Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
04e261fae8a5ee1f55008891a75f0909_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
04e261fae8a5ee1f55008891a75f0909_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
04e261fae8a5ee1f55008891a75f0909_JaffaCakes118.html
-
Size
10KB
-
MD5
04e261fae8a5ee1f55008891a75f0909
-
SHA1
99a9d1049cd632b6784523fc5c4c2a46b07fbae7
-
SHA256
abf45224cb7960e1e331d147e74b39ca4b7328b6c5a33853488c24c46697257a
-
SHA512
f9864fafd1b861e23a83877d56a08af9329b35f9015c221da5f4a0538bf95e1a075a1ddaa090abc96d9d836ee855eb66f6da19d3baf408105f8f69ca7db1bf40
-
SSDEEP
192:DDthd2tIrRD6kVlk1kd+TN92+8sTwd8LhBwJUHwKLmEwakpBSg:DJzdybxVhHwOHwKLmEwa8Sg
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000007988fce1c5a2f5a030f3c9c483181077e868e2b9d11b614b931b1f232b1765f2000000000e80000000020000200000005eddff430345ed02f07bd065d9ef1ec7aaae2d5d9ac7e5e500151fb49c0056a6200000000a269f756619978344247a8ea6c786e5013c30d1f251a07ad1aa068b4fd69e564000000029820aca58cb705d3a4c3fc4e34f90ae2c3df6b1cad1f918a72e2890c11c0c4132f34a7fe5a85c2455ef7b4cb5f5c921c7f837b7942f5d7eff7f7c0fdcc2a7ee iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000006123703a1282135e700ce0d4228e390535da53d090a52f5cdcfd175129a3b7ae000000000e80000000020000200000007147c7be0bde0118a3cb3f1f84561b22ee06eb53822aefbe209e50030382d31490000000104e7160bd81fe04d2899b83e015a8a6f1b2ff435f4a2f57cfa7e00595f1fe12138349976fecb3057a839fb01bc94a58a537c3887dea3d7109995ddbadb54c0f0691e4cbe4deb79c7e890a5f8062a3fcb38bf551f5581eacb8f96171abe40f66386e1161f85b62f6909ddf00fa9e595cee2be076f5e3c0f10d811fe4f4a1810b46bf69c2654fcc671494eddc342ea97f40000000cd5848ec0e2f3dad7412f5cc7fad3228f972f189fa99d27f0f2d549bfd2726d9565db95e6f0c740818800e77c14348b6c7e13756d78b395bd20ef8094a2b47f9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE42D151-7FC7-11EF-848B-7694D31B45CA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303950e0d413db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433930113" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2300 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2300 iexplore.exe 2300 iexplore.exe 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2948 2300 iexplore.exe 30 PID 2300 wrote to memory of 2948 2300 iexplore.exe 30 PID 2300 wrote to memory of 2948 2300 iexplore.exe 30 PID 2300 wrote to memory of 2948 2300 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04e261fae8a5ee1f55008891a75f0909_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5464a6ed4621e5d832a05fea2c692c49e
SHA1f06ff6685136af0d368f8de28e115a96ad336889
SHA256be0e82449c259517eaa8cc36807ca36389a0220fd34656f1835575179e8ea9e1
SHA512e2a03bbf0196b03c2318420900d9b677580ec31dbf857cc8ad68365db9ac4a72d4ee3e8ee824079c79b2afdcf40ed6c7997d2c6769474366873e968236d58bc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5641c5844d409c645e17c623ec76c1c6a
SHA16db51ab2496ba42722af30b03d414e6b158d928c
SHA2565ea8edf2979984ed3e52e43969606a80a7ecbbe97d3cf81d4c56508cd7118d0f
SHA512c6a18ae7e37fa13948c5054ee0cd34d017db1a04d548d4561485358f174eb63f5aa54a5fc31e714b6b417b2029d688328581c574d1a864b0f282ba05214fc58b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52840e7786458e8157b95f42075bf08d9
SHA1649ef8afa22ef0b8695f0e17610b507cdfae8c9e
