Analysis
-
max time kernel
133s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
15aac7667c29318bb8da5c42740f5895_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
15aac7667c29318bb8da5c42740f5895_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
15aac7667c29318bb8da5c42740f5895_JaffaCakes118.html
-
Size
10KB
-
MD5
15aac7667c29318bb8da5c42740f5895
-
SHA1
1ca2b83d34e126ef8e86c3c6a22d1c3c23e1990c
-
SHA256
7c10f8459939d9dae1c9f088fa009d1c4e400d7dceb4c6f234d1fd01964e19e5
-
SHA512
8a25ac3980171ec6b236c55a493c81bfe877c51caa0259d5af5dade80ccdd62d8afa4a8e12cf46282fd2799ea6c9e3757695248140b4f8ed063a1f6455b449a7
-
SSDEEP
192:2VmclIsr03in8k/w1whqJk1bBlDrnoFzwr01y5uBuLbdU8d:smclIcuiB/g6bBlDrnoFzwr0y5guLZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434254177" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a89f7dc716db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000d604b184dbb611fd363fb2fdbdd9c81c7ecb26ab60fb1694111757df555b82ec000000000e8000000002000020000000e6e8db3e34780b0662a20b03e538eeaa5c7581705151be7fa9e26d009bea93e320000000460ae0bbb8e6c8eca9bad60daa0324b7d687c5dc1b33bc7b1f159de619a846cf4000000063e93fb3be3f37fc5312d144edcb9f6fff9b3cf3066104f5359c796b084b61a1ac105d643bbd913bafadd00137de5e4ebdefcbce02b6ec947c74a326c0a72f07 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000664557948df6fa680bb081783e07b9fab21633f5b160b42918e890691f101ad9000000000e80000000020000200000000cec8edd9e239025ee94819adcf7e12170f0f8894319a0f02ff9bd94a89adea4900000006ee9559cc591293f1031c466fca359c67ffe3de3ce9e91ecc8a7d635d0cbdcca79818f05bb0dffc0c8e8c98ec961cf3460b573862e2f8f55b98d57516d8b2d1122c5128e5c0676a7a7b5231b9b15c48c53d6ac69a976794cee99b7576e3b2d499246eb0c38c5b1ddb4bcc1608ebe01c7d9c6532b1ea57e1c9210287a3d0460b703561cb4985f334364d40c4f13e5e92a40000000fa7f395f35ef7f2f86747cf33fba0333c4a9abce436f43adad0f4f850b72b3a5c7cc5aadb627461326448906e58fe5eadc253bbea3935a4cfc2dec5debc59a67 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{867FA941-82BA-11EF-97FC-EA7747D117E6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 816 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 816 iexplore.exe 816 iexplore.exe 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 816 wrote to memory of 2764 816 iexplore.exe 31 PID 816 wrote to memory of 2764 816 iexplore.exe 31 PID 816 wrote to memory of 2764 816 iexplore.exe 31 PID 816 wrote to memory of 2764 816 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15aac7667c29318bb8da5c42740f5895_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:816 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598de6012ec350ee4836e932a6e11dbb4
SHA1e947c44b01a1f531443bf0e864c9a2c9fec6bf80
SHA256866adc0b92f2e3b9dbd7fa5f584ad5832ddd09351f68e3f124723707db4c5f57
SHA512d981a98ee397ba9cd680ae32333d6859dafa852b2a833096d3cf9af7f2cbf230155fbe1276111fc4336978248ee1ba4437856634527c46de86cc13302e30643d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57cea89f03eae2fe65cdb13e2e64c56b7
