Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 23:53
Static task
static1
Behavioral task
behavioral1
Sample
07ef094b4da1c325f06d0c31d0f64f6b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
07ef094b4da1c325f06d0c31d0f64f6b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
07ef094b4da1c325f06d0c31d0f64f6b_JaffaCakes118.html
-
Size
2KB
-
MD5
07ef094b4da1c325f06d0c31d0f64f6b
-
SHA1
a7f70843b138e429abab804ac6cffdaaa99dbcb3
-
SHA256
5c3d1673a4fb869565fc9b5c43dc2a039e44f42fe67d2cb5fbbfa87ef4586a11
-
SHA512
02b4b89fbd59c5141152702529fd15d4090285289d5e303bdddb29a232d68823ab5d2f6d0dcdb6248475def8a9fa987b8ddcbdd8befe2ac7ab9dec7531dd95e3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000026c1c1909f0b19fbf9cc3feb4f9c084c05506a3f8bd05c112aa5882a21b45465000000000e8000000002000020000000744bb7a665a7d366c74748e7ea78c39c0b3a5c15ca237a368bea1af5f1d711dd900000004797f0a92baa6046c677730fbdd92a4e5b6925420a36e742f6de1e7ad7678f51f90a939d1067131e6efd68d62bb99fa00d79a474a6061feb947b9f9eebf79e3bfe80198d8b473e55d7fead993b0811bd822a21573893901d577a6af1efe38203fde70030c81520e295fcc2a28811addd9ac4f47302130b7277c99016ee09cd684d6b8b49817675e7a7a98acdd2a9437140000000b56b49a2e97c5a1148e6abdddda3680f34c4574a50e18baee3aa7f20221f050dad23aa7f3c4483d83b33a99902baf5bb41737b809812f93956f7febd28b915b2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54622D51-8050-11EF-8650-76B5B9884319} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d4ba2b5d14db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000002c20d6c876461ef3e999ffefbb661baa5014695ad0e26f2f59dec168e92186e1000000000e8000000002000020000000821473aad59c0e404358b9b587cdce95c7762a6b8a6682f5d20b4924e9c52de620000000b5257c464a7021a2ced5fec5aa29caea0761a3183a8d4ba577333bd86fe9a7b040000000c6e85c7adcd9fbeef6c00992e7dd8e24091b003544b83ac25a57c43bdc5c29ac6c846a32481c34186e5ee6245258d3abffc1e09e9f58a4366dd0b8f59f3fbd77 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433988665" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE 1720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1720 2360 iexplore.exe 30 PID 2360 wrote to memory of 1720 2360 iexplore.exe 30 PID 2360 wrote to memory of 1720 2360 iexplore.exe 30 PID 2360 wrote to memory of 1720 2360 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07ef094b4da1c325f06d0c31d0f64f6b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50647bc8f9006bce682b04672b99dd7ed
SHA14aeb74756b59ce4db185e1c88fc076c1b5913cfc
SHA2565d99253cd65ae5e2df7069ff2bf6f5a21532b57cd7382717c480dac7a765f4db
SHA512ab9d189bffb693adf622c2ef6ca71e7e81768c6ecf0882e639d9ad6feed9fc9515d0791e0c9c423b2d067f3d49da615227e4f125be38bd99c18fa5ee6126ba00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543f895578a1bc6b258cc3f992b3757be
SHA14904c2582b88e932c663fd55d84b2c7fc7508d0e
SHA256391cb0a32bde6f147056f2fa271183d8b56c19c1d68281d10eb668b6085df3ad
