Analysis
-
max time kernel
66s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 09:52
Static task
static1
Behavioral task
behavioral1
Sample
fe478b132f867e7b804cc0f1a6696026_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fe478b132f867e7b804cc0f1a6696026_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fe478b132f867e7b804cc0f1a6696026_JaffaCakes118.html
-
Size
31KB
-
MD5
fe478b132f867e7b804cc0f1a6696026
-
SHA1
7a9192d6f9492aba71f2653721a811e551e29c69
-
SHA256
52c47844a057a2f34ffc45cf3f1314d4a8905a7bb666294cc1cbbe694e1144fc
-
SHA512
de7063174bb17df21aa6fbdb0c1c01444f753955bbd5d27dab3fd4a4053c9de9687f4a55b0c946b396999f800736a877d7e55bb04c737a03321ce33316af5136
-
SSDEEP
768:UpUOX2rb3MpGnHfMgztpuMFnoTqp2whbKvu:UpUOXk7MpwEgBEMFnpp24wu
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9AE99881-7E48-11EF-873B-E28DDE128E91} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306b796f5512db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d5cee29d5ebbb12ee77fad1ee71249c59839305d002e573bde30e85b37456f3a000000000e800000000200002000000028695cd9804308c29fed3d03805b1a06e127cf281be871569331704d4e3480392000000046628ac13718e12053735a9dc6f2be56630fc9e158bf7b3a15e339bc33fbc53f40000000683899d38f22b870029d9953f0bd558c630e1233b79c3784379ef84caef47dc37c311b0aa68ccde5de0fdc7ba060e8a00323e815253364d888ddf248a3ff09bf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433765444" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000000238f3d5eaca765d9fcf2ed9ce15d2529c028c497ad75f67fd955edf9f02ab51000000000e8000000002000020000000524fe78c9bc7e904955d4ef4066e692fd3defe8319cf47518fce1765e686353390000000e2a8222450737d5151a2a12c010a5eea0dd528b6478968391c32a29e30500f5c462da3e3b0eb38d794481e5eae2a6388859886795ddc7d07e9723a68795158554f97c43c0e0df2c12c57462b29a09af6e05d5f79c3daad4178afef532e267f578dc9938561ff5e65d31e8a820e11b9fe7f9340d10c6a90e3752d7f40fd3348e586a4857b4292cf0d3cf6e2ebce3cd6f64000000061b503c2ae7549d81fac86c655052f2c70b999ed76256ba9f97d00caa8a832a80cfc1cf682b74392804c0f9082376ac2972bc71b36e69ace8b593db60b402068 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2320 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2320 iexplore.exe 2320 iexplore.exe 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE 1276 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2320 wrote to memory of 1276 2320 iexplore.exe 29 PID 2320 wrote to memory of 1276 2320 iexplore.exe 29 PID 2320 wrote to memory of 1276 2320 iexplore.exe 29 PID 2320 wrote to memory of 1276 2320 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe478b132f867e7b804cc0f1a6696026_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ff93b9ffa5953a02fc562a52af15821
SHA1f707d6614c308aa078d300bf4954f89c0f33ef52
SHA256990ec48218a969b3a9155c062e295ea0b7f076984f052841645a636b3bab006a
SHA512ea488ab8f135a753950ead781c63ccde8eeb4a98851def0ad532916dcbcc45f9aa198a4e76f1c06f8aaeb32984be69d5cd9b15f7be7a16656e796ee951411e59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525b8f842d975a3d234b037695826fbf4
