Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 09:47
Static task
static1
Behavioral task
behavioral1
Sample
fe4528e1fde638159c824798febad318_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe4528e1fde638159c824798febad318_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fe4528e1fde638159c824798febad318_JaffaCakes118.html
-
Size
43KB
-
MD5
fe4528e1fde638159c824798febad318
-
SHA1
eb4c25f152bb3b95b95966ec35ca59cd1fd068b3
-
SHA256
6d8c968d76852ae2e9564656ebbd3aead00023cf932667ded34075b974ab7a20
-
SHA512
55b6c32f906d9c149d829a939bf8403564c9ed2c24eea0f9b59f5d99cea7d673f757d7bbd3e897f68cb3dd3171d1f7acdcd2cbc80ee0ec4a2891aedeeaefb193
-
SSDEEP
768:bI+vbG2+0MGi+vZGIikHhGRGXiOgOeGBGlGD1b9oFc9wt/wOenU1:s+vt+0U+v5ikH/iOgOjWtYON
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000bcf1fbbb14a4528ba73e15decc80532fb7266949db35e759b033f32de472c82e000000000e800000000200002000000012c9c47e32c0f2a0ee4c6a7da93df4fa4af57d5ac16f8dc09ab27f97e90a99c29000000063d4ad1c4af2e632b10db60fb20714e5b3e88afe05b8d3f48768873082fbfd2e7a55d96162a3da86a77895ae06546518428b5655983c58484a86623a8312473a1a936ab73178418c27b19b77a83062971158dc4d025aa13a6ea5f5aa592e5de92cfe3e368a87ecf6b9df9ddadb4c1746b7fdd01c2720453ec8cd67ea7d43c26e77110556080b25ac5e5d9f04e811e25440000000fd235682037f9748749b061bbed9d0e65a2a6849e63d9c0eae3fb31afefd1efa7ce461474027af9b2d79c5dd663c5ec12b8cc514940db5565abe12a169ed14f8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF1C31E1-7E47-11EF-81BB-F2BBDB1F0DCB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000008325df23e931efd09fc534b92a893ef059a13e84f3295d3218a44a9767c8c28000000000e80000000020000200000006d3e5619f094793824965d11de7a2221fd80a19ce8c011afb263ac18635395e820000000c5af659e7babcd5b0a6185300a5a68d5652d57eb1932744de1cbb268b93b7d0c40000000db3820378be305b407e42bdf17af5adaad019e166020a437e3285f66a877e5f5d963b280177d0001255200a4413d6229233a83ca6560c94b5291bae6e6105b30 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200349a55412db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433765103" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 1944 IEXPLORE.EXE 1944 IEXPLORE.EXE 1944 IEXPLORE.EXE 1944 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1944 2364 iexplore.exe 31 PID 2364 wrote to memory of 1944 2364 iexplore.exe 31 PID 2364 wrote to memory of 1944 2364 iexplore.exe 31 PID 2364 wrote to memory of 1944 2364 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe4528e1fde638159c824798febad318_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ba817716f6b6404ae8591ea16e2e702
SHA14bcaa470d87433109e7d2eae8bdc798ec8d1c3db
SHA256e3dbb7f1f758f4c7864d49d5a488cb8cc442a8c1876b204659b500642c6467fe
SHA51253d9bd4ece7a014549063d87aa748e6d38140b75a14435beb214e2c1af200129bb9a4ea820226acc2c7fee17fba66022f7b512a4f778cd258fc5db7ee3766a14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b716bed5f165cc9ce89ef8e94df78e26
SHA13e5456de7e05b366aaefa80d6771d2d982fce50c
SHA25657249788b64f740faed4ffdebf420fe0d1e8adfb047a60bc55364cfc9da177c2
SHA5129ec0a84e8787ea1625237e0b411abcb46b4391fe6deb5788d8f0d3c437e446933d7327d4eea5c5e080c03eabda56f030dcd438f4629362d93994f67546b8517c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58b7a87dcbb01d47d3b6f5ad2de0720fa
SHA18d81cbfe25355334f11db0a2878120e85355f6e5
SHA25634a01d8272259688b1424432bd4a5a9ca8f726b25f175626c6d58567bc5bf40f
SHA512485de52ac4974dc461589f54ae1b35aa947b52f8290c4a3214534ce92a88f73d26ff87956ad74230fd8d46e298bfe3d762e37f44d4dfbd3db15773972ddd798e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b853677a456caa5e762959da210b4ad
SHA15579565fac38917e03656fda944218dfe0e98368
SHA256014c928ddd3ad8e09194b48dcbb4341a1cea1eb8d62861b759c5009c90d56648
SHA512c4663f4924d741f76613db8e8729e147c99e56bc4e51e85fa30f333bf2c3275d899de4c55aca3b648f24ca3f0cb53f34232105e2afc78813b51b8e02ae3e9ae7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f8ca0cbb74f0f4bbba450dc6c22c12c
SHA1a19c5771b6711ea2df392d9be148920d169474d6
SHA256ed5962c758d058ec5b18054bec09533d891bc472561aae7709424d49d06d7413
SHA5124d788e68294fa475c922b880b38fecb27cbf0e1eed7f97968c907231156fdc74fc40f0baa3ac39f1fc99a067e35a8cc58e53b6a9daf52007df7c835ec9b9c676
