Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 03:29
Static task
static1
Behavioral task
behavioral1
Sample
fdb6435af0c35ac48a5fc90f1739d068_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fdb6435af0c35ac48a5fc90f1739d068_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fdb6435af0c35ac48a5fc90f1739d068_JaffaCakes118.html
-
Size
872B
-
MD5
fdb6435af0c35ac48a5fc90f1739d068
-
SHA1
e980ecbbdd4fc3ca000346797fb77c762b0f2c59
-
SHA256
e62dd65e37621bdbf9f104c84914f6587ad13c8f5f35a265b5bbb7643ec4c1c7
-
SHA512
c8c677531cec8ba74f7043631f529500a2bbef629446ae3b7fc1ec73f8984b61d0715714d8bcb8ac77f7a6a29c78e9d8ffceffc8c48af5613798245eba22dd55
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000628ad6dcd9d184688f825a07483416b16b41107cc918a89ec766065a82ebeab9000000000e80000000020000200000009abd8f0e7fdfa3722137c51337cab24f557d3348ec6454d27f707de8a2e61b912000000069bdc154a0bfd806c204c9c7e4885ee8ef62618dfcbf09d423176a634972a85d40000000406622d117a09fe492a507430a9e516d97aa51a45f1bf5b5d4d47f0b6a37e8379092f605c43448d7c0cbd3ad20361ec1d6960069f269e00654bd9d01ddc2b4c0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000000f8ee4740cf3a90a6afb8e36c286c42d06053196ce0508a4b82a566f3eb0e653000000000e8000000002000020000000b0695dc0e10060cffb9272a71c135198bda0e0e7d4ebe484970e1885f99cf5ba90000000ec180bfe8db1c6d08f8b5d1b86baab98a6953efd0835145c88876f7844711fdea7cb15cb725a81e89fa501024d6ad90007cbc96ed81ad5101b600d5829cb447691a899458a8bafbaed0c01eb7740cef21e96579692578d6291f4e6272c066b4c077bc2ac2a1ec158377a677c77f67356f2a887e5f042461931532e5a86a14007025f8bb02f163d88b955837947168637400000005f8d5236beb42939e7c4a2495a32e61aa004c633ce70567526330009ed0d0673f379c14f3625324712af721f7438c2caa54f2d16eea4770baf98b1ef58991035 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d1cdcf1f12db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433742413" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB54C311-7E12-11EF-808B-E61828AB23DD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2276 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2276 iexplore.exe 2276 iexplore.exe 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2028 2276 iexplore.exe 28 PID 2276 wrote to memory of 2028 2276 iexplore.exe 28 PID 2276 wrote to memory of 2028 2276 iexplore.exe 28 PID 2276 wrote to memory of 2028 2276 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fdb6435af0c35ac48a5fc90f1739d068_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51ac82f3d6e25ce624614c7c229f57c2e
SHA177f2b706e87556896dc770c0ddd8dcc81d22688a
SHA256b89b3a92bb3639eea65b9b22dbf57316b1cf9a21f6aa152e98cdd5a379e1ab0a
SHA512e6bf49785cb124f47a3a1af51924a545b2c915f4c9e6b8b07b95d1b8963a1fd34debd50ef71db36a75fc80449b5501e5ae64e3cc38f23496d5164bccb0a343fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508b4570bf8f4439ac55336a10960e4b4
SHA1ceea2dc2679dbea4989573f83787a74854bded81
SHA256049629d502e49992a94af18d4fff25b24cf7ac87a5bb4d81d38850c7a86ecb80
