Analysis
-
max time kernel
66s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29-09-2024 14:56
Static task
static1
Behavioral task
behavioral1
Sample
fec3e08210637f8702c15e1f0dbc14b0_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fec3e08210637f8702c15e1f0dbc14b0_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fec3e08210637f8702c15e1f0dbc14b0_JaffaCakes118.html
-
Size
14KB
-
MD5
fec3e08210637f8702c15e1f0dbc14b0
-
SHA1
5b66b7738acc8869091f530d19f5205711ce0345
-
SHA256
998ef2b7a05300c4f8cc2167a91edb3edc67f1ea2bd52631bf05be2b3957af3f
-
SHA512
a335a63094b9bbcafb5ca5f9d62af91fa4e18220421be7d81a5bed7f124aab8b2b20cbaf32c2b1ad4c94e4cf6c447cee0de6266b9e9b0a964f03c80e8f1e4aa8
-
SSDEEP
384:WRAZfibImkgX7nTo0eIUjQewmXmT46wxmkfK/ExQw5R:lK9kc3CQewmXmU6wxmyQw5R
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000099d057ba866f5aea6f46a8035494b3d58e05347db09e3087cb536801da269f1b000000000e80000000020000200000001f788e2fe06d24a96a3626234b954db44b5b53c9149b69610f5767efa57397ab90000000634a3a85fded32b28cb4ab88473c05e946a88087dab08186d2b4a1a969b217228399a46d52498cc65d3a81ae34464e1f35a0fb9df20fa9d5971bfa74363f0c57ffc1e42c42f8fa960d83577294aff3761812bdba31be7a39fa88bca321bce30d772c0fdb09a57aa0c4cc6ca7e7862504e101b9d438e6969688df3e867c797dd04bcf00e83245f176fb6a62954f7c99624000000057e25303f13b2fe24d07eb9d2e5aaddb651b8305ef7de39738b76e98451c108b5e6d72a7541fac299e177b70077a30f3a6c5d5dd5a730e24b7f2a7f212858893 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606503cd7f12db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8899381-7E72-11EF-9AE5-CA26F3F7E98A} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433783640" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000baef76078eaecea99feb447907f6a4c2ce0d9c819cd7d627f7c5642a47a75df7000000000e8000000002000020000000c5552f19cad2a0d5da104ff34623134b591177237473f286e1e221d9eeae92cc2000000010bd79c48b19a9ba13d4c96b3b6b178b7dca5ec491d0426cd0e6b1d1e0622f6740000000c8c2f08626160233d08edfd5052a26a8e7e7b9558e825bd6b084d7d6c09c4bdcca50200556f5b3fb3e1bd1828c45154da249be21a7db3b42f24b8e8a9ce965f3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1736 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1736 iexplore.exe 1736 iexplore.exe 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2132 1736 iexplore.exe 30 PID 1736 wrote to memory of 2132 1736 iexplore.exe 30 PID 1736 wrote to memory of 2132 1736 iexplore.exe 30 PID 1736 wrote to memory of 2132 1736 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fec3e08210637f8702c15e1f0dbc14b0_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec11f09061b3de0ea9045f9ddc918722
SHA107fa8b7f994bb1879edcb6ffb559ebba506b06cf
SHA2564379cb8e3a067a04d07b7323408cbeea3d867f28e52734df38ded7f409a27b46
SHA5128295a036c3e422a669db031e2a960433e32fe913d9f1fe805b210ea134e822ef0f332c84390bfc54883ad63ce96626ff7636e9b4b80e379cc292ce32d50be8f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5472d544960fa23d07871401c1eccad15
SHA1a222a65fe7389b2fc16085536b07cb67d95dca8a
SHA256d544619ae24bcec90cef3b21f6cfb271cede41fb8c2782e95d7bdb9119570e55
SHA512e8483cc2c5a2b90ac56e00da259cd1f242d3490c1b94d3341be9c7fe3830f9e2b17f78580cc674de3872be841284a976bfa6ecb9c31253635808ccd04b631d7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2b7d83070bef6c183fd09476d91c92b
SHA12d8e01a186d37c91e887adea31ec8b26b42339ec
SHA2566f88716a243535f9887384b06fc6aca5aa60450e80266f0754f953c3a0948ea8
SHA512ae68fa98a282d5ef2922532a8e944ac480758424b83df3c2e81805b33dfa541858f06de34e154f02ef774159a2561bb614b8230d6fc11f23f7067beef135ee29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d4d6d469433e6cdcffc71ad9369ace6a
SHA10a823e14b4b612876a655454c4b1c8b977bc5b8e
SHA25624d6eddd58718374e5fb6b9b559ad8a75a4a0a02a616eef286bd1b7344e3a936
SHA51241a9b10fa60c6d6b12493e9f38010c7dc8bafd676d2598ef5e4376f377e2bcf2fb2c02ba5ba843e6e21641ce315fdeaefe48ae5e49f66ad8d87ff20dd79e7ee1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ff3034ae56df27a082f9539ba83d9ec
SHA106351757331a1426854c956579cce238e3981c8e
SHA25613e8e03e4734b9536245dbeeea40b3732c4871f9d775ca37d2b76a65a4f40b06
