Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 04:50
Static task
static1
Behavioral task
behavioral1
Sample
2b2737fbc05129691b2ea76254656979_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2b2737fbc05129691b2ea76254656979_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
2b2737fbc05129691b2ea76254656979_JaffaCakes118.html
-
Size
53KB
-
MD5
2b2737fbc05129691b2ea76254656979
-
SHA1
c5773fa6e41f2d8213ff3d5b2e582f7363f53dfb
-
SHA256
73fd40f92ad8296e683a06e9e55d20293bad8cb8c4d091c514021e0d16cc2984
-
SHA512
5f2b5ae9d4c226f99c6043b47a9afb29e84e008385f1c2d4ec2e565c5f8466d15f7033645876c0ed2fc695ad13dac007a05bf11653852d074bdec51b6dc8af35
-
SSDEEP
1536:CkgUiIakTqGivi+PyUwrunlYG63Nj+q5VyvR0w2AzTICbbsoz/t9M/dNwIUTDmDj:CkgUiIakTqGivi+PyUwrunlYG63Nj+q9
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7EB8AFA1-864C-11EF-8673-F2BBDB1F0DCB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000d3571cd0adcd7b18d4bdd4fa05fc8ff70ca19ed5f9597c9ad866bd7ea23090bf000000000e80000000020000200000008af238df4a67cb25e3a6d315ef5c56b7ff123a2ae59973a86d64b7e8deec095090000000826003bd20f3c12ed5f55bc2508fa525de7294b761f937167779b5ed177ed49b6d1a0caaccbcc7659a5e9d4bcd258ad90fb8e29d317a23120f5797a4842823f9118eb96eb30f092224f914156d14f3d99c21d5ba695c26a4b261d4c1ed3d76621bfa7602f7844883c4bda7b94896e2119bb521061c608162c9d7bee3b88e51e480c52afb39dab0083944de4b9f2abc7f400000006f70db0ccd3e6e5381a5dff33953dfdf26f1601e28b19a8b69b109686b26cff01e243dd8b97c171f637eab61cd014f8d142cf9cde6e0d291f66f3b06a82f12fc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000353fe00ce83d9a0af13dc80fcbf124fd364d94fdf36b76efa27f00b0a99b895b000000000e800000000200002000000004a793a87de6bde61150e4f2fecd3bba5068f1112959131bdf1dec1a0cfc4ae120000000e5ad240402e3bccc47cfd8e571391dec8c205edf176c0432b2c0a0663a4abda8400000004e84cd2eec42536c73807c2a6d63c7b6ddb83f93a912a4efe4e618ec8e54ed2b5c4462f5559294f0008847c1421532f11a6f21f3050cc810ddeacbc8fa0bdc36 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434646725" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d73a56591adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1856 iexplore.exe 1856 iexplore.exe 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE 1604 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1856 wrote to memory of 1604 1856 iexplore.exe 30 PID 1856 wrote to memory of 1604 1856 iexplore.exe 30 PID 1856 wrote to memory of 1604 1856 iexplore.exe 30 PID 1856 wrote to memory of 1604 1856 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b2737fbc05129691b2ea76254656979_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ef76e389331fbbeb5590cee93e2b8a0
SHA17f8267d532040fe564c683b56c2e9242f6691b0e
SHA25699177b8c5c2fd49708cdf47a7e99a2283602108e5917ab1873b242246139d3ba
SHA512be6285e081ab08ec240bb7ff883670f5be1e001389bf524196d80c00d6280cff82624a893198d52fe0004123a932138aee0ef623687ce298460e6e91c182156e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD500c397a052b7744fc4af089f0e090c64
SHA1d1a84045365d89bfa0dd296e6b14c34375a2e1fb
SHA256fca6eb35c1d2956ac6abf837c187aef7c95cb6285bacf23b37b4d771d0974d7d
SHA512e6792febc751930bda0f62e8c1c9bd945adf3d3b9e3c544147f0189fa907c924ce6ac48082eb7d4a67abda8fc727c1130f56a5c0803a160fa22a0881fc1029ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD509e4dc3f80aeb5b62df94fb46a85a2fa
SHA1d4dbaec5722a155247494fc5a94730ab3216c64c
SHA256f99f3081c7ac5da16bc191fd3119075593fc5d2e25b5212724b1188ecc7e4255
SHA512d8666b8536ff4aa517eb9f73fa99a245f0c5579dfcbd222399a2be35b94045da9a20f6072e5c74639b83e72a3f8a16c6d8fc8b5ed52bc54a4590b79a4167d25c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588e9f1595129bd425ffbd4f578e84c29
SHA188e48fca2b874a03186956e8ded8186802e5072f
SHA256829d5a05cd7c8d9577e25ee4150e917aefdcbef51914900ceaf4b23130e7ba5a
SHA5127a176c8397d8b294ecc578fc444a5c4bc6d6855ad4b1bbc1b0d809c600abcfb6afd110be0f9bfd993042a63f1ec6fb080af6eb248481164771341e216d2c7f42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc8c4b6ab62d7fb304094136a2c14c3c
