Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-10-2024 06:15
Static task
static1
Behavioral task
behavioral1
Sample
04a80b0d15662daa981dfddf1d9dcbd5_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
04a80b0d15662daa981dfddf1d9dcbd5_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
04a80b0d15662daa981dfddf1d9dcbd5_JaffaCakes118.html
-
Size
6KB
-
MD5
04a80b0d15662daa981dfddf1d9dcbd5
-
SHA1
643faa3f797589322c1ad0d41d80159dfec46bda
-
SHA256
66b2cd0b2609b4ec4fbe78646c5527abe76ccfb94779e9f57b2df7fa47dafa23
-
SHA512
e0e8be589e7f4faede9d2085cf777aa34b1b69f17be28980762d2fc9514990f52f398658f2e5a98a17bdbdbb0df7e44ea405b18658fa909d4c7bc2b75c647b6e
-
SSDEEP
96:uzVs+ux7QtLLY1k9o84d12ef7CSTU3ZcEZ7ru7f:csz7QtAYS/ib76f
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000001915818f06b2c9c0ff4f5627f6acbd9b3db28f5f0c6e139f08bfde355533a4cb000000000e8000000002000020000000d5ebe4cb425868363dfeb7108abec3674c6ea5fba0a0b3e38bfbff5f15774c9090000000860b5c6ca755fe89573b31686141e00c7b452480ca325f5e3015b59db5d009c7b3b58a8885ca9a31f938d82cc8f3b652aabd8194bdb2656e9d1797e7796356dc30fdbbe66a7be7f754ebb9183fd072c3fa4ec1dba4ff38ecf0ee93a16a48993447157add34eb30734fafd6a0a3dcb9f2895f3b7707c983df524534aa9b6ccdc7a62b8cf76e121e7e7ffde0e3ba6b72b340000000ed392468117a087f570dc34a7fe5d42ba020a287a3b179b78b94aaf45d06b1f04d9d9a9f163868f61b9b5a1fc236eafb7c6cf1d112047e10e35336fa7bde6a11 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433925180" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b2a558c913db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{830D4981-7FBC-11EF-9E99-E699F793024F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000b9e0540571055d1cddf952ce82b8cc6ee7d10c16b03d458f8a227d75f8426325000000000e80000000020000200000007e3856726ac99eb32010eee6983d146262a91e83b1a540d6e60931fde49740f520000000509b8aa0daa74962ec48b8b5c73b95819317d767420f8139f2addc792e87abf0400000001c6642c56612a4928587ba117c39a46c01727d78acdd39ae3793e48f1d1f95cc5acd0dc5f68fa3e4168f3644ea9074c03ba920bc359cfc4e9a22ab2b33dcb09b iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2260 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2260 iexplore.exe 2260 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2260 wrote to memory of 3064 2260 iexplore.exe 29 PID 2260 wrote to memory of 3064 2260 iexplore.exe 29 PID 2260 wrote to memory of 3064 2260 iexplore.exe 29 PID 2260 wrote to memory of 3064 2260 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04a80b0d15662daa981dfddf1d9dcbd5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa40fdc55c189d37fdaa70ef7702baf4
SHA16264288a0b5d2ad9a4070cce16b8e2dab5b781ef
SHA256479fdabb9603b331ce76a62a3810ad011e9dab682d7b3b48d94b2f8a4ea8fe07
SHA512d1db3443bebbf148b963652e840976abe2f2e234fc3cbfa9f01e81553aefa4c72cf1087551ef3cab9063d5c55181d04558a83f00db6b1b0ca83f6aebe16fc477
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54da4d8c71e22a5c3e99f0192e8cd74a3
SHA13789d05232f6b5fccee2ce433d78ec79517c4892
SHA25653acff54bc3bbbca5d1a5bcb1f3d1179ba8ea7c75ce63314e641cf81434513f6
SHA512319fc31c924600caf6475230b02cd9de6e90d33ced9283e355d8365324b512b9481e842dd6a9da15116c5dc4d9d438d03f6093a6c6d88b2b09f186e3db959ec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504d9d3b7d2077ef75755a030970e619d
SHA1af723b8e3eab082009ed4fd8bbdeaf25ca6ba7c3
SHA2562188a6d02de96e052aab469ab645217559d5b9787e007abce1a0b8636bec6e38
SHA512fed0d216966feb0a46e1c33457d29c4e83815a35f13e640a96c1b3797dde8cc50f52224b8cc780b7a131a93cdc7a5ae647128d6c9f851c61d068b5204c32aed1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce5bee0bdfe1932c580eb947cf6fafac
SHA1507b5259cffe4e5726aecd8ac69f286f6b360123
SHA2568d1581455130c6dc986d7d9b8751f258df3bceb1a89a87660c69b370fc36fe06
SHA51226da5de1b81b469d6d5788e751530880e4dfb96fb188af028cf01933336ece7937af442fc1d24d249a711b06f27875b956af8098162788c06bc71986688b1623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cec0c5024a4aff0854161e21e918a0c
SHA179cf0ec4e4c7a08a7be92da5a526e34182c777ed
SHA256dc0321a70d45a15270e98413af693e5322b27e91ff471c3ffbd772656cc9aa01