SHA51230c9612f646bfb568088f3d901e3765ecbb36bffb108dbc6c4ca06845a2a7dfa277be3efdd0c50ecb56cdd3402c8770f12d22d953bcc58c0cf542ccaa39c4fed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b0973de44f4b92a9188efef03e44cc5f
SHA1cc2ecdb5688e02bf752eb0d8421fc17f150b914f
SHA256901697b8dafa75bdb00e244a09a8c3ba457db9063a9dfac60d6ad6fc09bc252c
SHA5128cad1d0ef09cb85cbea0a171fe4be30980e0b6e9d1136c261972cd9a4c339207324fbccb4e2c16f42484742a6035b936ace82cc4469960cebb39eb2e3e7f9016
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5259315fb31ade887fa6a3f85ec4823b4
SHA1b6cac6e7be71dba679af4c7d9319a47fe1e7aa27
SHA2564b19fb89d880a2970f5f557cdc66031e8c57eddc3915a3065beaff9825526779
SHA512885c2244891cdc0f99804de316737855ef54520129e59cd1d5ab1e1ceb85c96919cf693908e8a7090aab7e2900cda64fa8b7cf84b79f080e5a3f84052466dff1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54790e4582f474772a7a45db2bdf8e492
SHA17c3331811a68b3abcb4c3e4232012fb52c27bd66
SHA2568998bb9d86385dc2b8bf3d77398d9694973bd6de5ef2e1ada9dc715516cc2659
SHA51238a6a922912c8a636333d77ecabb5348050aa0c9d725d946d971b35288960b608dca9b316e3554256b22d616bf22c241e7dbe544c93237eeb93d4a7f5822a86b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2c28c4d5b237540f07d7c0e20c64cd5
SHA1c8118653d674ecf0812a21bedcd70b478d56d36d
SHA25698f79da63a32ee9914be78fe9d3f7e6c5a9bd433d1e64f61634d92af63f59493
SHA51218ac8a9bf4f650de75e336a4b09a631fd0838202054ccdbb93bcc1eeed31e422c49fac0068c97478305c7ef64a6d3c6a8f1bafeaaf4c8a26d1efc7aded4b241e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fef9c8ebf84c28531488a1e7c924f2ae
SHA1e0a5eec660d0bcf84de0a97c511056945cc6b0c0
SHA2563314961d8712e6202c1abf4f33005556d78c1b049bea2344d86b7d457666402a
SHA512d82a002ee629e1d29cdea71bac4a2465aeaa1733036da5201be43f9eda822bafbeaf9d1e4c892eaa5fb9929122def8d1b8a87b4f054aa6fcd54a4c9179e56ec5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c6b504f2f5f4f6edd7fec29131d4d7f
SHA1ae5f03e2e6b83ecfae7e3e6848f4494cf2fbde28
SHA2566fb5799c34ee83b0546e6837818081117b8cd6880eef6f138b855216ba0f924c
SHA51277a690fb64ae4021eeaf4d9420f2e60fd11a1d24fe83b9df4defa742bb79480a1d83b689edb1d7790b9caf7158d444878160ebb7c00f66d36d29676cac9d82f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580f771feee5d7cdbc0e4b0b2c00655d4
SHA17d9b19f9aa9111958b00a602f068274470689abf
SHA256cce1fd1fbf5e21ed62b0d8f67db0ce0a6a6831dfdba29ba1a0c74f03829b21fa
SHA5124dfe260eb5fc546b454107082d0101b25c9df24711dc5c742e827be2b63fb09904abbb1d57138b5a50533dc5e31e1c4b0c9c625a95c44f8834a1469597e97291
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0c4651e5db3e50d9cdb6d4c02a98e5d
SHA180b4cc287a66cf44248e78d1d996657c2e37a8d1
SHA2563869c123e9b803c8c0aaa0e812188e29a3c07e8cc1903297eadc1a85504a2754
SHA51210934c27a592d75de5945dbe9e6f9f1accae6c844dd0037c497bc37c1025aa5b3860a81089c7bdd7707a3be5562956606b90317d02aabbe383ed216f65f40c80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9f26cf8b6af3b826fe77b167df6220c
SHA1817ae609c0f5fefe16d4c4816e414e60feeebc1b
SHA256769f71780a4d1cd0f969f7e07db090225608f7163b41804faa4cad13d2d3fedb
SHA5129b26ba90999f332cedefac791344e8fbd1f5dbeec962ca38cd39ef827ff8e89ab37ac3d433ea916d3bd9ead055a8de09741e6dd6a93abfddbc496a54e53881ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f22f9c42a363184bc731e99cebe48624
SHA110840e931157d424a3e44a51e7128ab29c24080d
SHA2566556dd4d7830c821dc60c87c1e3263760df13e8ce1ab894c46b04d51a0d1995b
SHA51217023519dd4c1443bde36743d0a1f43412ea0f39abe3fed73b9b10348ff37be75c5a95e029ed479c8d101b9b3c5dffa22e3aab90d21ae6dd73945861277fe65b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5307e8c848dd5712e50a349b80fa5c3d2
SHA17f0b025187141ae8401783dbbe078f5bf009f807
SHA25625882c8e566e44b15993723f3f367401722192e5d8e206fa5bc451129481583e
SHA51281cc0f53e65a1a8d5195e3d1a93a80bc9acfbc21b050f534a1a25f32087968f3f257a83215ee9e19584089c5b5c165679ca3739bd92f4cc23b737c4fa0e5ef04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59495ddbb340db82265db99720db173c1
SHA1e4a9a7717db2c9fc4c176f64cdb8aa912b118010
SHA256729822a0857ed6f180d4da7ecd4cb8ad2009ce3b228a330f4520c7b07cf69500
SHA5128ce472ceb4d6077f85e562fc0b5daf18dadb2118cc9db77961f7cec05e3f8a2d044c131df131fd32713bb286220ac3a83205e2320f3b4c8a7ec13bb65008952d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b