Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 11:37
Static task
static1
Behavioral task
behavioral1
Sample
fe721ebd5ce462525bc937679ff4cf1a_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe721ebd5ce462525bc937679ff4cf1a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fe721ebd5ce462525bc937679ff4cf1a_JaffaCakes118.html
-
Size
4KB
-
MD5
fe721ebd5ce462525bc937679ff4cf1a
-
SHA1
3feca3a733645d7e8ec674dca204589e0d08f0e1
-
SHA256
06ecd8d5d8cf88eaabea2b0f0d1d67972bb15789604e28befbb425ae62f487d6
-
SHA512
e919b27f4e3f44b15ee9cf0c0752a851c412c8d4c3dd637e9aaae6bee79f04fe4b6eb04b9d36f494a5be482867df710cdb9442c8f0633ba863a954425d14ea69
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o/ZZ5d:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDk
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000170ecdab00b19751eae07ed0fbe5f52bc79dbe3770e27e3f2991db851ec596cf000000000e8000000002000020000000a523e7c37f6c15440af895411044987e4c76cfdca7bc722aa92445513e209db3200000007300b12c9acb549dcf8febc61a3f0b33309c56448e7469e8a623e4c71bed9bcb4000000059fc049582838e026eb0f5bf2c89fb334f4a67c5f354ccb48339d30319f4ab7126556fe7ad0b1334236ecf94d1f3fa17f8deb89198d61b04f1bdfbfc155d02b0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802a9f086412db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433771715" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{341EA1E1-7E57-11EF-B9F2-E62D5E492327} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000009f87730c3bb1797abef788aed9cfe439612a3f2d19bdde776f2cd741f10faa8b000000000e8000000002000020000000e02d968f848fff454e9d22c22cc134077608465c290dba530f4b69f1b6568de890000000ae3440305c0cdb768f803e3f76a7cb122f6bd5cc23dc1b07f92ff5c0fac957f0f7663e2bc86eac3df278c9c863f6f6539f4057ade0b5cbff32635ddb93cfd8e8e53f1c6e8db54c3f3b5b5a9a3034c02e179a7e6a0a5dbc0f8a689fa0be022e7b28a7437537bea6dc6f755738290106ef700276910e68e1469643349065aab865da9c7b31d495b26e10c3b9ea8e2deaba4000000023bd3aa46bffbbda4bb1127588493af04319d6044b9f9db78d53dd820e5ae2b5a05f4ad4de6b8ea267d346501c5f9ddd1ca7263ec1701785c7ab533c9bb94275 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 768 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 768 iexplore.exe 768 iexplore.exe 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 768 wrote to memory of 2420 768 iexplore.exe 30 PID 768 wrote to memory of 2420 768 iexplore.exe 30 PID 768 wrote to memory of 2420 768 iexplore.exe 30 PID 768 wrote to memory of 2420 768 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe721ebd5ce462525bc937679ff4cf1a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f09efb5c58e6425d630f6a92b8a001ac
SHA10eef47e49cd3c70455c55903fc3651624c0214ea
SHA2566029f3d746d1239a89c6827cc8d23fbeec9c28454b7be2ef69251f7cbba2f9d6
SHA512490daeee0ce3204fb519d27e9bfd9dc1da7e4babe457fa08b859d360bc4613735be8a9ecd3069d0885d1a63c519f4e201e04f690e52ca8d09d5797aca60243b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e1e97800cf8326eb2a78f2fb3c9e92d
SHA1371721966ca9b9afb3ed8e8a08aa0170230452ee
SHA2564aff73401f852c123ddff53c3847e2aa4ab5d689d0f0396e46726bf267ff70b5
SHA51285048098b3708980d81a3a1e5bce5fc9ae6202852b64625056e80ecbf14b1e5245950752790898192f486d3112d4087eedaf150e26a49114017127f71e737cbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd63ea1ec4ca7180eb07a3792ab62565
SHA1fabad2b24775a0d6042e0ea57c9ef665812a607d
SHA2569d7c7aa6c94bf280355c0159cb17149a781ceb33d73001d0e75f3bfde6f80a9a
SHA5120f975e67e46550e22d0a2a159dc3e840162c256a180ee510484d14f98e833152aa334aed7aeb7805e9373d78cfd6898d7b63e7c4aa4cc03a874921673f988edc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcb0e047ea0ffd7e310ae826c9f2c302
SHA1e5db29e12fd59f3bb55fa650716e13d0c2682a5d
SHA2568fa072bc43d9af84b776d1d99352da7f6f02586a9e4410c9531dca071e17c03a
SHA512af6d18623cf325fe0de74f617ca035d26a8cf0ffdae2b31eb5882ba3afc294362981cde0f74de9cedf9bffa270bcffbc40733de302245aa379ac0624f1f5691e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5424914dbb05e235f75e2c24fc65a4b41
SHA13fc290186734bf468cfe6f826c2e1a9e070fc00f
SHA256d2d789c080f62a20f05fe4a260f88535fd381c161ffff0f4dca22a08dce38adc
SHA5123567497034a729885f83a27600236f89d62f5278e5fe368e0efef0c9b75530e26f79e9c922234208dbcf1744c981b02578f4e1b05f8e216cf35496e34a7c3bf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b855eb63952bc579baca0b6e2a693a89