SHA51288d10a1af0dedfb7c3b389e0c329af59aa0dcaf6b7f585053ad4f66e8f3ce93326cbe234c3233ca8d573a32df6a8548279d9471a348f7d30dea72ff001bfe8b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501940148c25cd06b3639a58fc2d73cce
SHA1835d861a68d169f5a5cd68db30aecbdfb487f003
SHA256518817932c4f4c6d0cad5908ede713dc2f1112b12ef0cfadbd040430f01aae1a
SHA51226e65d527c9c1007fc5a8a1e1edb63fa6ae2e991e6fa6b9d0ccbb9b143ef6781710821313187b0e13b02f656bd12135aaf6eb68b3eb41d5ae34cc4dd0239b8e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e75676335db132973411098549533159
SHA17369e3e8f3f5966f76503fa3f752d964ec4477b5
SHA25605b29cc678d04172367a5cb395eddf4d5c74b21e504f5b9c4d897f2db37ba898
SHA512e6b5527dc895192f76a48a1b37e6e46f379845eed276d6d522b57ee454b9f621cc0c45ed41dd8691c6c69be8523459ac125edb51dc085ad806e4742b5513ac5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576e221a60e4d07babc62bfcec95c01cc
SHA1f6366d27b7462fb12861e2a8ee320aa49a499857
SHA256f7c29c97c205fc2b1db24935a680e2a7e3e0363a7cd48c4ee311125655a2da8c
SHA5128b73d50a6bff6386c6a5545e91e0777b758fda4b5e59fb8d764479856bd3f5c110aee71d67a4a5548b4d2168fbfa634ee79393f11d3aa65889d33998e6662e47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52db98399f60588b5afb2982d0391e90d
SHA1044e17d933e7eb77d5e5d491b23a3db631301618
SHA256e2b6de042aca83046e525a6dbb2ef6a0ec4e7246460c55008b47d81f330d6229
SHA5121a5e2828c3418e84263d7b5ca0b1f36992680f5fbecd18eded912d0da28998746b2ab05e0d5335434fbaefc823f5dc602166e9ca21e4ba2804b5c690da054348
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52881d6b8f13208c4063fe1a21f40e13f
SHA1bfb726d7bacb35be0678d9b9901c8afa48466e0b
SHA256208b33d7087900c936641a22625cbf31e267bdc395b633bc662301dacdc338ee
SHA5122c06c4fa24b86359c49801264ed6b98899b1158a8cba4b477e66c45e71cec4fd937376e58d15566b5532537fdad92bf0e680c14524e3571d86310b68abfa1702
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5375943cabc278829175eb5d8266abe6a
SHA14e6d4a96ad6389d782381ac884e3d1222abe6690
SHA25666959124a43b8b361da803326d9da86ed2717fab7be64f3df468af779f2d00b1
SHA512754e90a130f82d9785cf2829fa9cb1df390c36a7f98b959d412828f1f4b2085a322a51b99eb0b164d8e40f1e5751d6110ff431cf10489c792bcfe49225a79c41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592f3e3d562212e4c135a77c019fcd8c7
SHA1be36dffa95403afb43c31a2a761a0d16124f096f
SHA256fe26411fdb20b75d8a2bc85e07c76ff23858d5a9a7abaa1ce0c3cb706157d2a8
SHA51295502f6f38c27c9a2ae0fe9eb2359a25279e2c0b6cd9adaadddf98952e54827c57a900a612d81d01a33bc0526bfadfdafee51d5e05cd824124f6cfc939714074
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d3de45efd5108ccfa6d135a43c2c97d
SHA16429e193d5ec3c140021dd411e5b5452efd11e37
SHA25660b360ecd34705dc6c1c1b72232b0f33e72ab2a34e70613dc863211a84a5918e
SHA512c517687c682d2db459a5989dc358dddd86d3fb3838d63a9e164fe6b8d224f8dbdc3d7860c090b7c844fb1e991565eb7ae4ab15537c25a07918cd11d45f698d81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50eae118a70326bf8ad406df75e298b95
SHA1ad4aa68ef6307e764f4e45498150b2179114400f