SHA1fbcda9d4f299d96e4dabbe9af3f6b1c4c8c34bc3
SHA256bc3661cb35f7e72627da017fe9be4c0f2f692bbdf600d227169fdc8a49696d9c
SHA512730505a1169e064153f5754a24cec6561006d79fe833de6594a25d9971de6370460f9cd582c04896f864d209d2f824f6c68a4f44b36b3468be98ebdad9aae870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581e509a0bceda6fa90dc507c4bddba38
SHA19fd77cb64c79645c308708eded7c58bd263eb2b3
SHA256a34a8b5ec19cc3001114135dcf8989aa2421bc626695dabbba132dc9a86e3064
SHA51260271e0c7ecc9613632506e27f80497eb7fdc5889da73dd66523df439fd16715f6ace87be731e6c147eaa636fefd5f7575331f61e42ed93f7d056dfb9e15a657
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a49ef38a17d8bb4ca35a678a2bea6693
SHA1bc426162e30d216b9240fbf0c9286c2fc70452c4
SHA2566233f0f7f4e04155bd843bc02a0d4d6179887fd5109bee5098d809c5f2b3e60d
SHA512d3e0393073c145dbceda90b463cc66de139dc4d9db82990ef2011148f6975c2323e0616b41bc434c9c5ceca17ad1bcad3b199c055fc3d37706e78f199bab183c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a003ed8194d1a2eb271fc4fcd75ec57e
SHA1b4219eaf4581d17f1c8ca02a1b5d836f70691893
SHA25679775a7ba29773fa666cb65b3a4ac312301d1a33c18d7dddd7ace37086d33b9c
SHA512542ad5f3372e7558d2488726b60747b583f3ff73e6f16e70c73a9350812925a34c763c3c33225b99d9ca3fae7b9cd0aa000c821ed18b2eb6605949d021c51420
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55da76d7abd40e44e5a5b04feb647db7c
SHA15dfd640848f68513f9e572616009ab081ffd5c0d
SHA25622ed715ceab5905b9d766362eff1d03610ee884a0ecfd8ed741ac7ef37c288ec
SHA512d2f7a65a4f892586b72a5eb07dc3f369483e3e7ae0e7dc38e02d6cb6cdebe9291a847a73ff9918dedaa10ce3dd2f1fd4cbd7ba4dcfc19517193431d9de33f3ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eaf570ff21776cc72718ad82d0cbf2a9
SHA10ae15a31aba7d70007fb0d368270c5395a708b38
SHA256435385daa7a618c5ac8a8cb80d51eaf378925983b4c2642d864d524e6baeaa13
SHA512e0b812ff2179560e7b1c6638307978c79809bb1e1d167a3b4a8d7d53b020500e0c546d31d2375306c746cf2dfef6ab0682e99b6dc3253db1b221f7b3596ec569
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518fd081779a5f95942b89885fe28ac9e
SHA1769e8c50b26ee0068041fe9f484f2a95f7bbabcc
SHA256bb0e25578a86e2a373ebd4998c8b2fe62e5ff52919bdc4cc4b45ddf4206e3ac5
SHA51211dfb96cd8bb9f0b03baad7e5d5e172677a12b75e810b96044c7b521fd4263f234c17efb32cbe35edca8b06b7366dd95b636f1a1d2d980637391ec42da716b0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579ea72f1b5b498fdbf39fc0b7a030a26
SHA1fc10d8b056603a55e5f09ea98e2297e38ccab2f8
SHA25624dc8858d1b821b41b1e587d85165e26c23772f2e2b72c75f440fd6f0885dc4d
SHA5129362499b65808ddef32098a148e8583b9aded37a90ac5c2f0c6b99daa015eae47e77f3fbc05880b961d8c4422f57bb98559fd8e38d12fc49e0282e9f1ebb9ac0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a97e592c85372c1ce14631d00451dde
SHA1c20a9f7f4ac8fde1a14bb2b1d3ae1cf5ba6c439a
SHA256bfc0999d09a05540ca21b6b4a8baf0aabd05e5b080fcf3ce15d4caf3345e79f7
