda22ef489112eb21880b08ad1df0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52989efd735583538f5a6e535bf3829ce
SHA1533d450713e14ed170f3327717a1ebb3541ab478
SHA256ab3a15120fe6445349a974a20f354b90700cbf2b758299744f2dca6a0f48f778
SHA512f629b90cecf47cbfda85e6023e92a3990ae5b41f284ae932784db49992b98911fb1c98bb839cd46a07afe72d50de9a719a1c8ce8e313fa3d318df60e091b24a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552b77fab38380a1e84db3cc7ea40b535
SHA1faa9f422c218709853aa5f9d4f758fb820fb11a9
SHA256ba04acdde0346f2fa1ac201e86cffb61370a327516489fd0677335e844ddd67a
SHA5129c5a6983c34244b0d2c104a8ec15ba253c9e1fdd1d87409ad63c700ebb3eff9627d9e66f0c6dfcaaea506c10de3861e29dc18b86b7295a3017243623f9e777c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db3211d5121d3417cc2de7e096b71698
SHA1f2b744e4bcf9104c2cce63702b41ce62172f039b
SHA256d062da4bc91f93ddcb1e93b4a1c244084bcaa524b74ad23ac4aa0a90191b73a8
SHA512461c5fb01f37f6f41e46650b3489507b33b8062d37646bf68617bd65afa599b7015ea9954cd30d9ce4c9f5bd7d20855502b8c1afa9461d610c1d11005400d224
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a16d62e97cca64ca230d9ce74abc60d
SHA12da1d602bcaac623ab1eb1d4ec2a828867ed92d6
SHA256abe57a7f90960facff315f6c3673ace06844c3779d1b816bcef8a03df28a73cd
SHA512652c1433a353d5d599597460674de01e57de1b3c5cec51083a7508156257b6043f3053dd6b60f3fca160c7aa4f9b5ac68d5acae2d0c993686b4f5329c41e2873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5660960ebf748f42551f0d5888c1ca763
SHA1cf5a44b9a758c0a2ce30bdb3108d565e5c93465a
SHA256b7383c12def32c6fbad06f168d787de1aaf93381cfb9ab843da374cbb6488b00
SHA512b66d64b83f8eb3829daeec9698523d487425209b55824d0631c25af72820e000a83278d9acc4689d4c241e3c0230eec55ddc6294bf37963fcd9f75c391e8e94f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57748929a6a7f6232d254926a3fe86659
SHA1b251f034ad8f2fddbd530bab48ba375b877391df
SHA2561325c058ca195c046b52d8a0af7dc1c17024641fd3165924b70eb2cb130ca555
SHA512c199fcf29891b46400cdb150c95060f8d5deae447a8f7cf350775a1a00811bc9fdf587d824d927903e3c216c253f8d7d593a00a0557745aa3372aadf5a1f75d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ac27df1d6bd44095a1d541a90e1d8c5
SHA1ccda9c69f6af3e0133eaccb6af0052c524f11254
SHA256fc5c9115a8fdb3c0f0b0bd28f8b212ccf5a2affb443b496fedfe048137a02c10
SHA5124a9a08ddfbf4af40adb8e1b04d7cd8502993ff7f2548326a6432f8defbe62672e48e58cee4eda3626d43e7696c918919fd069f5a49a812800ed05bdad59e29a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b2d7036221c7f249277dfde229bc380
SHA128a66474ad76c20fb0cd24e70e167cb82609548b
SHA2563b99a2fb61da49f3e107b68ddb4285c1f41823d4d869ed11bc6294357aaabb7b
SHA5128bea60bf4a5b4565dd36f8c45ed6ae845abd1af399b0098f1b14526556fda077cd792c2f4bfe4d9b311d75bff69b38d59f28cc8d1824a23a79a24fe17f442264
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58904fe916fb4f338f9a408594315cf01
SHA18863dd11a70a340a3f9330060c234099af0f4a9d
SHA2567644ea28c4bbac85328a8dd77213001e7acf2e266e9b999e345a4c46e17c768a