SHA512e0ff0ec37704e03d2f6193f43e4544916d62720cef1bf3aaee5308e9a764fd74b5db6dc6848495c057ee57ef007f167ff44d4d7c7188a20780c006ad0246ff5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fc6b3314bd51bf357c6b6fad7a6e8af
SHA1752951c22331a1180cb4f9be872b2562c13e0843
SHA25600a1454b3e82bf805c3ed9f9bf77a98efe521a53a88046149340731840f7fb98
SHA51226c4ad4bcf26c79e69a322d30f10c25193a1af693b102177af9638f8eed868274a2990674ae7e8c4edc8bf3a26676ed0bf4e7532e256ecb6337cc6e467a5e5fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5950d9ddf083f58fdf643c444fc8a1ee6
SHA15f38e406281822e00103f456c216436af2af457e
SHA2568687f826f079edc53da0c79a743c88ef4def6eb476ccefc122f3c49d531a130d
SHA512e76293f6e6d7e7093aa895a0fca5bfb2d3e7840bb9eea76231ddef5438c01fe2ed2a3284d56767113e53fe143daff97dc4d20215c4f6bd1e68246dc3ccdd2335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e887254962ba86571a45e0c21bec23d9
SHA162608ed483e194f30d6cc5d83edaa274c2a32e38
SHA256c3ff11b26e8b6457a3c09fd9f4747d56b6851c7048574904ad27a5145eac5c35
SHA512604beccf21df86370d6f6ec38ec74e2d9cc9572142a0a6709e6e91478ea2a3e0644f54eadcf9355d5ddd5c7628ab5e4f7e40e46b26ee38413eeb01802d96dd96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55551a977c0eb40935cd83c51d39b4cec
SHA1380a84a1c462d73bd68800fc1fa236c3c84b4c83
SHA2563d7d2ead271bd83d5d6a48643a250582d00d546464b990120aea25a50a3abcbf
SHA5124106d90e513e6c83f4abf635fe45b1cb58178551305390e31c8be819f90e581b56a12ccdcef92591eda0e1487500110ee835f853f4a3bc9b55df926de1724038
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed7fee88d47b14a155ae979ac5455e72
SHA141c3ab0a22739e8a022a8688ef0bb28501a2f049
SHA256af5805fd028b587875d9a4cfefec9a242c218ada4f94705eff0b11b7487b8fd8
SHA512ccf669ac4c417bb74ad739aee36d6bfcfa3a7b7315178360634926529ca4a31f034cdd797cbd281a636b42c8b612d23354b0836c083c639d24cc10a425bba773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f11ae8b6d341c49c66361fe382f9fecf
SHA1d3366aab6b955a850d1b79ad9a076010592d031d
SHA25624823efd5b8dcb588122762d71668e3c3bd360254bd821e15ea8b40c88275352
SHA5121826c17d9eaf7ae49b117086c197dda74788efc0ceb2c839e8028874937632f78f9408a12e6720d07750239ea1cd87569d8311e422fa53b0fc85d6aa5de11c24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ebffcf585ba226dadfd053f1cf3f5a8d
SHA16d212226f1534dfbd19e2f838a06b13ed5d35533
SHA25655d10bdcd78682fec826530e51cc1ddd872ec3f68f42384c8569dc44de125d35
SHA51237fb864d896feb5cc56a4a41542dc94faaa5ad48f70d682056d7b3861eeec8e1471711c9440aa8590e9b8bcaa0a569808784efd45da3a116ef72523359e24872
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506949eb8675263afccba909ca417348d
SHA1ca2138b020c3f656a8bc15a8f27a90d8cc13dd91
SHA256faba11ab20c39d44a79d29e0e4233459c2e82a4085a136de300d21a4d3018cd5
SHA5124f3ae468e5f695243ae81ca8ffbf3de22850a51b2e8b740db7f987d648b13cc5d75d3c927ad8eacc10c7e355895e5bc48d6922736847b6fbad493433ba204130
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520e819f5eecb5fe6d31c78fd8e2d18cc
SHA1eed2cf5978d7ca37be31a671e76074f78bbe82fd