SHA5128c6fe3d5ca9dde97cab6cd9786f5a703496d2df9c9139b8e99226efe7574974eff5aaa575a6c178db8eb0d49581afbb96eac280659d068738d5f9ae44c4f15ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503e90fa27edf2cc6ce0d7eb665825bd5
SHA15cb4cec21d17319b9823bd9b95c231dac8c80121
SHA25633dac8d09750c377a6ee97b5e9e2232ad3984c2c570db551ac45b46c25f44335
SHA51275f390d88ba63245e15d8338b5c6e09cb12f97c5cc4bc983b512f32920981e2018e28aee8b458d8ba2f8ad01d698ec1f15bb46b4baf8cc41799d5b79c01d331c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bb47fbb1443ea6c1e2b2ce9a19b0429
SHA15363c26ef67e6cf1adda64522405b74bacc92d0b
SHA256ab62c78a1108a020ff81312e4eabf547566e4b89ad2ba8ad72a6064ad876b794
SHA512e862a62ba9e4099838dd95d83a5bdd3dca274d98c403d3e4e5f6c83b4917ae899cde10c2eec6f9d7e6ae1ce3c9b5a0b81b83a38d29ad9189766006bc932600c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583d6df24dce0d787d35e4e596c49ee78
SHA156169f659c52dd438b6f160e7cf92074675f9859
SHA256bf50d857fc7593db0222824b6f2bb8364b286f71d25e575cc49a5ab4986d1bd6
SHA512de3e2fc031c9fad1bd1e0daab98079614a1d9fc27079f2ade78ad4c967d53d859b6873adc80d720e311ae44ea95eb89e9cfdbde5fe7967ca7a149fb9a3d25a36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0399dc9dbaca96adedea6f6c692f53d
SHA1b93d0826bc38491792b83002ee34127c3c6aa31d
SHA25621f2e06a51bd88c0085548f064ae69a91d78f38056ddb71c447c31a99bb67ad9
SHA512177d72d9643391205f9fbf032089f8887492e7cec0d902dbef356fc41de932d7ad136383777967e08b862bc53a2c355e41299dd0cc8587f9bd2051f555a240e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d21fd55d85ce71e4719e8c0c461fcd5f
SHA1db32193f9ab8b8cb73197a64aec8593a7cc18659
SHA256f329351ca69c7a2736f7995ab327dd3e64520259e0326635ae6adc1994ea8a1d
SHA512a4fb288936295fd4a584a6a330d17125deb14481ff4dfbf7a5b4e76917ae0a6259955522baed2487980899528af3e0aebef63f377a8339b6f34f5bcb8e80f96f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a931fb8f5059ab11354cdf770a4e5aef
SHA1cbda4f9c39ff31778488e4277cf1ab04be817427
SHA256fd40380dc343a5b79aa2f624419980a4a35cc1f81f5e2936067b6fcf80ffba79
SHA51214d70a839b0e772c8de8567e70844e3f4e534fc6083acfb586b199ef11f394150082ab2d9a8569c4c8129a371e4180a69019b10a69da1f270eb5500a56c1bcf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD556fd0153b1d45fed77fb7274cb12e7cb
SHA15350ae5e8e3bee8c74e7dcc6083aa802a714479e
SHA256b7f08d389bed1c9a2b61be57d1b71c633268cef5b1676c5f6d6e38e7c0b8a82b
SHA512938691875523415361ac3a39c60e2259db4933575796e51cad1175ef1fb95bd58c35f9810548e5638467bd09ad8626b3f7bc060b84ed0ef8f40eaa849c00927f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503256bd06390e8b34586b74e99aeea5c
SHA1152083599cf49c31974c98c1399e18695adbefe6
SHA256cc56686d9341ea48fb9809c002287ba89860ed7321a025096f95e46405d85aaf
SHA5120ad2405f8d7638c1755818be19891849d61fe8dd197f7415a7e7a7769f20059f6e37c66cdcd82f956c1ef067da1dcc3af6bbb8c377ff2d55be860148367859cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50313a1012ef568e706296c21c25a226e
SHA17995c59c36821ecc0845aaf6fbd51e7346e91233
SHA256dc025c632c2483ae8f82c359aeb7cb59ac88588e45fbdfe3b065f4bd269fea44
SHA512965feea3331ef5def192fa318b48fe3b299d87805a1a2dc662e9ca90d0227f56ffca86b48aa832e04f3dbbdf1d93c4d07a84d5e20315ac2d69df2cf32f720000
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b8d80fc3902e2a1812250793d1ba482
SHA1294811af70e6c84555998213b0fc83af07c9374c
SHA256a053a0e1a1f534e47ea8553dfc039e98bb63f997a95bea6343c33578a48f1d59
SHA51251d815c1b85fd5de9a5789a69b9c0731b7969e37b28e5d256653f3fd3ca931cce13afde09acbf704f48cdeca59e93a41867a3f3e9c8b6e279b5cb982f99bfa9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ec407dd6e0da229ea43ab9dbae2208c
SHA19a8654d8060b3364dacda345a200b29e5490ad33
SHA25648e882283c44019b68c453d482a1f0aa2cc0cca9c6c714666a2116d5b89f2546
SHA512a27e5a9142de6380ed99e7750204bb0383e348d4f35538fc6d72497aa8410a3bc8859e365d3f46fbdae60e4036b11a6caab417440bd2788dfdb2e66596660fae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2307480acd7744525bf45cb126e6d99
SHA1ee0e5d64170be8778e715bcfab703af469c7bd4f
SHA2565ce9cfa210f00a7f2d43d9e7defc8ae955b01720ae82d09c75658bf16a1cfdc0
SHA5125864e3eb95f3584a93851ea76a3517702922829fb056ef8e1e177350de8fbbc4bc388515c68cd4b359cfc7fb5ae8027b2d887f8d6ac78ac7e254e332811d86c7
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b