Analysis
-
max time kernel
136s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 09:49
Static task
static1
Behavioral task
behavioral1
Sample
2ef8b45d307f06b615c0f3b4dd75f03d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2ef8b45d307f06b615c0f3b4dd75f03d_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
2ef8b45d307f06b615c0f3b4dd75f03d_JaffaCakes118.html
-
Size
19KB
-
MD5
2ef8b45d307f06b615c0f3b4dd75f03d
-
SHA1
8d9508384565cc485bfadc4b146d329e8482ed20
-
SHA256
e722d277d9f9cc09cd84e5e6bc1312c4b4f40e54c8a1d9baa5dacd4788bceaf0
-
SHA512
de7ca1c205e6879b9302d530c0a6f54addc97390a2760bfd1dbb6f51227b9eafa0d70571c1ebe255440f4e947194eb26dd0ce8696aa4af50ea4d5dbe1c3bffa5
-
SSDEEP
384:2Fjouw6Cogm4xMop5bG7VY8mZd8bEA5bYO6TW5vSag2PDVKhJ:2Fjo8CooLi7VGD8bEkMOH1SaJIJ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434674927" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000008af02269f60f13019dbe05110246fa48496ff178c45358ad15cdb4359da86600000000000e8000000002000020000000e14a4cc6a1d82e4d4165e6abc256fc360fbb9b3ab8133627bd6ae2845527e0c820000000c0cde77157f653be6da1534a6363e37bf9c3a8af1988b14164e5031746538288400000006fab1c6e3addb1f73d66bc2948a06af796485f21e2f2eb4bcd10b271bea4c8c47808d606ed08e6e7a51223d6e45bd74e9103964335aff3dc7c88535fd58614df iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801b58fc9a1adb01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000004e3ba432ba897f694ffc023a2533adc5b697909e3111d98d525c91d528db5cfc000000000e8000000002000020000000e8a326b25d28146f9d5674c39956cb1706adebd28efafa4e970386fb8fa1c6df90000000660e61a0f4561eb9436470d377ca7a2479e9e71c3bc9165108e15227bb1dba1e950a3b77197c3ba39c64cb641560e55fd360c5cf754a62c6e5953217c697608e7a262a2e6682ad69de5305be76217d1f1b2327abc80312c1023706d0570054630b6ff41b94d6c8e1b00e99303c8c7ce294c255c404d064c871d703c031f124fe0f73fe671279aacdd408139819f72d9240000000b56f62961ad77c380d7330f696b405b918377583703b8a29f8d31ec80d46acd9f5b4e4492d673f849a464ddedd5c2f30bbcad587377dcbd4b713d69536d18579 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27433281-868E-11EF-A02E-E67A421F41DB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2684 2088 iexplore.exe 30 PID 2088 wrote to memory of 2684 2088 iexplore.exe 30 PID 2088 wrote to memory of 2684 2088 iexplore.exe 30 PID 2088 wrote to memory of 2684 2088 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ef8b45d307f06b615c0f3b4dd75f03d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5800c3b4606d946c16440010adec9c9fd
SHA12eaff7481a63d7fe6fe0de90f8283d1556523d2f
SHA25627c728f8dbf04107e58f1a43acb33a403a78748f9141650122a9a9b039bda864
SHA512f4e47547d24e5cc9078789bdddd652c702b9b0d5392bc3f0bf24ee7365718688a42bf3929ea8505566696549f95bc613bb6ab9fe1dbc886fbace429c72ab6503
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c4d7ef2669ba08897fa221345de10ed
SHA107fb7eb17de50a070aec854bdcf2eb93c08f131f
SHA256401cf03e5413c1c82476c5d569e8f8edd7c18fea6a04fd54e5d4ce0c414c9f64
SHA512511b8585cf414007803625a467179a7e25880d0b9ad218154ea13922995686127b39dbb8ba8a88af2686f648d50b0f7b91b34d7e53d31504f513d1d93922a84e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bbf3924f4f94f411b2fabd645f0220f2
SHA153ceb11d786b211e8c8b1f24eb5486bcbb05cf32
SHA256d5c6a3940ab02b1695cb57a48b8221cebd90339e5d776f9a9d30f160398095fe
SHA51215a0e75504958f0fed348de8877ca66cb3076b3f03d2f5871f620dde9cac2605745cbb0e50a6040aad779a7e4322b058e2005a669a4ec9531c740cfa87ce1911
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b9c0c19c133a8172ccfe75ba462c15f
SHA1cd98dfb7d370d6181284767b5bfd91bde3eea793
SHA256415a0cf71437f3cebb65d5c7326d4b8479061155bf0ed29dd76e77022e284606
SHA51232186030c48648784391b3c1835cdac5d54c04e7bda59c987aff55c9975af1155baf7a34f35ad6e1efc4ad8024a476f0c618c4947de243636d80013ea7f40bb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d013f575006571943a1b71547256c151
SHA156690e17cc900c2d7a8a4e8344859d162e242abe
SHA25650f46f911e00aec4b9b5f6f77f3be25431ee397ca0b3b0de59b4b7c936671eab
SHA51266140343b3e70be7b14861f46942bb6457a4dca8a91bfe58491fc8d1865f34d75e1fb74ad28a2c69459d825fcc015f97a999853c9614a517ba58ded3444440f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e5db2e7fa2deaab148671dae966036d
SHA1d72a73f2761baa32b41f9d0c383c1bd44a9901c7
SHA25663f35a012184c3e76ee80e0d43acd48aabb1c076c03d37bf4a64dc47097d8712
