Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
fe93dbeba90f527dabec0b6f5e5ffe09_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fe93dbeba90f527dabec0b6f5e5ffe09_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fe93dbeba90f527dabec0b6f5e5ffe09_JaffaCakes118.html
-
Size
355B
-
MD5
fe93dbeba90f527dabec0b6f5e5ffe09
-
SHA1
db51d8f2934058bd7ad7fc003de08e93987805b2
-
SHA256
6d1158349f7002a8a3be8b7ba79661594a4dc6b87ca7b833a5a0d2b041b76061
-
SHA512
b409fdaa6c26bc759d1334ffc289fa71e4abfa709e76686a6727897edeaee10fd91517b904bbda8986ba0bac3cee4c299771f92ebbad1f68def23600cfec913f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905673246f12db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DFF9141-7E62-11EF-A444-523A95B0E536} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433776483" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000a6ded766cfc348d621fa4d05886d1332bfd061849d0c2c1e9723fc2751f61147000000000e800000000200002000000040639444c867dfad3ee4d1ae6c2bb456b9a6b219d91054f335305c52d8e2d98c900000005c93cc23496e41cff229331d0044c11ea6b4a0bb853202f33beac1b895e67a8e43f25c756fc12e26d273d2f70518e871d6691a5dc579df2b783640448093ae1a982d8fa81ba4e8bb61b4435eb2c77cee00dcfa56740e2d7f20f232c48cf2dd3287ca8e02d53f7fb08152aa482e0820e32d909cc9562fcdf51b7054a581f58bd06737d786bd8d034ee91c90d3fe04066040000000bad4a4ed0b93791ffb189b5a2089350ef6eefb8b745b0b6493bc044a19cd77b1ca3a89b16bdbf84c085232a3ea7a30443e7aaa3fb5c4456b5b0e7bcc6036d667 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000000291dd882714343ec0f9b41b80f963c7f4dedb6e51086ba4df9029efd4330104000000000e8000000002000020000000e1a7f07d2dc167e03b38555d3807c036fe5eb0e5a3c2378e4170f66c7a23ce6920000000fb77409ab80abfb4fa5cf7e1e3c28904ffc7479b8fe69cbd3f607ecfdcb1347540000000bcd8008f3102928d5343fffd2f9bdd9d05ccfd238fedd559e99673c39203a28813f4a566009ae3e90516a2d3953e978b36e31c59e75701281e4b2e68dd7cb7dd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2096 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2096 iexplore.exe 2096 iexplore.exe 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE 1940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2096 wrote to memory of 1940 2096 iexplore.exe 30 PID 2096 wrote to memory of 1940 2096 iexplore.exe 30 PID 2096 wrote to memory of 1940 2096 iexplore.exe 30 PID 2096 wrote to memory of 1940 2096 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe93dbeba90f527dabec0b6f5e5ffe09_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53deae740d1784d5ba4cd58a083fc9748
SHA196737ca87b9b15241220e7baf330b8426f841847
SHA2562ba68f2fed73c325d8bf024e1b67995a509f207f84fe05f60111468d10bf8403
SHA512e2e039ef2fe3130cd23f5e5cfb8c4b4ff86b4c8da0483e9120fcd08b2a6b59f5e0aedf0fd3fc400d1d89ef3592e197dfea8034cc61fd5e5a282428bac6e7ec93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b35e1e7583642208a6b472931306780
SHA1480ca385aad395934abfc6f658c005dfd104cb7c
SHA25615073e1a12818e14b8c344e280138e8642ad34e15ba4844b2cddde2ddc7eee54