SHA5123b2605aac5452c69912933618e20341e632234c0858cfc86525d5d675b0c39b03db801f970ce8b89423c674bf63b5e5e83e7e2a38fd05f57b801aef43d4cbe71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3adf34f5d55651e8989805bd7c78acc
SHA100323388909a37ee62b311cbc6758a5604ca9add
SHA2563390e2a8f4a86409ce36f7a65d537ea8817d0f27e20582609bdcf70bc0103b23
SHA512ffc52dd2ed521f38a53f6c195a9c7e9a6c7530708ec3b0e58a1e7f4eab003a60bcb53a64dc8f531621cf4ca429e20533775d1b7edf532782efd243240441c06e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e685d03b8f7674f383b6d47689be3b66
SHA1e358d79ed8ea30341b51a9d9649be5a132bc2020
SHA2560ad95a31c61c860c7317cb7abe766fea48ded08f092fabeb15bbbe574863ef5f
SHA512ece49a4519d8801881998281881faa64df93fbedde8705ab7cf35b117bc618eaa0a5e10f174b74afa09497f4c989b8fa87cae53d858c59e2d151ff34332cf670
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f36eb5ccd878a5d606071e4957375a59
SHA133f0779029b3ceb7e07c9ae8d0775c0c362907a2
SHA2569a062896f0d1f31c71c2835d498942384e1ff0ebe2d46a42f679ae5bb8472c08
SHA5127ec001e061c6fba6016572f81e775ef41198f7c2b792ba83fae43ff573023ced03d5e134c92d09e69200121cf87f62f783c7c8e707b963c56be247d309f5bc50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9b4e7b4bcd320a719f0df00bd9cdb64
SHA1a0b80c7709994be49b21a6fd431b673bb0e65b0e
SHA25632d21f4896fe253a7f39e69152d18f7a90a0be9bdc1e2dcdb38feafeca49fb31
SHA512ed0d55ff829cd8e1716ad6c2b9a07935c09eecafba8bbf1557a0d0725a331e47942547ae2c3176cc078ef2d1d3c040b61fd8e7a9f10868de06b0b78a93d1dd3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0c01b75f33df8f2cfa24473a9393de8
SHA118721db6511a564ec3858d1acab89ca72e205533
SHA25653855cdc49cee450e13ee1c33d3e02341e195ad451fdcffc5897f96b147fb46a
SHA51224a0e29f9da3f355a4c6011f7baabfcac5d7e9e55d705ccb17c7a1cae2b68f13e98083f92e1d2b7a478c4e8c2ea442074f29ad49e9884efd7ff08f6b91631980
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528d0c63e1ced3caf8bd476912dbfbde1
SHA1d6e16cf67d0b6a88a09667de2e1ccc7549b4e434
SHA256c7110e86ed071bef600b72eb2b5f5e21318197bbe6a8d9d3f4b4f2571afb5a7c
SHA512ae4e26aab2d406578e8ff3b8317b9165dc0db79789416d47e3f3a6a45e5053dc72d850dfc684aa5d36bf8e56e23ac0b97098dedb5ec6aa10b07e9a6ac12b58ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d2f10c8c9e2feaca0cf26c8c3c6cf17
SHA198c2a5f83fc649c03cdf246959b58de8c74f08f9
SHA25669f1058c3f915b56525eb8673e489697ad6af39e1c8a760678e61a867cd87fbb
SHA512fdb9dd18ab1d2f384ef4eeeb185d55a7f4602832c39d1a845e85736c95ed50ab5ca24db37d13c313fd1ee7243657e2744c9256cbc480b1230c1696c11c745921
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5068342bef67052dfbcbf1241b6b6fd63
SHA1fcf129ccfdd4a8c65b068bfd43f898ca1ade2c28
SHA25643461bbca8c5a540911518e2319e29e677a8264c9e013f570e283b3e6acc2537
SHA512243365547cb5a6b57a4d5bb88bf98c4eebdc123f2ca7f836eae4fdebc2cf7a7fa02cf8d9cadc654138d6fdabfdd3b4af040c76e822b0bc1b02b6471a0890ecb5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b