Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
fd9703a1e1d913ae9d240407c67225c9_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd9703a1e1d913ae9d240407c67225c9_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fd9703a1e1d913ae9d240407c67225c9_JaffaCakes118.html
-
Size
2KB
-
MD5
fd9703a1e1d913ae9d240407c67225c9
-
SHA1
334d0b664a3122f0cfc430eaa1e72a382952583f
-
SHA256
33a3d76c820cfd5f0ccf01fad8e9672269bd516591bc6bd9b118612972341845
-
SHA512
4170d8364257c3ad428a496ad51a929778c4d54b982973e09be0a31f26b1bbdb0eaa578ad1ec08505304934f33b87275020f49103b7be419ef249ec046395d71
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000008f997a937422210f693e7fbe41076c77b19f2a9c90750c4163b36675d18e8c46000000000e8000000002000020000000992f3d306adcb37ca254f00b0af9b0c593a31e3a10a6de6f98da88ce538e9416900000005f873efa911ab26bdfa49625e32dea2658beba737c6a6236fedf8cdeeac77f9462fa7c4b7993a3ebf5d4c77aa70ed810dab9f82563eb9a561335ede423d2815de657fcec8eb6463905993e37d20a04825aaf8a7fd4090625621a4379cce83fc66982468ba17775749c2429766bee68066daba6202a62edab8b73c96fdc2f20097b39cd77e8fa4f982a3b98d0e7fc62674000000067dbbc2d08e61e00cc864cf731be67a53c14b949b865f56c8d24fb0827b4dd53a35e36a44c917f72d33ad1b86f36c92820e9b17cb8b9bf1b90a4032f70870fd1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000007b64a9bf7e45dcc2326ee58a2e69b379d9884ecf55e1a08481f5fb48684c749e000000000e80000000020000200000000d1315898f110126cce13ac5905730703e06ebfc52d6a6e2e909ddc05db8afde200000004529acb02e1d41941e08d9c855de13c879d6befbdd741b35dc89a178172ea25540000000e9ddd553f75c7acc9761bd9a1327628816fe4dd5628f7e1f5a719937588cf383850299c06dae61e383ab0269590894fd26cc334ddaa73753a2d27c168551aa0f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309520621412db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{892D7031-7E07-11EF-B439-523A95B0E536} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433737498" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1076 iexplore.exe 1076 iexplore.exe 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE 2576 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1076 wrote to memory of 2576 1076 iexplore.exe 30 PID 1076 wrote to memory of 2576 1076 iexplore.exe 30 PID 1076 wrote to memory of 2576 1076 iexplore.exe 30 PID 1076 wrote to memory of 2576 1076 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fd9703a1e1d913ae9d240407c67225c9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525c05f7678c84630f0be378a33041f0f
SHA1a47662b3c5aad48c9ffd2128b9e5610baeb9fc25
SHA25676b71b496169634b7901c69164432f5325de8daf595dd53ca93e85dc74925210
SHA5120436a063feda724afcdd595c2d3efe5f48d32d8852956043c909b17eeb1bf89cf903f8c229007f22508b645466346526c400995ee5e748b6bfc1d6653e2983c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd802d1cfe2149e76186db7e1c3d625a
SHA16bf6cc9c50cbb37e4c2a735aa82ca0f8601247c5
SHA256a0d46a1d46e3651a8696b8f5f27a08b8a44b14db8101e91e5cb366740bc3680e
SHA5126d73ae690f0fed33d89d075061b9f84a4427fc641c7e0d4609eb17030833f589ede96cd509281a0f44e624722f1a1fcc841bc889b3caea192ae135f7db7a0207
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52288df7feefc10eeed9dee92d1b58c84
SHA1d785243751ae78ab226ebe8bfe8429d815f38a32
SHA2561c67a770e3d7d661ba42e58ee7352be748bfafc10827cd4820f2826426246145
SHA512697d0f8904cf742bcf35afc0aa42ad16356fe3cca1f592cf3b03844f7db4f99364afc11b6c6b805e980c2d32ac4cc120e9ec236357f45bcffcc347443b958b44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a8457cb1c25d3e1cb82bc477de3db4a
SHA15617aa2ff15345c10064d33f07bfb1c200d770c4
SHA2567bd48d7276398d1ac99ca52c08e6616fbf93b9c43c17f550c8cabb45b7e0f284
SHA5121b43d3135fca4da73778d40fa3ea5e84176025265acfe39a3fa5eb1ec2407ee33d44a91283ad5c2f4d9886951143e7e154d9333ddeda8dd697546f682c55fdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546d020f23398fc749c0bc22ed96e9315
SHA1144547a246cd37f684258f226259229375a1b70c
SHA256eefbfc60f654505322d17730f692775a6588c83d3ced1b72d484ad2042c434f5
SHA51276c2d1648ea062bb0c12ee415827b4aee0043e07faa0c766bc2865b091b75dbd7c53cd33763556319b8699c588433cd0f174de3de7ad3b731561fc1ed13a6c2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea736322ff727637c7f207a3b35693cc
SHA149f40a844453f8f04aca51761b4ff0f97fd24d39
SHA25672408d75453830195092d1507f74a2ee1c05b3f771292c9c24a5f350c846bc10