SHA512b91d0b1a51caa14eb5b7912b59c58fb6c6023d31d508bca39ca5de73da2cecfed331862c201533ddb9182c69979ac79d8944bc7698f17dceda0d09e1de95c3fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56deefacb87d4306248c370d6fa1c0632
SHA1a682cab06dff6c08bb85f97b755d54cabe02f76c
SHA25620b8cc0a71446b909c6362dfbeb0d06679ee0fab3207ea86ba1b7037b7bb7ea8
SHA5125c3c3b22437ec88f695710ca99f616e7cc3a900afaf64ad26c68223a775431bee526841560c1d6931933d7b85ae980677705cd6fb8895d4d682728b60f3b9e72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5755ccaae6f6805d3003796b43d795a22
SHA15401ed29ec05994d4945f28d2c20359b660487e2
SHA2565089322ba7bb2216fc94e8949a7c5c648a459a097994e0d6b56fdde26ecc3d85
SHA512ca302b80d064837be65b2289eae69c8a374618204536ad00b335fe9a614b7c5124aa39bfecc7e2746c6bbb9b772dc750de68e1fab01c3e39a70796483fec7062
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549b0d097cd97241e632988f36f408fee
SHA1f64d3a532c34f22149c0e4c6b9b956771bd3b7d2
SHA256e30eb365bbb75a9ba34046efd9a21668e7a13a9b13542049d3573b49b67411a2
SHA51219f848db1f68f68b457cd0ea782d975498089827300648f11f88940f5010aab061a80c5980a57d1773bdaf47561bb8c9c8731d567590fcecdcdbc819730ea38b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcadad6ad2af070d5735089ead6cb870
SHA19a1cfb8006ec2f3daac418f18582fb90e6c471e1
SHA2568b820b7de447d8228daa3173f7c812f06ae90c2e0def83cd432c21178a055d09
SHA51251166301839e01995403742083a8e5f75e2d1f04e322d17edb4dfcac5d2ea502e0d7b6dcc489feee41f0793c0fd692ba9e09bbac20f0595a3e597d9d3b0cf713
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5acb8d49ae90140583e9e89e143f9e4ce
SHA1f648c6b7a913461287ff91827be5f20d7c3851cc
SHA2567bdac87fed3e6bc93ae68636465e769c7b7ab31678d35c923186dad7d090f3d8
SHA512edb66f7bbf295dad6822426616d07f6ead2b1fe571e25387adb9a35752f87285ac3b71cb8c5be2b726d7674617eba165cdd025a141818a83e5db534b839ec4ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f5bde553528a60f7a0fa04b9455291e
SHA19c3837f7289ec12ae505cd0ed7273a813f84d3fb
SHA2560f4f31f6385ad2a8a4ba856a21900dc9ec84ef0939d30adf7e4d91c2be948fbf
SHA512fe25e1bcdd9cc1f50fbab6be876c8a61d9b85591f95fcea8da9019c3d6291f2c282957a8497afc2c952d9b2963e5029201ec8fba7c72af92c92fd04a85e855fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fdcb48f4aee89aa6cee69479b5f92c5
SHA1859552d53d90a7bf48e8f77df8ff7b78888ecdfc
SHA25668f0913d824561425106844a9588eac8384a2055eaa92e120b8df6fa081abfaf
SHA512123796b63ee7a241c629aff847154453bcb06b4c821d177215cd7f1c439c2a358f3ec1bd5868abb1bad133ccc8f7ec4244428028e41600c6c78a977c756c2bb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52566f7b7dd252237809a3174c4b78780
SHA175b9562ca029e7c07702451c2934a1ca39a12845
SHA256280e85dfc8de9db93948f48576e5cf438e82e23a4d13b2faba5c6d431f04d78b
SHA512c1682afb13d5dd81e79a285fab4b0bc1566025f8cd58eb6d1a013ec2ed655b84cf37b961ef80384a827911a8687cc09fcada6371af0b44fad0d48bb199de47e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5195ed050ec1d44be492b30ff0d942358
SHA1325144ba862def7a7301202bae4b6ad59d2ec4e2