SHA512052edbc1b79eb02d99e17b22ab27a1fb011221b375ec0a732ea98027f6afdcda45ecf9b69e7f444f9bcc9af0403170b19e03dc3f5fe581edb1a54d4b9be61183
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523171723d079720df14521b961702e74
SHA1eeb6a09ca2881267439c5635532e61c1d951383d
SHA256e9532e470c01c32dc93c9f100243c6f4bc68901b407cceaf7ca912d463dcf52e
SHA51294b8603847b05b8d0a597af5930bcd9114cfc18cbd6022acf1f4308af35cbd98ea581eb0516dfe9326bdd7d4234cc3f684f41265044899ab096468f5955eb954
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9e19b902692f1ba7a163dd76273580f
SHA1dc8584e49c556c3c913072268a3de8bfc4044a6c
SHA2564b46b5aff0bb0633ede4daa6740b399c7a7f7a3c31599152e1e62d704c5cd49b
SHA512f480565aedce53895a5ebb24cbdd25e32a24aa663145687648041cef5b8fde4158d62b6df8bb26c9cc08240449a3658cc1c9cc85cc25a990b61dba5acfd8199a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54fb40ec6fa97e755f3865616a9e57aab
SHA104dc120a8e6c0b88d3ef95432edcc8febb64449e
SHA2562a3c6db4dddbdeec6f0c2c389c1107902a1456ab16d11e968a4a83720b09e9a8
SHA5124004f727e38fc2fa6f009ff6208c1a2ac229c5debcb260db8ce5fb974ae7ee0232ed91f30470b8f4a7ed4c966ccbaeeeedcca0534e1f6f5143e6905435e6ea04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55eb2ad3143b48a1a2f0bad65744621b9
SHA12ba9b1b41bd945d06a09e3067399994293ff5e5d
SHA25685ad2932611b433595746e2f3abf646402d9de408e131439a90acd777244c1f7
SHA512e02c22f9f6003fbc4ee2ead82dfee249633e0cb02f8076cbe1e1a0ba015fcab894fcd668a9e4a283a796660766e1f9efe447442ae707f7951c4f551e3c9fae4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e1c86997025b3c08c2668fa9eccfad7
SHA112ddd9da9262215307c1541581a7f38c3f9d9d12
SHA25671ea56c72c99bddd14ead6d2a360f71eeb6eb74a74a342d4ddb99ecd8bd4b2f2
SHA512419a3a09e6c873e956e57cbd4d02462c5231b57fd89e2738d0af8c933082fcd87381aed99e56906bcc5679d4f8f55d0ac4cdbb88d4ca0b8acd2abd5074ce0661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579d9dfeef41801f2a65b06e5133ece6b
SHA176b7ea16c943f3bd1ed5a900be46958a21a29126
SHA256f538ba8c4b48eeed4ee6587eefeb8f7f1aa5f8b5d8d6ee262bf0e5d549ea5483
SHA5127d47c5adc33ad1615d6b35c6b00d8fdc265611f2d1f2809e20c9759307cbb2367fe904d262641e597c6b2edf184db5a14b8f330ffce02b66cac01e0974c2d2a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5187426b5ada3ab53067a07ca28d1cb1a
SHA158db3158a93582b18fcbd5c7c2cc6ba10552db44
SHA256c2e0fb7b5af98508770f8fa2364f83fd0132a1561a49d0ad39eb38438ed984e4
SHA512d0be1d5dd6c02a5c3facf8ff3d80480e0b1fd442a2710479c0a117835a6e160ffbc54fe1ae3924c83e26f4372bfb69ae686a1883d0ef1701a0cba92f30fb537e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589742ae2424e49d0c5d497b3b6ced4ec
SHA17719a5c273726f290e0e2588e6d79c7caa37e4e8
SHA2566a2c2a1fcf80d0e09428d254ba27f6f577ae22d689c90d2d66277ff9bb15f798
SHA5126811e94fb20622298a58ddbea25a6bf395dcf7ee4e2e53a470d81ccf9ec114f93d300b7ed7736f7489215531c200d2a508c5d061f41e13a4fe8474f0136e5c4c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b