Analysis
-
max time kernel
122s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 07:12
Static task
static1
Behavioral task
behavioral1
Sample
16ac4d0900d3beeace47f8dd19cca493_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
16ac4d0900d3beeace47f8dd19cca493_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
16ac4d0900d3beeace47f8dd19cca493_JaffaCakes118.html
-
Size
32KB
-
MD5
16ac4d0900d3beeace47f8dd19cca493
-
SHA1
3a24cbc78bbbc68c25fdbbdd28d3f3ddbe6de7ce
-
SHA256
7c62fddc8277b487701bb36abf9e52f26acc4259938d8218eff384c63edce369
-
SHA512
9828b43fa8926fe1990ec402990b03e1ec5a78cc2f7a515c7dc5add4762d62fde797bfd6a8ab1136991c8107a5d21bbc989572d9ec8574ce94a781003844d492
-
SSDEEP
384:sKLlIcytn4PWGTHVWl1NeCI1lm5nakto9IATGJTHlSqIh12/gc4B0fnt4+glS0sC:V3NWHrylWnaEJEEguQ0ExLZ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000a046ea809ea6756c35b7552c7369498c38f7b3872dd7add9f93c3ef5e29e1735000000000e80000000020000200000006fd1191fd12507f6f670fd9fc84c92e677370f5952294a6d08d7461004dce47b900000006e8fd17ec6c17890f4cf64b56e1e9759b39f8357c6a8715b60bcc2e5a3cd984a9fb9d75d17bad840fe6893a1d2d2f341f964dfc9c47c5461c41beb21bd17d0db03647726e265d1deaf86309fb9916a25abd32e482e6c581700ac2a9940a3fd7163ba3ee04d9c45ac7ca90c51f1704e01cdb2c3d5c4655fce793274ac74223ed5abca48e563c4e53027c1e31a519c8da04000000029e25f0a1c4e9173a4423187a0cfc6ec2fd6c1cc210c6f337fa25492dec9320ee938a298ea0eddf3c4cb452340795d1d8d6db42cf4ab89a14531cd4595c16eba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434274205" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28148131-82E9-11EF-B909-C60424AAF5E1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000b4f3ef7eadfc320e949c7f4961f2f15209b4e17ab088342bc03968839a5f6661000000000e800000000200002000000035caf794bdbc7bd082b0c15a4de547334926504f1ff912dbe7becac4705780ed200000006a7cc324cb7c20cce3b98f8c79eeeea804bf4e05652094bf507773139370893540000000a41bea89106cfba5b936bb4a239ee5b77c629dfd6f62792fb9e9c1a1bc2b17507db58088a23c207b4d8701549b8958e4413714fb4fee0c4b64b110d4fd09cd47 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f1f02ef616db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1712 2112 iexplore.exe 30 PID 2112 wrote to memory of 1712 2112 iexplore.exe 30 PID 2112 wrote to memory of 1712 2112 iexplore.exe 30 PID 2112 wrote to memory of 1712 2112 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16ac4d0900d3beeace47f8dd19cca493_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a33f6c99b37bc90b1439f847985737d
SHA12baf2e8a5a98e7cbe4ee6ee8a8258c5f392114ea
SHA2564df6cc6a51380267b57c4a55864e1b7e1de5e4c65f0e40a053bd930106ba405d
SHA5122ab09540de91e25056adf5d147b94d679072d9890948fab461c839cf2d79bc21459b26f660054c8aa100494a829fbfd5c2ea0c4f4a3005722b7af9c00c3806ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2248fb08d7710a519ca4e66449171d0
SHA1accd1c83b386b1d645d2d05e9e8ca831d918c3db
SHA2566a801510b54d335bb1a03037f53bef284ab735b3eadcda2234cb750646d1a73c
SHA512c289f60a9a80f10320c7d547bbcbac96c00833f14b4415c0584b3dca821f9e9f2d44e2a6ef3f05aefe3aa917c6ec64b6bbe266a4808cce1720336c88f4697165
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5157d229212936aa90082f1d92d194968
SHA1081de814f999c777759e0bdb69a71d2e5c1ff1b4
SHA256cad4b597017df5d04a8461d0d0b25e9313c5e1cd582eb2664ae37a464b6ef331
SHA512c1417832ad9b6cbfb1ee3cf3af4ddf136115330873bc195f21ffa3df9c11de2089f0d162e50ddb374abbaf9bbc7317ac44c23828baf8f3c357355a7c55ca5aec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595b1a3674de98ba9de2d519fe7e64663
SHA151220db5f7d3deeb15210403f28d632c38c6336a
SHA25622a640c857bfd006632f341ff5688b2c2466896e8c810e125d90cfb00f68d543
SHA512b59ed994fbb72721eae68dde5a1170cd7c62bc4dd6c426055fd3385b1bfe476c08a82c5da408e3c8d03bf69532055d64cd5de14767d479f341904ec62c2491f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52933d59a639352d33b5bc9fc59e19ecf
SHA11774699f1adf3b917de3c1736f3e2597a0611033
SHA256c3f6d1bddc8bb3a47b626e2b17237b8417a31be44dfb6ec5344c76b377bbc455
SHA512b54d907889dfff5e2b05dabdd0d2a16c6608822f4edb6b20df30055ea97ef75b4e4822f7d2b06b99e3ef3ea326bac17eca7135aeca624bca6f43483feaea9784
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b55c6430d1a9d505e3ace86df6d8a5b7
SHA1b86b6f8640f6d071f2437766fa8bd63f440946f5
SHA256de38abf5480a0e5500bd422fd6b3fd4490c4379cb1dab5a636228043e1c5f1aa