SHA1045d79b0105fe8a92f61c99d8e4f5b924783e3c6
SHA256d2b84596f2e12dc545aa40f04c6e90381fdffec8ab48030bc44c82455ef1bab0
SHA512a13d67d2925c8a1214c3f9c2e021051c12c24761824d5dbc6d086aede8194ba8660b9c806f37ea1f55c7d99de0bf5a93440dfe5e422bf2e5422b803bbb3a9a20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d8b0227224b984f4aaebc8fbd27f264
SHA16de27fa99c56d97d6f30bf2b56f1496858d418a6
SHA256578259e3c786493e5cf23e6b907227cfa967c86399cd62f7299b33b17636f33f
SHA512be4c9ddc9737d621cde9c6afc63eefb1105f2f71efae67ca306ed8b896a7c689cda48ead884c14e266d20aff68854a6ce8c3fa3cbbf387665956f1458f4fff41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58693326784ed44515713090885400d42
SHA1993b1b831e6ad0cc81f4b382dfbe1e4849eebb48
SHA25694cd7408da6fb4799ebc379887e10cd99550a0a7181d7300ac763d4fe7ae6095
SHA512ed689d988412d9f187c30a004fb7c85089d7c4663632b7805b4eb6bdb1deda8347ee06aa5cf29f4247d96178f1482deff68d0c0feeb8f94f4eff5ce323012db4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c05ed6b08ad14515368650314306191
SHA18ca7eab317810af58a691cde3f6a3d48eed32fbe
SHA256d6340a285a707799e7329339f2117a8dfd9e766613b9dc78d79a151d6cf82d35
SHA5122ddb06722624b8749d3a30b86f6c02b55b0cd710df0028b9ec17bf2655fc485c81056a7f0d954c245523864a615a11cb756d0ebe0b0733d13f9f2a75a34fa495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e7fa3ee9e7c20380f3008346d4c4c0c
SHA129f80239f70fe469479837654c1aa5e0198bc03d
SHA256789eb11449c0e22fdb1081592692cc993e2be17430dd70e852eea8fcc41581ca
SHA512e8a404cbaa9b9f6606b61300a3c4dfbd6d0e787f909da11f119339edc0225e942eea8a1b3520b2e4075ae0a6d48f547e04c3ba3605be6b4868efb371215a5c10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2d41cc990025db4d71bfcde0e76c9b1
SHA19afb300d1b75d834ecab469d4e85d85f65b10713
SHA256d6efed605048987ad991fb0e58fc978f3bb0ad2b05c4de366d8b69bf8a480d21
SHA5121b993082729121b109881efbf54ba83a776e4dc7acb33cd64df4b67504d7d7fcde9be604dc526a98c654106949261614da2ed778e61f1a08770de13ca68313ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52bce077af27462979e79a955844cf6ea
SHA188c6c065d44d4542c2663778c839da73c794db20
SHA2562253035f08206f13bb61c2ccebbb89b1f0d6d7cd7af0fe311edbb3f2977827ac
SHA512ad15636ab7028b1083ff9fa1183c7d461b2b0e26243cacdbb29148f5c5e97238f70aa29fc7dc6d4d732c3085fbf4a534ee503598c8d6ac6cc082a1c11864ad28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fcf9f81df36b907ed1e539877484258
SHA14fe8569469f05f186637233a305ed357d195ed22
SHA2560bb1458567b40e0f2ee4c57777b45edee945f64bbaf00afc0d8d01fa6cfae618
SHA512f4ff91c1a2fc315bce76256ee2b3b13c27d0fd4a23dbd9f606415ea76bdfef34581181d2cd7d8511002c5554dbc0c09a36e4c68f8623dc94bec91db4d42c27d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fac45482edafa9ace650f77cf4d2e72
SHA1bb1ee43e35fe88a4faeafe3675fc1ba0e9d2dcac
SHA25647036b31825a627f128ce3886eab16895135c1697129739d22a92fb4ed53ad41
SHA512828e8eb51d92cf40cd37e54d60faf89e28179eeb1b1ad29f03977c2a124f4b8639c07f66298db4305238cb0d26fd72617bf8777bf75d4b70fa93581a4dd5f4ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e1edf0848a2e57cb2ee41fa9661de99