SHA25681263d56be00cfb2771f5d0e0d87430fffc20ab46b415d04e902e64ba156b117
SHA512614190fa0a868072421802325e24d0a5ecaacd367fc4edab8e812ae419431f01741fdbdff40f76f8974e70918cffca5f9294fbbc1ec72126fb29c3912de2a4b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b87b52ba79258d42a7c91fa6409650a8
SHA1e8bec59bfd06461bdad2946d7ca4e865781ba9a3
SHA2568ecbdabaf5396633613814645a2131aaebc1b5821c6cb2028b504b5e2f303df7
SHA5122beb445060ab3033721799e6232c935e7565d7948e1d5c54ef0408d195b6aedcc6f1b30de03cc6ff561c70ad5541604f6b00e745e51565c85c734a5fc188550c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5165f36ff08d314f2ab366c5d30bdb6e6
SHA1cfdf4bb86dbd09918d6d968e10c9b6cfc8e399d5
SHA2560f09a13f72f94ac13deee91c42186a5776c9c3cedfe079bac480af159f9de03d
SHA512bf64cdb2cf88f88c725e100a01709bbe36bd76689b893cca025c0c280cd9c98801a125cff8de8ba95a1e768c251116e0dbc67863afff578fa54c5bf22ed0515e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8af236c2ef5d8a13d356d0ed4a64687
SHA12718d3f650d263907575048d8c70e88008afcc05
SHA256f8249434aa2e84b0b75a15c60ba709a9f7aae3b6076581288c433622259cf79d
SHA5128ce37407a01339c4685be0b6442a1f8eba95a5468d182ff57498b9797f4bc276a8fc4249bf9b428b1cdd36980cfd35ab22bb251f02bec5f18e3b8459da51c265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae73f0d96734e6a50db6ce195655ed04
SHA1212e5426ecf06f02bf96c56d5e2254bbe2409fe0
SHA256d0958edd89adaa28ab081168c08f8b7108a01e3709ce034aba7c4dcd43c15153
SHA51263d5ec5c9f3a2349ad714bf1391e2943c136857b25abeb8982ff944b8b5710e43e7062d6e56fb72f18ef52fe107fca50fd61b2607745744165c4da1742a386e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592c1a28b1159d9f6406357c0f627ec0b
SHA153dcc2808df0b97bf518da0fae9cc24ac3046bf7
SHA2561f632c6a339db139a7149fd532b467825fa22c3ede78c4c6333bfea205bc47b9
SHA5122548ec3d5b92f4b36f20d8ec7fade3faa9efbfb4969615a26d8847c8f18f1fac7487f34124c2af8debbf77b62f182063d68e17b35876d0a4e97ec4b085efa2e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e9de08adee80569df25318acc9aa47c
SHA1368a23e2d93d80bedb5bce72b6eec80c99ba27b1
SHA256c2ce5aa2d510130c41c9398b8cac0b7fd3cce9e31965b1a29892291340c2fca0
SHA512641b30767a032dd68dd92d07121469b657dddf14dd07d98d166b448851777e5f70cf1ca637210f18722e10f99447dc37a659ba3d04deb91d32d25069e9ab99a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537999fba8dcd2fdec7b7c6e697259625
SHA1d3698044224f022cf37316c10cbf9892fca7da75
SHA25647635cf18f59d91a6b99f66208636d5b8c2231a727001e1edcd1e0a7dff7aad3
SHA512f7b26d5ddf3427f4462d073ab9987c4d294e35aea0eafaa1a8b4309f1b031f44b373d5050e8da25b39052bea31bcde5fa06ff1b537dc9827fb50e66f6593a248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9ac2045a1e8f31ed852b88cd1f83802
SHA193e968ed0a62d7d6396fc3111be45b9157ca3d43
SHA25616a755a3c0a0c96d9194d57c32ecd6d0a45c3620809ea47420605de1819f32bb
SHA5129a52fc58d695dbae09f2c5d4da59771e074fed86ba8801c8d5bc371a28c12547e071834181b4241098f7cf75910bdb8741b84ee0ccf59f109c323e27fe02d809
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b