SHA25653190509015432486bcae85a9e4362b6caf4a53d25c7828ef6f19b7a6a9a314b
SHA51275478789be836c2d73ea844caeea68b2f2ebe0ed8d20d3c86991da263255b25fb669f56a28607cb803b53f159e6aae563944c9a48aae6d58b615c36d252da18a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5886c7803cc5241279a17e53d2508d6c0
SHA17afea78e324d9792d524f7d9068fbf069e957edf
SHA2564278e80ae1155e02ee861aa54d46d66aaea552d3545e0c283fb7b551002999a1
SHA51237220ca6e3267a48a6a0b7d83fdcdb100c0d5cda74c161d44b5ab6ec9c810a0ab4d5b211ef0ae82ece726836603e60975fc45a92d197b09c1cf82e6a3c299e7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef0751e9890366d26d2ac55d8dc94418
SHA1dbdd128e5ae418b94e0ec856d27fe1ebe3a8a018
SHA25608a971698b423ac14d2124ac4e39b0415fa1d7f35429062682cea22cf63ea970
SHA512e399f2ad58d275bf141d9d29e31645e248363cb79f48e89c6fb67d5df14177a73bfd46c82d652c0c745e8f71b76d1902641c1ccb93be00ece72e8fdbd7e2ba62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd7feb8a40764f5285dd617d7832cbdc
SHA159131c886fb8e1060521f4df010847798b998eb4
SHA256e728c6a72dccc574436c974aa0638c73aa3e0a622c563fda8b88226d03af9e2c
SHA51255c6fa62199bc13280511ccaedd9e3de35bd3d4b151c5db0f1144970b519bd64a689312c5cedecefe1d7bf2af70b532f5032b08e7ab8c33b8cd08a2cae99abe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1509d48b8cb1a965662f4e9ef831439
SHA18729498bc8139a5f43df49e4a18d23a2c116a545
SHA2566a9eae2a733ef26a092af21d1932cd5e86140e4e04fc48011155e4c875529d92
SHA512d96c9d129ffedbb6efde82eab3dfd07c9d083b660b1ca0c7262c392f453d8af8e6a77358cbe9e30427ecccdba662810e278357e786779a7bb5d36e7620373055
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df1b6bb6458c68f9d1656199f69c86c6
SHA1e736172e5348133bfdb9770a7039e83edc44ff4d
SHA2567d04a5b6456677e71af353e36028e2af3ca1f00bca0119c9a755f8120ee85e12
SHA512e6c2f08cd9187b71b8eeb9b7d85de7f03d66d131ada87a4211ebc84b0f152715c86782b4e25696120726deb20ceb046f9224b2cda4ac457063e8f04af43ca8f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f049e6b5469cc31ff17704d2df88d6cc
SHA16e4b4e512d3cc1f6ecc1805924a218aaa36e6743
SHA2561823730e350e5692f285e8b60c2c1a0655c0c1ecf6699289d3e6e0f8d347c268
SHA512773af5118d13fcbc600eb4edaa6d2e6c86bf67ad8e16b4e661526f7f9049d09aad71b9e4465804be635f4770bb941d009aa841bc2e5a3b291237fab38eeba747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52aa391a6eaeb5f85ef41f9dfbccb1ddb
SHA197964a4401ccc9991a9051412cc2d1b3b583d006
SHA25600e35f98edb5d7d6ac8f4f29355075ee294a9a09c7bc63f045857ce887e40ff7
SHA512f6f60e0da843b1c3e74cfb2b83d126a511328a24a67781ae39fb509018e436e7a3ee728e19145c64e11d4767a9280dba3e049bf269303c9896cab91a2ed7742b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509dddf6926627f3e7cbe318f0a5dac84
SHA1a5d507ea38f8155bd217d27f71534982708fa849
SHA256df4170e25c2d746f742e85e87f25157f555a43d221edc417f1d4e2ba331f3e89
SHA5123a3c8aa38191548b7c712b8653015f8127b70e4b96efc7324790fdc91c70cc41ad0886058c9367dd2546bf2ea143add4a965187746180ed66a13c8804041a467
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b