SHA256e65ecf9a6f23fc42b2849e759a73be58fc47e5bca8be6a7112681e93cc86b231
SHA5126a8cdbc9c79bfeb5c07283719982448a9163fac1e906badead3c5b5529a1a61179a28460dd97247fab985f0487d9c97066422146237126f770890c593c779b7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc5e6bd343c6e484f32fac847135986e
SHA1e64ae66a3163abfff915eea9a99e8d556346d77d
SHA2569c1e08ccf12dc47498716e58c450ebc2cc40d5c635da68d562013b5fca0b1b81
SHA512696ed10c64cdfdc42a5c1c1f4261372e0eb23cde77e949e4e45b69f6671fb19673ac8b64b93ca88976bf7277904d7d7e107d4b0822a2e917c572679c80e807a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5506caaeeef8cba867726dcdaa833e8e4
SHA1a4467a17c445600aa92a0699cbdd1a14757ccce9
SHA25644fccaba8199ae8edd2fd5c566ecb6f8fc11b69c291293fc757524e6a9c0e9cf
SHA512223d715b5aada59498387615a8e21b6b596cd03c93b004cbedae4e3a3c6366d42949d0213ced7c080257caa3a659ec4a93eb0a46d83723c72cae1ddc474ab425
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b7e265da64eea8b517a60473aafeda1
SHA1411ed1927f16e6c15dcec39d5ec8a10973e4ac1b
SHA256ee1c63a910559901cb9a83cde74f8c0522b1bbb65948ee42a07f7d48767981ca
SHA51280bd359166f123f3f1aad0b34fa0d5bc9aa4ffeae8d58f06459849613a90de4bcf256d58d70059263623220cf64229016e970740eac7390dabbc5db8e6992c71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5980525dd18cc0163ea6499dfc81fc2b4
SHA10481bb1e6ca8d1bd53115658058f9cd421136d01
SHA2562d8a07457cb4af01d73510ac13ba64fe645b842f8a914b6d045627f16a9e6b65
SHA51212525057c8d8b51fb0d8bee8837252f111b39f611b8aa1d7a2e9181638fd21b08a33043adea29c5c930624ed2087457de9c36438b8e44458129f9a075640d7cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ae00e9d2cbf229bcd103a8ebaae7240
SHA18ac922ce36a01f1c3f463b5a71bb292edd51c8ab
SHA25617708cb4529c118da591d991417af96a2957272918b5ff45e9504d444a5f8b5b
SHA512a240c469485ea663e7bf2b5c515d24025ecef27665d160c5462a442b9946ea2d0d0e049f7ba4072a6406a6021d254bfabb079e68ed0c0ff76cd3895a7750ca4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55dde6b403de8dfe3d49aab9bd9ecd2f1
SHA1d4fe88997e68941be2ebc57e5170e487c5fe14a4
SHA256b8fbc0f0ae452a2ee510d7b36867e0e60ec2bb641a6e5bce3c16ea54ccc3fa61
SHA512d9fbf3890468c63302d282cdbdeb8d7a42fc8996ca5898aef02c42ab5b576b5f7d3c3e2c1aec3ec141b7a6b0cd111a4eac06faa77e6ad3b93fecdd36623f35ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dac60ac68dc0d32d55fd4f959efd5512
SHA1e0d7c993a679c33306b44eb963bf2e3e60f34a4d
SHA2563476378879988f668e473ab5d39c67fc2cde40dd3a2e12d1dc85164b70351c58
SHA51230d71a923b041925312f7f8de2b926fc32cfb04989302b4a38498d25220e5d7abde74bb04de8a3355fcca40fd7f3239f34474898d9ee6fabbeccd05741b08691
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a54c3c49a813c1328075feceb872f482
SHA142fbe59531bc8c6f10e785a5356975643416d913
SHA25642a1600143a9dca3461808585c15333e7d530bfa950965792e3e36d87755ed83
SHA512d3779f810226dd502b049186025717676bf8baf43b225a61165c1202a5ad1c3b38a103616d84355549437d02b53bd8da3fd972c6a9f0107a6544b55acbb3595f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b