SHA157bf1f093961760cea3a39ce95d274c3b4db613c
SHA2569f9a36efcea0e0841348a0b9fad8c92e3368ec05ab4906662e45bd51a25eeaca
SHA5129b894b6aca1153af2ff0e3d4b2b6632e3b0603d9ed6e13121429eaa82d33a4d1bc6a6f2bdb83f54a3243a09b26df0ee73798a33efc587597a06e671324df3e32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e963132256768bf61c45ea039ac67d62
SHA1216486a3b232df8d8e3810d020d6963d21749568
SHA256b489e9b0a0c3322a97ee9b5183078bbab5d4e629cfbf02c96dfb563f9897f9f7
SHA51276bf8805471ce0cc9257c386ce560b1a8eaff051e988f8c9a5d69e8ea2479c23739940ac4facd9585944c9e3c4468dab8421a9338e49c30da768bbb0e0bc9ef3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563f269892e1514f181aedc73234fbdf1
SHA1ee79a9a53632be404cb6b0902f7649730a5df957
SHA256ebb40adab96535d98879cd6d5dc723bd7c95e3d9c9d3bcbfccf9ae077bb1cca7
SHA512515c5ec5c79a7b4b6643061186d0752c41a1dddeec55c65f34204a6ad024296566ace2de0a3ede795fdb7b29d745f8eaa418d18e17b2da93b40d7e5124d81278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e14b67378b8a3c094ffbe252179e25df
SHA1f5d667c84c2f17b24d50a64f06bef3e0b5cc1e63
SHA25639aa7c3a15825bc6bfe4396e75a5e4aff58dfde44d673db12424c9073b81a2fe
SHA5126db838087f62821f8a268f59c01a58e2a4f28ad718dd87a48a9195cbffe832ec884cdefff93b83d19807287c86aabdcfed2e8f05e9874e4e8415e473e0a3053e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56641acd23313259320344bb977df0c6c
SHA12f00fcb5ceb5769c3f118bc5c52f939304793b43
SHA2562e9863577e594d23ad5a6a8d76bbf82b0b3578f6dd4bcd970cb7d71d255cfcdd
SHA51252c5448845358d82819839c79674f326bd2d431101f97f14ed8eed49d002626dc09b4b904fc8c474a0a02ba92af6680d0982f3753413ce53ced502bd8612ed46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7c47aa5906f750ce93eab83e8094862
SHA1b6567bbca34ce063b048eb45fb94bd6d11a6ad46
SHA2565c33a86cf902c81b6b7c39f2fcf248a3c7081e7f16ab882d0efbb65129a2c72f
SHA51224dfc6921c1773ed32b90838103c792ffdd5a6902efe8506da5b2e6030d4e48101a5d8b1cdcb65f35c2066daec0dfcea474f1b689244b1882d6e9033d8684127
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2b64eadaca1af4b88230f3ec8dfe432
SHA1d8f0cefe73c5ea57e5addcb197e3a54ca1955e0f
SHA256d53bbb4e4a1086d92308eefcede38e44f0fad02a3babea6e5f3c899aeb4cb5ac
SHA512e67f546843da4d8c9f522d63e2fe72facdfc201058dad00fd571b0ddd60bafa321fcebb76322833c10d20b97cb8df29a7ceaa806d339c3a80635e2cb2f2912c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53657ca9bee2c37b0a897c21da741c427
SHA12eeee5bf8eb3c163aa3dae9a0bfa0a028c5413ce
SHA256e413d0d58577ca8f57145342be887aac419796c63129c8fc78e4f9b9ef8309cb
SHA5121e828c6adc249a10c0ef0f14205e8a074ba2c06f302ec9cbc2ef5b2cadb14dd4180c579d3c9f650c0a82a066faf042dc723b4d1bf259090ca05c28cefc9727e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9a4aa741bafb62287d483dfafa5f444
SHA1461c50222eb09b355f98aa519ad3d8d2a7131497
SHA2563a97f9bd3623b849da437b8a53500c3775cd5065fde507a1e2465979bde55102
SHA5127ef06f3252810f1f36d68d3a5bb731e9112eae72f4f80d7a8cc601433b78967f2fca31857f7fa12d18cb671a9e47e8ed4aa0a607a008436a8c431eb0a4334586
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7f516e5151b2b2e1e4a8a316d3d15aa
SHA1595ab142a58eb2759f82a271a11deb4879800189
SHA2565b6cc7cf521b949def123adc5b409dbd71ab0cbd929750f86efd21cc8402601c
SHA512517597d28f051f928b7ac4c866ee856835d6d874991af4d195fd2911a57a27f28c643f3068f1bf57a72e1f99872a0ee781f5a65da975a5a610d16509bd0585fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d1a9e9bc7ba6d0de53eec2513979b05
SHA18490546089c4a9eda55d6ec459483c1c9fb9e3b2
SHA2561b004a0c46c43bbea7173ddf3f6a6486447fcf8de717307fa44da95c10de9374
SHA5127b6967cc02b232b147bcc03e8e24629b389d18258d9b86e4d6183ef895652a1df7644a4a085060e47efc6e59922c530cda29083aa6645ba5d4c92b7353c0420a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c2c1ec50336c34841fe1e7b3f4da5f6
SHA1f775ed2334a227605380c977618941ed87c15785
SHA256d2943596ec973e317f676428378beab11fdf710f213aa08a70706699ea82e984
SHA512d36505ff809e2778c4244071ec55d306058ef7c5495b0602d3bd62a2aa391413817863e223966d6ddbd269863fd6ca0cf91479c73080f3cd2d57129feb109783
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd305eee3c6c5ee10161cdf3d68aa839
SHA1d704ebff65fbe110e75f8687a2b2f84c3a42918e
SHA2565b29c6cb30aefd95a8c6c2bc166252bc78f90c78c24530e70a2df4ca43f7065b
SHA51285d39f315367b683b4522ca67e064c8c62043e3300a4fd208c6e2954a45343bd7864e931910a6a2be5896e986b5dbac0ba60397914a7d5a0a0628f89f6b7701a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b