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547dc889655b2313df85acc96b8534c8d
SHA10c5634235595f88151094d6e48ddc1a331c5bc6c
SHA2568040e68d5f9e6be5b7bab1c31fc9e4caaecbd0818578bf620989acf652eb11b2
SHA5124e036c388d2ec102bc421a13ada1eb7fafd3b2a774bc5b6fd073d88117fa352058908677ad6a8729f564b31c1d1d9b66bbea9836fe3bdf393ad0f0c7ca27967d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5866de9e1873841a0b534b3bddb018f8f
SHA1db502b5caf0e30b8592667ed8fcd39235f7c2272
SHA256641a1cd71047aad106d8cbf9c8d8c872b172d01493f7102b87fab80aea34f414
SHA512df4dcf05d367157b918ff19fd2fb0e8a5eb885603b934fd11bfb5e011975de945359716edbb4e2f4945242b0dd5bfcabb801b5437c9750baf6270caf0c29e237
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cdd88d1f6b2685a8e67bfc34f3ccb78
SHA19cb0cd83fb7dd7079b0d30b10df2141cd03b7339
SHA256b8d92898e8c58a8e218137cc807ad76c053ecb6c56f364ddfd9b83c3976e7968
SHA512d9bc4f9cf53f356912c61af0356a8da52e5fb1915dd107f4397884c040fb1743c80862d7b4994d67644f69b8f401f41c098729efb52d02d7e20f67ab9a904474
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ca1c58cf555731ca0c201cad2fb428f
SHA1317881d9b395f54ae1fbc1e903058f3fee7cd274
SHA25614d1b9243b34a413163ef3641f3f5e512d778fd1096309a999c1a66b2768a907
SHA51299f029e67853575919de1e85933545d6859e25eef90e9e46ef77c1dcbc12aedbd7d83ab2c65c5ca558229c3c86a54db2342abcb20db53b4e80b43bfa877f0727
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a0c3973c087c6dcbe1ca5eac3931728
SHA19f21620ce65129f74b42ead65ead12d5e4875daf
SHA256828c46b53573f5359673d490f83f87fb96f6859ecdf4281a830b9932c9042244
SHA51234cbdb63412985db7561e5725c40e431ad6bd3d6b03dac1b7ff2de39f7abca17b1fe770648b311753e89f33607aaa01d7767550f6ac98fc99d4dba85ed2988bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ef5ff5d9ae9c3f75fad3b000a17c96c
SHA111ebb7ad2d35d9f3dcebf80d66a1e795c6a07122
SHA2569ebb75f3b40ecca7629fbbcbc0ab545ac70b8daa76d5f725ce8f13d738411a0d
SHA5121213ce0375f56131eca1d53357ad45341afa26d21db7257c15b3801bf698c21c86faaaa245396d1a9ee2fe60fb1d32412a0fbb11167658834c72e2ce61ef3add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8de4e1b362c72a8a29d5b9e069635ad
SHA159c4747ec786bcb3b37c9a531e8fbcc19cad189e
SHA256e0425af587b8bfbe043d45bd4196ad923c32c4106fd6ea3be2796c643da9d073
SHA512df0dbf28810bf1f64e7c2eb0b068c2e19a7943ea62992f0fe09e98290d9e4065ed34a40b25c37ef8b9673c57dde8564b5c9808401fe3dec35fcb2a177d864c7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5176aac2845c8bf936a9014573bdc4e5c
SHA17b5caab13d5339045772c05cb6af91f6b80e848d
SHA25636563f04c4ec7c247aa9501db1627a4b927a72aeafae529c36856153f4a735ee
SHA5122727d00356bc9ccbf06564b7b0b8e4a0ece5fe40b899d906ab3ab6bbbd152a1223177dc8390c1aef2747d51307eb5c964d6e4c234e8e0dc1441cae478f3eef55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554f23d775de558866cf88185b5a8618d
SHA15e1445d9a845da8bdd4ab3fa80d96d7e1b289460
SHA256f91c3345f3e86523eb2b843a893876d60a2ebf530fb7e966c993d61c3038eb73
SHA5126df9281d725fe73c622ab1e85e7c2659ce71014f9d1d63e95947673d13265e3d1a63b24704c965a286adb07f91e459c93cfc1b28222d6f1ae686debd03609956
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc51ae323369b3cd5aeebf9c5eff060a
SHA139fb7fa941d9df9bf119a6a68ff8a8ca08f1ead9
SHA2561ace2dca74196fe7446d91518384ca1509ab42356dfc1cc884f37b43268bb69e
SHA51291759bd6f2677acc3965691fcbdaf5022aaeaaae9ee6ffbddd827b79b75fb253d85510b8b27b72268cf675483173556f1730adaef581e1621eb60e5c91bbcebf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586003dc1dcfd1c7a6303fe0656dd38b3
SHA1334cea6b33c764fbfb7d0c48f817c87e53e835bc
SHA256e9d2ad4e4fec272ab25ad5777679ab45c084b1b0d29c4846934a368ae43f9b3e
SHA512dd6abb19b1c0e8c50ada5b467d5de7d6d886517fcf62d755dd17260493852095309b7697b5283ef584ee8157f63cd64c405740f5efe64213cbb69245956927e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfb1a2afa31763ca7bffc489ecfa4110
SHA1e414e85d4c9853ce997174636ca8ce3e1ac21a90
SHA256d063726ae2ae0fc91e211cbd683d4313c4acd0087326fa72c931e25aaa291114
SHA512b68b9ec501beb252945857fb7b2e0bd127d3934a4e8972fc45ebf0e1f8449ec2f5770f6cd9f608479f320869585a2c5f44889a902a9a33d478a0db4f16323e5e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b