SHA2567c970f0043a8d9b669aacdddb1c76853c2c4a2a3b08c67a6655378632af79d74
SHA512cd3884c1da0deda75b9e02934ca9fb3ffac94be0d90e9ec63e06ff8a591433d2b2fbcbde583bd64f4602b75706d4ab16d68191ac345c2b15bc7d59e7fe84b20c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577c6afbe828b13ea52079c7df36e430a
SHA1cdf2c5b0157fb123e7c604473fe1cd62ef1c77d8
SHA25665ce46154bdae825f0b9332a04d188ae8a21226a4d2d264eaa2a5bc2fd20a621
SHA5129e93ad6bb404b2aa67525b7b39c0373fe7021f1dd35b3b10bbe79f9ca046d3f7c774e4f982f953b3c826726917e9e92cfe4dc7ce182e42ea0edcd056b61510c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57155ee0ca68aac1be8cf11ffe86ba147
SHA1ea6b8fac2383905b213eda05db3d938b7bb0eb68
SHA256f5b0616806a749041e5fcfbcee259300cee2acb7b4d0c5888ea5a3dba0b8597f
SHA512278de388e69882cfdf1f5293a27e7b9052c365ae62f340be94b035e737679572cd08cb560d83897ade865d6efbb6bea172c7428ac219d3e504ab0efa1c599a6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524a56a1bcd16805981cf0c1d62550ca7
SHA114cad0d3a7c400c9c0e68cd36cf8405f4f3b4b6f
SHA256252cbd264b52b13078f74401c95db2aba803c3effe176ca32e4aa613f6184622
SHA51289ccb996985e75460308d40ed08a91b35a0dbc4ae5b95e8850c3188fbd6577b67547064ba74467d0e1a889b14286f33d16e2cd4a21da5472c005031e5cc88975
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57043ee42498d3b23527e59ecbf7c2026
SHA1511c1b45f44b361a28a4e8a5e0ed2a3b4dbf5b3a
SHA2568d007556f11766e374ba84de199216b3029f8966a0b799cd2d0acd9279a1c1bd
SHA51207daa2e8a94938c09648e1c424d930df3ecc195135d6651b260616102727270882373e2c152fe9d85896af273c8065e479b819e8b68dcaeccbb116329fe1bb4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9afbc4b2e0ad967a41ae5001c75945e
SHA15ca8c1216aac9f5418f751657c6a42e671e038db
SHA256693b1252cc37c6de999f684d109a81082cd0b77e9a52936982737832e35fd126
SHA512812c0887739b1f8c85571880a22460e5e749bfa72a21b6a0697d385d45a0a9e3e2852c4854b1488b4e35756ee6ebf97c6506efd4bccd8c321e01f41562944cb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad7182e15ca4e92b9a510e02e453e9cd
SHA117ef2b6999ed44b783d3785fda2cad88e1dd8d21
SHA256e9c8951bf8673bca170930b62c8d0a80e6adca6b8602c9effa612d22fddb8056
SHA512b725bb94540341e92c11576666f91bfec5b516b11bc4f8ccb82fb7cfa9d3031fe12cab65bd1e3884af75fe0cc0e408c375d2083d3a530a189e7fa289bbf4be22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0811f98138b824b84da9d142df72a05
SHA1117c34f56f086e0bf1af73cbf59f59358a8a1fa4
SHA256ae9276adcf30030c218030c03e60251a04240407d3aa1b372c88e6c756284ade
SHA51219f799124ff80eb7fd25ca0d3f0f4c2cd8bb936a10fd5a8b3a70e6b073d171b60e273136067848b4a35e0f45db1e139e4a740ea6dcf8a36093cf9a10c11eec16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bfadab50fadaf15a4bd8c070bd78552
SHA1a43e1cf105aba2ca70933ea8390b43a7926e8ca1
SHA256b0be6963dc3cc4b65b30d7a380ea534bdfdebbf4ea92830a672f6aa2a2e14198
SHA5125925932879e23b0eb01495da123fcf4a07bdc76fefda2d0fcbbedaef07e2e73ade6b6bf9fc46c1aa4bef73c9dd19a5aca443becf7d4d33f8d643361b888d7c1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc3dd8242671f40147da59c631062c29
SHA10b762c2965185d8dd3979f36b8e1b0dca12b794a
SHA256f39a091580a4a9a81c1ea00d46382ec061afae57b8978da8a055da73062dcb19
SHA51218f174a47c1267bb7890930d899a996c47469c2875b705f7ded51b32b9c16972d517ad8543065cd45a2e87d4ea6d16bbc19a499653dc264f08c9465e9bf6565a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b