SHA1db1561dc82f10aa01d285eeb89dafd28014b07f5
SHA2562b0e00cb923def0374d1b74a396f62007ad516c61023f4a16d5c634106962a73
SHA5124db3be8537aae2fa72e7bf4eccb3c62cab67ed21381c277314e2d57787f3a6260fc31cba02090bd2bd0245d944c50d274570932f50e27bacda64b773f97433cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f95dff0602c064f45c980d1d4748772
SHA1b2cf48e06fb9a3e72560642ed3114ee49d4a88e6
SHA25681602830cd40ee93a5d662c5171e8f7b88fcff8c6952158d480e3ade65b7e7ad
SHA51260636399772d05d64d023aaf0162b6c2bd8bbe296697942e27f6c2b4195ec79a76aba73fa324180d4938b69567123d2e24912c5c4f36c8ce42109d295a54ecdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a6fafdb8f380402457b110fb86ee9dd
SHA1f49ee927bc361d50cd02700fac94ca7a3f38cdce
SHA2560e6fa86d4bffc60c385a4bf9390efbca112925f8838569c9d20629a7369e69af
SHA5121f7189d431a7a08aafabf31c34152d83249535c34c07d3506019ad531c16d2617dfca9ff9c7cbd9d00329f24c9520878324bb7bf3e0d49534d3cc1919e2c0c5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a758627a5cff1633bf66f8c75f80249
SHA1d0d076db7a1367c4a557d413250b4b781f82c480
SHA2562509ac923b56d9bcc43150af3d7dc4b2f5d6d3f2f3ac2d36a34594360b7f6caa
SHA51220983dbb7be711cd2e105fe631ce2ce4e243c6df1173a9f4ce38ca8b941a1246ebb481ac4760f5f79917ad7a6f7ab3e8599aaae28cec37239f8d93f34a88e7c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5597d6f9d99e34a8274870aae63a99642
SHA1171b06613912f8565a4871caa9d61ae0b2c0fa6d
SHA25667e4d7e3dbfa24486cbf574ccff442d9c7742c16185691fd3bb2e040efe24b4d
SHA512ca4504aacc8969c8c95a9c8507876570d2a75687b9d387ae0fef9ba3f59a5a0a2be13be23dc0e05ee9c16c229e758cff575c64e8f091296307e5ed65bbce5a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50ea65718326b456bfe78d1cb80d5c642
SHA17a62ae79f167e75f19d2dfdb351ca5ef2b241a57
SHA256186487f89011bcc0c5ab61a03aa2b29cd13c9c2536c475ebf93a694bc9a235bb
SHA512d2794bc48170c15cbcb974ef93ddc334cf603c13e8f871f26285e27b16cecaad2d11e53445f52790e6e979f858833b3fd2a6f6c0b6b2a0c540136d6d14c4a33e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0187cb3ceca291faa3fa6324e244140
SHA13ca660ebf796840afe1afddd4273c8211eaff8d2
SHA2565df8535f307eb062e5af3d19a8ab7c065392e749030f1439b4abcbe937cfe8b5
SHA512adb0519f65bde27d9e4a501e096716ae6e9d8fe4169fec24f47644630bd2b8da3c65feb32b33bf6ae9b5589b67ca35d0b667f475b98d8927b5168fa0b1bbade3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57210019327b45a3b96621c8e4f06ed97
SHA10d1c5b93b009e3a81227a7a2560208cce8a2fe48
SHA2562c730b1dd6d936a8b3174ad8c23ccbf366c118045ed1431e0f0dd38202fa8dd2
SHA51255ba93e7d6bf5ab4189c12ee7a92dde972bc5fc24e05517e84130769bb500201cf0aeb630d4c8b8e702999e992b34a51be539f61a8c28ab21ff59154c6840912
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f912542462c6104d6dad94822793fee
SHA143e12f6d00f281252469f864c1ddb4767e1b3ba6
SHA2568d019dcc57498d78947874ef3e11d3519018dc93e50ff7e242795ecdf5218511
SHA51233ea37431b1d3b18dc21c7fa38d42ed4388f296d729cacc0c7aa35f513f6164f2eb26cf7c36b767a89d076103b4166a93e8fba39b74bb3f11f594123e11af999
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551101ee3099619a12ecbf5e70bbdfc0c
SHA1e71cc99c2032870209fb19a2500025ffdbcb013a
SHA256515da6fd975d296b53f48a9433a481dae402beb520d0c5945d653c8bfb0520d2
SHA512e4a4a74d51e99b07adb03a828c9dc478d1b2d9c1227ac7857dccb6c3ad6263dac47e70e7b64e00fa151bede5e7acae2db63f15164659a10ed3879bce102290fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2d12ffa1ff8e2f1ff99ee3ba594a70b
SHA1534d44e7214facb614622f0ecf23ad0af1a64e6a
SHA256f919a1ce24fff169511de2dd409eedba4a476eada2afe6097d90a034d3b5359c
SHA51215b49b2b018dd88b2d667afe41459af4e32035dec02fe61210816088ec210653ac2e241f2dbe231487e15b797ff3cfc16105d87d1635da916bf2376e092b692d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f66592f775553a254fb97e6868385a13
SHA13c1fc85792fb1a9f49af7d1d09a56029f0ea91b4
SHA256076188c86912b77e82425c167195dab86043eaf9f93a2f67f150af667d206234
SHA51213608fe5d36b6be698970261aea985c4bb84de942b17fbb9504a31821564830ab86c6a48fdebc261c8da4bb20d4052b30e8f2cf0d1aaa5deaa3d2c8f6ae60286
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b