Analysis
-
max time kernel
117s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 16:45
Static task
static1
Behavioral task
behavioral1
Sample
40f79e9d86e39df04e74da446bad8b63_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
40f79e9d86e39df04e74da446bad8b63_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
40f79e9d86e39df04e74da446bad8b63_JaffaCakes118.html
-
Size
5KB
-
MD5
40f79e9d86e39df04e74da446bad8b63
-
SHA1
1498c64a9f9a7cc12a6e67bad1d9d7cf990a9d16
-
SHA256
3e36a64f40afbac9d5db0facdcc8ef91dcd66cbeed36e9afa278d74c1882953b
-
SHA512
fcc9d90c8701020622d710a7aacae7cbac7d76f7064cea777914b5d3886fa785b2c6f2a31043217a882fc7c538619d3a621c8c1d75f0ab59bb6703586ce9581e
-
SSDEEP
96:7X6crf7y5n3UUMxMVNBfEObAAvQU37Yun2:7Kcbm9k/MlWUL5n2
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94910AF1-8982-11EF-856C-4E0B11BE40FD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808a0c698f1ddb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000005952f2fca235bc50a065f140fc442c3e4e0b5e77b810bf18357b9275c6c944a3000000000e8000000002000020000000358daab26bda90d3a2046ffa0e6b7b27cbcc46a8cc029b75d351a736d10554a320000000e39f5cb5d4f36d7763864d7c482c9754f27e7525231249af1c6afab921dbaff440000000d68b6c69bbd9eb990392c8025fe7bc2174c178ee213d2cbf2e476d10421beabab940b92cba6cf0fed9a5d4718b034b319808dcbaab4e8ecc9771c8fdff66a272 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000809eca3739a1eb38b07aa39fc4712893b3a014587fe56f7ce54dfea4651966a4000000000e8000000002000020000000f3b9072a65ffaa8e731f2905d07064bd431009ade21178068f3b3be77f7c55c290000000de8f23e27ccf12690b64b3689c825b770a60ed61ce05d7b2f9bc2f4bb5c909bd27d3581cdf46c6426c69f983a584c7a462dcbd19a7f39e57b73e5def1a938b499c96b7499d4de4b9973351111c251c178a0652a76812978d1e0899ccd7630bff0e7db911e823fb504d5fe77b66803013151460b457a1a63244ab0e3f4f898a14a238d09127e8a1708554e0e2dfc3a0a04000000057d64447e5ba99ef670ea246b764c900a190f59c507a76f85063320ce8026e804e9683d509e557837192cec690fa179d79655c8dc57ed068d1693d12e5f330d3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434999819" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2988 iexplore.exe 2988 iexplore.exe 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2088 2988 iexplore.exe 30 PID 2988 wrote to memory of 2088 2988 iexplore.exe 30 PID 2988 wrote to memory of 2088 2988 iexplore.exe 30 PID 2988 wrote to memory of 2088 2988 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40f79e9d86e39df04e74da446bad8b63_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bed5f37897e46e3397af4ed2c32af12
SHA1822737250080d1938d4b05258ebbf963ebab6dc5
SHA25642c20db8e0ffadfce92b3a988598553dfe93f721e296ad87e63db361c0e327af
SHA512d7562d14538093f0a122708af8a340fd892cd8a17eb430fbcddf369f2605052fdc7fa1b1f9adad7affe90775fe3f7366ccfb7287224459f8aea28cbf76df0520
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b710d698d167e4783b4cb56ade39d7a1
SHA102e5d40d10113cbb93370e89ab4b343c151d98ca
SHA2565aec05908856b962e54c1916a1852b9ef3056d14bf79a207173c843f397c758b
SHA5129c445abe1d48138b6d5efa5d69a90e45790a42274e7e9c6f177e2f7cd8d73b0e7ba457647d43ef62c06aebc004fb7d0d88d27935440bcc1017e246ea118c31ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cbec4c54eaddd9661dd9c8f4e94932f
SHA1d96f500c2e4269857f51225c12efa65220c2569d
SHA256a94c93b901e3363edba9cd9109d5c9b3f6d432cdeef886bf3387084531787276
SHA512d7c426e5f3896d3ec3ffdd78ea805e1ae6bc57a07460a51969f225208ec5791fc62539c768457199a77d223531490a244aa22ede85b8b054f1a3ffa8aef26265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e25f0268f27dad0ac04b512b09f53ed1
SHA114bb0a8f65865f89f8d5a9c004c23f8483298831
SHA256bc56ac0bc4e451879528a7527982a461240513174e6fd13fd136e8adce4d9ee4
SHA51242fb23382d9070fe5625a506bcb463901a152b8ea82d92b1ae5e89f54407f0c19000e432bfdb638e930af5412e76279515b39a85fd4fc489351760bb841d6dea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e64d7af2cdf545f09213fa67ece15dd