SHA512808da5a26d98c368a218f13da75a01bb023f847868c11c82bab0aeb50e85557ca069335a15e29bd220a793b4080f02a6dc69cad246a4e2bc653d23199cd765a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f5cabded6769ef3a1ac5b4c16fa4714
SHA1643dfe815f1f75322b69647acfc1322e0347fd69
SHA256397a6d5fd4545bcc2f1c3b87d2afd7329f1a619967d44c08333d86784153d732
SHA512d90e9c2583d62be3c17e174c1a6b0af61e9dad2c66aca829a67bcc404e43abb610104f51e03cb0c00659ec6beb0873ff08883a9af63f7a4ebf56668a3a74fe44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7a73679582ec3179c7a430ab041ec35
SHA19e7ec8908681e285df76160a01951f1563a15e38
SHA2564be0ae77bd05b4f209762368295a01ae80c9293bffb432c345316721a7fde51b
SHA512bb4c24225bcd1058e56cdb5a122b59fe21a44eb9d47bc1ccc933f0720be867fdb4bfabeac1c9a973745e718f41cbfd433366335beb5976c73c12c5d516abcde9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54db4b0aaaf6b3313f3a8f3f4ee495591
SHA1a120d477cc581dc1b0153129d2e7419ae250cb7a
SHA25616570245c76ee47d8e9247d3a980dd0bea13a1fe07aa23dfc4cdd2d581804144
SHA51215f3ad887420cae07d013ecbf972817746f871cf68ba7df3abff9539c9d00f937ece82e5fa653a480ae74ddd065ec108030d0098045e8043e50fb42a90766c30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c3df92db39ef2e3b110754d149f7ee3
SHA17084c942a601fda941e6b6e5c00aeeae2a86a4f0
SHA25683f699856d230eadf47d80807ef148ed4fd2778992512aeeae603fb1a254d882
SHA512d40312a9d732a9020d3583d40c12179f46cee4de5d3a21de96cd5951444360c0bc6dbc595590e6a47896049e857e1a2d32a2b782b6f1c5206868ed00767b8d75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcbe5de466375966d38cce1c69fc4b17
SHA108e697fb8330c39028333b2a18756c5228eea891
SHA2561edbf65a6a111780f90fe3d2b37d523e10b2efc8cc74b0a49fe2b0b9af92a6bb
SHA512752bbe7ed4a5928c33ffb0a874bcbb28a4533e22b800c6ab020926d5685a7482feb9de72cfc805cb6749dbfb29c436e99a7ec03c096dba5eb850704715bc023f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d74b4222b02441c10a4594bf12c7182f
SHA11607006f077481146a6b69f98e07f6b2cb6d4aa8
SHA256e4ffd85a96711c16206daf41998bf62f174c1b2818cbc840310185304df90dc0
SHA512cfca931e1272936034f5226ab530746c61ff9e6e38c3a6896ae86d0e665c37ea308304b4a6604d30f47e4597130185b1a7ac2bf5b5e1b0d9bd57d75c7ac332c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f840a4e6d910b4bcb71f0ef027e88ae3
SHA1a1a6437fd9cd008e77c86c1ac876d08743527f52
SHA256ebbcebfdf19dabf9ee49846dbdceeec363c90edb07a3830578e61a0fd4f1090f
SHA512e195f6ba81e26f937fa4f9e9cde29c9338586e56ea77faeb94646b83c344cebf39c62a5fe24d72844df9df8b0c2d421f37f85f4c8ff3b0ce63a6ba2223762373
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5127af2d74e4573a60c3099e35bc03c2d
SHA15eb2cdf22211dc3b17343575eed1594c2b58fba9
SHA256e028c1206f592396b608fe9861a7ce294abff288a622b7292c0170f64aed4afc
SHA512f353c2c0bcdb6b9e694c01124d23b2426b016b59a9eba9601ded644c017b14aeb4280548f1bf712cac8044fd13f9c8ebb19aeccef65bd28d22265f8304ed1fdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500eea55d9ca4bdf4743df744a0aa4dbb
SHA13b5b007ca8d9fc513dbc912bd63bb6361ccf7b46
SHA256eaffa9637000ab67e6293936a21a261f72f8c0beda33140bd021fe62c5a512d7
SHA512c05b593f595955b2a0ef2039145fe97279a0ae4e4627bb7747e9f1aa8709d4256180409f6afcfcdad8c7ebd29800c5d9439c32029f98fea3d1fa16bb456356ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595db5307c079f811a8ab295e5c2909da
SHA1e30d32a1d5ab3f26451d8a350873171a8e25e9be
SHA256b0729af8249eeaab341ae84299cafa0929cfd9f6523167408bd9b14beb156b16
SHA512f78968bf903692a89c532a7940bdd9ee3b8620491aa654d574c85b54a4851195c49d6e5adf875a4dce4bca5790e31623be6392bc3637afae4ee518557c9dc368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fc7b20c0906b9901a402c2f056359f9
SHA1876a6b841568163a07cd405f6ffbef7085b090ab
SHA2563b746964895a256b8d8634f7b45e5fdc98c4c3f89a63e671144b21b8d3de496f
SHA512930b9266b5e37dcf25936c6fe04b9e7a703720841a628e092d8186d83a28a940602dc7834c7cd0b4b6d248944feb455137c0d4f068491d729428f9f8d98660a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52017a8173e07ae5caf85f25c7db9a492
SHA118e73736b89fb9ede3eedac8ad53454fd3e2d037
SHA2560ae02765238a28963d9cc5218e5346c4b7af3a36ca628a39cf60bb6c353e0714
SHA512c5d3bab5a9dcc7706ddf4439562e4a902c3b4096bb1499718ecea2f6a9caac615f9c7204fdfc7a4be76790af28914be538974b24bcaf0f6f0c612961583a63c0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b