SHA5123342602be9f8bea5fd42aa18d635ce34a3ec1f53ecbda8fb4511e97bf5b8c42fe7f08ea511ac1060361af38c36ddc72ccbb41c15f38792cc17760bea5aca340c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2fac705f5ad8ed01d77de106822b318
SHA14ed84529ca1349d3be4184f916642c57811fc05c
SHA25631fab602c98324444de3e76d6497e31b102f20698d14967d10c39313bd4304ee
SHA51246a421a584399ba6cd69ddf63745adb0ff6bd13d94ace8f834916050353c3e942b9b52d29b96b08891696242a8ed0f63848e330a72b580a147fa014047e22b6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513c3d09478ef550049091634532edc67
SHA1bcbc0be39a17f4b51418e01d509768bf43546f57
SHA25614befdb73594a30c1f2bb6ad6d6381bdae01eb09be13d62ce98cbddb117a7e2a
SHA5120fe2bef584cba210cad60e4a7c19d8e7276ae79d23661a2d19c5d9d0f59cb8b9f741a7d3b093d901e26a6ece4bde4aa9ee4205e189d735684de5a2625f2a33ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e014846b117c3df4cb9376866d07fbf9
SHA18de40c9dfb0996f50f904054fab639be61fe9a2b
SHA2564e14cdfd329287febeab2fd9bdfe2f5c90ac75791b966dde65ca153aa503f69c
SHA5124218de5a83eec566596efc486a766dc243806f6dfb701e8428fe54fea039a9e053cd0d159ecacb43dc60ea2ac6ef0cb43938c36dd364f8f4f725c458ce392450
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527db4cc86e3b3e3d1857cd044670d2a9
SHA19ddb7acd60e92237b4e63146a2a237f61af51d55
SHA2565a07d03375eeb4640ca2b45570fc0c55704da502999a3663f407024f7e90346e
SHA5123d9af6c9a450be50873573484bc308ee68644102e1c6987cb1dbda9ef259d5573f610516f6f7676504292a9d6b9540682bedf8a54ed958c3e12b46fb51d21e12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d5cf2315f58b56c7803bcc584d33683
SHA10746a71108406577c5830792d90c38c753c2def0
SHA256d193b206de2b1c4cee93c0fa772e708bbebd497edc2d472005c7e123788f5249
SHA512423ea932ec65348d3f6889c65266b2530243fc626e07b6f30961d59cfc96a0914779ffca56dd3e03f48fc63e97937176f2c3c505815195c739c16ddfd2354860
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5255064e2d3f0eb8c9d0753bcee0dcd45
SHA17f5f55971c5f436ff9957fce816c90e952b7bc0b
SHA256d5948d703b8e549a49dfb9c20b55dbbc52709e3ac5749514c9ab1fad7566eea2
SHA5123c38d2bf832bb433ae746f6292b5173b19041259a390b8c68bc72b454337f0e025be27537fa78aea7610f542e3b529c6f7e26e6f0c1865515df7c1f1baa8e326
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b63dfab09694538d9447459f02ede13
SHA1190d9d52335ebadaf5d2a4901f7ebeabe6b0d333
SHA25695ea60a9031ffc259408fe3acc2c97b742ed29855a96d7fecc50ac488ee4dbb2
SHA512a0994aff14d9679aae3c4ba1aa4e81ebed4a6f36ff2c197a2c656f4c218c32d28aa007658e4691428737a92f2e931dcbad208c896e2c58638cd98c68277045c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2d8b1e7551a2c1706fbc22068ba44b8
SHA180c8e06cfeffd7ce82762a30d47d272e4fc1bd3a
SHA2568e85f8b997a9807da7d4e7cf6e164fdb01df0f1bb825aaa3abab7b98c7b2e9c5
SHA512f6fa01d27e43728a25f67512e86cb8c811f8244437072474ddc5323a5496d53eda1527b7dc783fad27b82ade7178b9c2e647214457df8f8250b27b33e03aa14e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57856332102e29dfca2ffa792b78205bb
SHA16f3cd09c7639b77f2bf51561c700bc7bc0c16830
SHA2566ef14109968e87b6381f9a0334c710fb09ce8999e718cd8b9fce81cdf44c0202
SHA51229fd0f61ca8b258a2172f1fe061db5557c2523ed2edfb9d2eb2a51aab7f197a631fffc1bf7a4f376a2610f54dbdf8b04e6f54750bf71cb51b30ecb4345bb1af1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530cb052dc94373ddf1f8f4e5324129a6
SHA1ad3e08e2506f31bff753b1a9f3ae28008e88167b
SHA256bceba1572d50f4a13c0c86f9f59a3f01bd36c2a55b312689180c7b3896e573af
SHA512f1763170254d46c75efd3e0cb66a0e469de91aa148dae94f83b33b0c42066de24907c76458d75c2155bd63c9f489b74f53fa0bfcd8a56f12819c54d6c3a3682e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54973b862e96a69ef90012e6bc682ea13
SHA1223f303cbfeb3458604be963914eb2e61d0153d6
SHA25661db37b9f127a5154a7df224b347e595e45d84cbc98f2da2f172533ce49a30a4
SHA512c5e38f112481c416908055dae89c2d680a30febc98a9fd136e11e08a757573ff3b8b8d5fb9e2f4a71c24e75a0d8c104418f4a855b4bf9a4eface57f92eb499aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1b052df044d61d77e6ab005ea93014d
SHA165e9addecd8183d72a71491911448839866f115c
SHA2563c3adec1f30a21b8e0de02580d31542d4aaf780c28f8b017eeeec73106fe551f
SHA512e149522c8ee87c6e8322beb45665533d0affdeac2b069ef1311b4d960986182c231ca0175e7e532a138453e3baec660621883ad1ab5901c65e782a31497db561
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b