SHA1a32239fc35106fc834dccf494a61d28d3e030e7b
SHA25602707732c86f14a8fce9ecd8d7285fa1cb742fd33eb835beb7385a18a1d01b16
SHA51290a82aaff8c5bd53dd09f45ba8a66026bbcce28e27023b194b9a4d30a28fee1189e560bb2cc1f4dc929c4c070af81c14de277351ba44d3c80dbc8976885e5db4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac5d3888ba4179a772222ec2ba925c2f
SHA177df54739fcc3453becfccc36333c320bf51b20c
SHA2565fb8cb3670a59419497701365ae7c2d294e54696b132e1d94b7d7b644de78d74
SHA51221adab7ebdfd768ccb179dec6680d2e054bd43d9227f91e3029a14e919a54cd9bbe984fb91e1e5de5d0c8fea94bbeb961b86e15391c6b02e9c32a37669e1ceb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a9d0919c6653ebccecef18671dddbd1
SHA169d32a54f42f4a8a8b275658ea025c3d4ac500ea
SHA25626b502fdda7100c9fb884a895d226b132f71d29355d2ee1eac26bb228f5d5d38
SHA512e44017897d63d7eba70dfc0128528de48d0d74f6681a1ee9245d04ba5ae97780d6a96ffa7e25b9216438dfcfe4c1261e724b43bb94908713d3fd1e941cf34e0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e268044a90d3a3560d16f2dd1305b0af
SHA1b6131dd5c350935b4ce91a6d203dc5d93a08343d
SHA256974e42fe6484e226eae01316b5b70d5e5ad9306e6687526c27e74ff8f7d2b8fd
SHA51228ef6ed3de92490a683185fd9ee13e2e9f2e63cc0927d5638a8508df63eb7e70cc680cc87563ca3c8b0cc3461041b93d3d635beb1fa8e9db4da0ea7cced7f335
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5bef10812127c08855fbf8600bcda2a
SHA118c0586937030b92daba559fab9532d990027646
SHA256344dbc8ca9ef7caf8ef6761993a518619575425e0ece7b0ad2ec24191ba469d2
SHA5120c0ed190a8e0bd3e6999f6945324690fc0b1f990fb1c064a7b223b0056695e1f47fa855119d2bcb50cbba1e53a19013c8515a7a02e3469619a84600de01128a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dc186e4861c2248ce6adb172ae88798
SHA1a28c0cc05524192a1e89aa144a5f058562eef33b
SHA2562a722d88aa0ce460f18a1d40f24da1321c5ee2dce550868c3c73f389cb4dcf47
SHA51277fb7234bb7427491ec898a3bfaaa05edd2f73283fe3d254989fc96f810976325db0e1b5d7dd8826e1afecf63dfed6397b8d6611fdcac0fd4a2fd325c89d6792
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d85e70c69449a8858785a9d56e21d4bb
SHA152de6456caa78af9effcd4e7730aabc7f08710ce
SHA2561b17082ec4f26597337ec26823544a19d432b328252e44640844e16aa132dad6
SHA5128072734972e940107dc917c15212dcfe253e7169c71532d683b511015d0918c2a833a2227bde5d32092a1866c3488f3637fd9a738cbff0461499ea9a7da746eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd4d020879941906e3d46a632c14b3f7
SHA1433b922627f90531a7ceb1519b85fd99fd4bc11a
SHA256253e93dfd20199fe800d199acd8d0f4a00e79d002c0c351acf530cfb7110311b
SHA512497037fa779a8414183d0a836a2aa085e5504bdce3bcbcf9e0abb57cd39b456f965bbaa150941b9bf35e0133526da4d6eb24db2aa4af0589b45c753e3d97b099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c9e5d5f40a2fb8d0b57872e45e581e5
SHA16ca1302df289f7488387c959f7660a7a4ebe80c2
SHA256c12359b900535667212cdea23f27e1d999045ee21471956ed59b9d52bbe06993
SHA512685b328ccf40d7bc45ace008436b1a8d90ff694a6401b1e3845d18585940dfff116500ffd00b9e48d197edb9d170fd725c3fd0665c31b8014c48c123b48eaa4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7acfcb487c91b9032d43ddf07d71436
SHA120f48f5885cabcc6ce3898e8b668a4a5a99ccca4
SHA2568f8d4c2b526b5fe59ff1860d1a09806fed8ec565bc99cf9255ad5587b0cfeb8d
SHA5126f791e1df15423943292503a3681332de5c5342645428a3df582f9758c891f120c606470fb0880e109ca1f154f7ccff8d2ba0db6a9a1b2b095f942f8c29fce8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56923395d06017e9e0c47fb1d608f897b
SHA1c07122da8536e1425e65447ffa7e6d8fabe3aac1
SHA256b61843c26957acbc011e3dc72d691d68a52624af0c3df48e628973ccabae008d
SHA51204a1789f3ad34ba7e8e9292c0e96265341ddf28a70f0c14e7b0aa561fcb113b0dd7981af7af4fc45adf4b39a99832baccbf721b1e330f6118ad983f968ef2c80
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b