SHA512a093bdba1e210c3ca44b7e8350ad46cd194791ed2f5f1fa53ef9222e88342bbe2384f3449185383f210b0d2ea4dcf72876dd7231adca097774e4c0dfaa8e9b75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD584c61fa0aed56654726cfce537a542c7
SHA13a4000b1fc090cf455a811501752aa03648c7485
SHA256e78c68dd87c91bc7ead19f6ff33fcd64f479ed4c45114feee705337b8f0e97c3
SHA512e218038ea38c10d1bf21fb9725b5b39b6fda1ebc19472366ee1213d285c74c0030cf5aff574e33c1ddc1a23ad2b7a613b6d4b00cff24eef07444f364c26a5913
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50d1db6e3d78e264186268d3b55606805
SHA15705763b998b3083a16c64ac5e31e6219637c4a6
SHA256b959e26367659089fda9da854f0b7cb5fd7eb45c13906d7d2c42a77b1e5b50a1
SHA512085f0cb5b504b6727a94eb35342255e6433c019be36a788c207f9f77ccaa962137717d5bc6598ef273901a330aa9fb79497779e4e4fb7327a0f0dea74fa67499
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e633362b475e4f05429256b3b716e08f
SHA195e551fa2be36a7d3bad388120b72c79f1b74436
SHA256ee0f818c7db22bd43c443c3417946e9803b92b4488a0a5b8de3dbd0cd7c343e5
SHA512d6db10eb63009002c54784d3633c7c0b1e7a2cf56cd411f05251e275a69b5d163f7ab81079ff9b8b1d75b8a69f41804a7fef3b1155ab103aa10dd0b3fac3a7f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2f5e49d552364151e51c71e867dc789
SHA1e01278dea0ca584af29522736ce91b08221223b5
SHA25614e27ed89204ee11de2c9b6eefac5a6787ba0ca5dfdd15a7c1b0b95e9b2154dc
SHA51232901c06f9bb457deedf8cdc856d404b007d7ddcd3ca4c3f1ed1e1595ff319269c0e8f81a6d9f3f626b7cbcc3479e083d2ba3088a598557acc9cf28b25147931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdfba4c6b8e1c9f5af667b44403c4e04
SHA1f32c8db548d5215ee016272fad481b674b4a37c6
SHA2568ac36f6e258ae510f094f5e94df85364ce58a556ab3fe2125244f91f00fa6c5e
SHA51263466a5c962d549910fe5f379b717dbd0e9dc67b2ac408dce9ca1efa40be0a014ba62e28ddee41ced2877b96c0cb5c32fb73c018a4283afffca94fd0df5030a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5979542d272e02200ced18936527c4453
SHA1e627e37221e90ac729ae04fdc30ccd89319c4fc4
SHA2561df129b9242f4f9df837bb109676b2ca23856bfa1d182dfafef37d35dd0fc24a
SHA512694a506140541264772dd07ae6591f6ed4c294d28f6f48d1162d1513956323f0651e5f930288204e6a039e2c3ba9b0efe3901a952729afc1f013163f69b24da8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b663839678619e746c7a94ce17a9d60b
SHA122c002ab93ba7deaedf05f4b660011e9bb9e3812
SHA256fe9b58f950d0b938b64dbff211931b71c01e85ee9e0ae6cabc920f17d2215acb
SHA512018e08113effb07a9628fa9b33c5e4e73cd5f45cb952a7d6621cfb0f93380975e3e8b3347f85bc7c81b36924f6ba2e419a7c3bce385f263dd2d129a06b1c5795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ecf9003a585e5b8ccb453ccb51a5320
SHA1656d6ece29c51ddae0c6ba8818f63dadc0a57c77
SHA256fde6f30ff37a524b3f852c3e3856973807bce9cdb2d8e32f3e00b5c0f01ceb53
SHA512fa3ef2ec198ab2322a8bf1327730de2e952d714d50467f087eb7f638abce9dd3a3f2ee932c448902ad076597e2664b2d4c64a179a695d4cea9b0ebdd8aead1ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555e19174554af78b4ce87911e0cf6a62
SHA1d5448d1d92627dd3734c1ce21d24da8f39a2a295
SHA2564bc7e93d29e51a09e4239cab531a212c73ac30a53beac04f707f5361b9e84cab
SHA51258d00e762bbaf7ad3f4ea10cd98095a4a7847561a0f7c66405a9747b6dbc94d1ff0819f6e1ba5c815207553e9da5eea1a8583384f8eb9863ad5b91965661a129
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58920d89a9f444d22da07a52e5af77706
SHA107071ef3f0b0480b0b757297a72448a626fd4392
SHA256601607ca71af4c2ec41ab3e6c510b2cddbb2db375e94fa9dd6c4fcc8d167adff
SHA512ed44a5ae29ed0a955b9095d124f8c1b9bf26e1e032f80495e3c3a600be1523b431d9b8ace6e254b1765b50e2c061a1ded0ab915cefcae49218d83b4fcc6d7d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ca6ad66f39bc380e54c3cd817b92647
SHA1fca8bd43ab7eb3409ee2b4a562ff412ad563ae67
SHA2562811ccda80d12eb4e36bb93c0098226b3461e8fa2c8bc4161b673ceb2110695e
SHA51224b91dcd606fb20988594c145eff98070682bac25e402492fab93d3aa253a8157f4c5099b9086e983ba6b258e93abc23822534fe41cc1c034d926e4b4f52549f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c878626053f2b98c6271178f2c88561
SHA1d47c2f11cb30898f91837c42917711f913eb3ab1
SHA256bbef4551674b2adc152c49909ee853ad98bc70e04bed166fbcb241ff3033aa8d
SHA5128bb9f44c8e07c5638017da9a87de0c229dfe9f13d4ee3655f0f6e2df71ddeaf5378cc432ce983bc0e71b98017223780bb00aa19b3697daad8088c029b771e783
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b