SHA1e87ec07bb3b137e7d7576edfa217387949e3f932
SHA256e2ed469f34e2ad59bf43bda3c3accee8f8f4a1970cb78a53347c02b7bf02c61a
SHA512fb3f40fd537fd43db1af064ebfa31464a7915878e0d31bd7ae5ece823a9b10e53085f6f550d03441cc379df6fe6025e61a455a9a6aff8a09cc52204b86b5c832
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5442fa50d70447c2fbd8dd3b853480158
SHA19a03f5bc6fa0d8933dfd4d2d65202995746ed3a3
SHA25647b4cad9eac87f1ed7a7eaf4fde5b714a87187deb236c3b47ae08288cc169a01
SHA512d0703db262d776321efa52702fecb572e5b9d5ac616b7318ba14ad7d01af4fd48fe6b76746c527896dede50426c55274eaa104afcf92c897739a015da2088716
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4c4fe2fce113ed4323cc6b7af50790a
SHA184bcbe181996a2a52451f51c4c9bbd8e6dc0cbb1
SHA2565776de6de9c35418a0eceecec69a8ab70425df463e4dcb1120b7b6bf4813b69a
SHA512847e59f56d94efee5f5bb74437dca7371909cd705b228195ca98bf4ccb27ca086a8ba4c6dfe87ec78e7f280f26bcd467cbf5c0ab0adcbaa1b23fc82dd1ec2f98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50185ada7b877e689c26795cf1c2af870
SHA104f9a45dbd479499a55a48f35e0071499dcbfcfa
SHA256034b7da0cd3e610cca1ffd77e4508a964c086ed55c20c4fecacb25700fb435c7
SHA51249501117bd2e177120a046e124440ea77b3d8b0215c57164c6b2262b312706098d5aafcb35325d17df2bbd2206d44f320c24171ab38b843c77728df0be7cee23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c32d5bc4ee819570f8a286941d745e16
SHA1b0342294bdeb94bca7d738b3b8d0db300c14acc8
SHA2569087dd31288f1c7c1caf3af430e7fcd9ca8282ded1f06d2fb25e4699dbdfa734
SHA5124ff70c48ccb7925b7630e4cf744032b9133790a311a6d7e29b1961163a220d7df4d6a4e43b499f308cbb46a9faebf22a57e79ae89950d1be43d5b4d6d9c92403
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da12cad3b9c6bbcb536371f6bc1a66db
SHA15bcd7c9b4acf42abb11f8d6927edff3a53350d86
SHA25621726a6840c7a4ccd7f7866a2949d54bb70f7f3eb539c768d77fa87010d19449
SHA5120676a133173660e3631e9af341eec062f955be7cdaacfc301fc3a1e83f451ab8873f4ab428497769820eea1a02b3a00d512454ebba70afd796898be74a71a89a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD574eae695d4707076c4078af102ec520c
SHA143c124bb400d4a97705fb11c110228af2bf46d66
SHA2566f9940cd5afab38bc3103631b974fdf82229791e5065cb23744b98ab6e71e05d
SHA512ec6b419654f4a87cd8143302e81b36fa16f7746ee74ac43c75335a6d649c8485648eb4072b9a268b51b9e34b663b1b5346d99de3b421b3e15bfcee83a76c4272
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525d82cc2ab9f1727cff31a940d7ad49d
SHA1128411191252db8c80ab2d23ec974e52265e6b85
SHA2562da1d1eb31090f189b5fba5cbaee7b9ae95fd254a0ca5df17c19eb0a5a73358c
SHA51216ee3447ccf5f5a761e4a844a95a50aa52180d7dfc90d425b480d09856eac26d10012eb837af769689603a0681b70217684ed815e718d9c1c4de3bd89cc78c11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a30ea6ee37a4e0c59a622a1f1d2f053
SHA14b1877a7ab65e6da0dc5472f8cf61c51b9b0efb4
SHA256aa4e5befde81bc2a4c0c001f13d8513665dc75d0c267eaab465e25f51b31fe4e
SHA51286a11358538908dacffd771195a1e56bf57231b5e261b858b9b2337529a91e5124a1b6b61e2e45373a06fbec2e255dbc00f8f1af5845dc07809b801a4b13c3d4
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b