Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-10-2024 22:42
Static task
static1
Behavioral task
behavioral1
Sample
541b4e1b318c5cae203dffb4434edfae_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
541b4e1b318c5cae203dffb4434edfae_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
541b4e1b318c5cae203dffb4434edfae_JaffaCakes118.html
-
Size
13KB
-
MD5
541b4e1b318c5cae203dffb4434edfae
-
SHA1
256ac4a31e314a5977b65e0b78667bbc17bd16eb
-
SHA256
c277661980df156e4be8a84181efd461a687a934055289d58a7cbfde15861ed1
-
SHA512
c4b5eaea5672847dbe689c6535ae0d80c88c70ce9191037fe3fe275f52fb91fd8ad2e9a745e9bd37d3cfb834d6ae452f044ce521ff3ff85340980d6d5fd926a0
-
SSDEEP
192:y18onh/tZnwbOheT+rh6HHswVBvReYOSlhlex:qZnwGiUGxzex
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2381AEA1-8CD9-11EF-9A35-EAF933E40231} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008ae3f9e520db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000a1af30b002cb53acd5998bd27b6c8a1e1e04a3c35bda8018d45acc7b49598ac2000000000e80000000020000200000004a69e3585377ef8711c9d5ed00cc29dc21a9dce59d21c5282f6791cd9765804d900000005e9d9d497162c04d15d276306dc8fd4846a593ec227426a8c01b9dd94e30943b8c641188d609b039604978d6fc84d60e498704b420ea7289ca02802b3c2f85f7d491989cb5598cd4c22970dc7f7f18c59f1c5002de3eaebf80f63e3ce46ca33741b04380d64c0c972bb12121281be137a5ae26238c26529d4bdd33c64929fdf73554845b4b96c1d19536254e1ff72b9540000000274105f44bc90c4993a6250629da18e2c1c06d576c744e8137cf44f211174c664f862032544e1c7be4b30d5beff54a09a9bb56b20f0427d948d72bd2c7e61294 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435366838" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000887463ced0bfcab2b035939a086d30f53502d714649b2d7fc863bd4903f8f489000000000e800000000200002000000008b15ab38a9c9430c4c88fd7536b194039ebbc2a59bbfe536c8db22e6cd41cf52000000071be0187881c384ab48a375c28970c2cf83a43e9068e075ecdbcd76e6ff5beee40000000211b29a1108db278de66f66fc56b861312bae8866233545f08d3bd3817775d419f112e391c3bab814a818c2a8d434b027bf39cd891f0ca42ec810414c5cde036 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2384 2100 iexplore.exe 30 PID 2100 wrote to memory of 2384 2100 iexplore.exe 30 PID 2100 wrote to memory of 2384 2100 iexplore.exe 30 PID 2100 wrote to memory of 2384 2100 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\541b4e1b318c5cae203dffb4434edfae_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5438479cf09e91a7d30a9bb59b49b0d8e
SHA12489b90447c83743b7c998bb3f890fd04ffb9f2d
SHA256cc083bfe2c4ed4e4b01966ddbb8df8c0af039f345ed09251289ba9afca943df2
SHA512d506e51b1a599a82c4b899533c6f45d2566498e20965cc42da5be2773f557c03c33c81aa091d8556ce453d340bff8aa80cf582150fc80161a150ccae27e7ebfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ddb0fd5c02516af67aad08d19090a227
SHA163e1b6cf64e4cfc08462db27f260006dbda8811a
SHA256df84f62ff910d97714be00a3e8983458a03c95b503e104ab8838c56974c0832d
SHA512ed13105a60ebad6bfc8e047ed4e3f5727ad3a1411fcc439dc7c878ee827ac93fb5f7bde4f33725996fdf2d565b17f82223879bbadad2d59fea565b1880aaed6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e59e9d7e9e73d774d5077d9df7ce382
SHA135cf8f8827994ac0a703855295416496b6b491c0
SHA25649180f2c559e8173ace1223304916c2713a71c0ae808eff808cf4795234980aa
SHA5126831f4cb10a1652b66897acaf9216c612ec2406732afaefb1bc20850279083d04055b28424242654f11ef07020b7558521b04cba628d189e9f738aa1d9cd1cf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dc33bedf90f062cad11460101a7204a6
SHA1074b417529c8f57ee1d754b680e82e8d94037a93
SHA256d79f005191a36c0fb2eda746512500579efdb53fd9d3406a029a41c3e03c0dae
SHA512c4da83639c09a67210831547b9302c5881b87199600ad393b66d79a7a54b79551f15c3daa0aea7dfaa70b536a570232018c730fb6cbbbd2617c03aff8ad48a99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5adf4928e77715a3f2a3830c9dc570c99
SHA17a7942932cda1e132d33250748cc4dd48de9091a
SHA2563e6c16fe5630093df41819bff03e3621db39c62e25cf6ae759494c07aeacbe46
SHA5126de6ebf74d13741567cc83d1736b758c4d9607e822f61502bcf530d5c105492a70636f4eadf8ff67889abee48dfb748a09ccf9b4f470c716934369d482ca6e29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54633613604a63d1ee11b790e9842ca15
SHA1beaa82bdded9ccd5a0aec6237724071d95dc20d6
SHA256a902b7a9289364cf87a0e87fc0fdba9d61aec7bfe80f722a34b611ea9ad9a78a
SHA51292cbe0cc4baa198f9265d450b46d3a7dc598287e040d387a1650c80e98ade550d70d81b9d2e2a994dd4bc9c9bcda49e6f6495a9085c27aa8069265cb9611d3e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD502c50dfbf7db12d17618ee158ab530a9
SHA1119c80088e5ec3295e2956146ef75869df415e90
SHA2564b098e7250aed10496f3b63d24a10d006635f67be7e2bd344a34e5549cf0143b
SHA51248e3e5a317ccf6f1ed7d6ca657da0fa30eca846a44c65992382ff733002eee35f8dc4bbcf3635c3ad2e28f4ae650267b1814148e21bbe34efbf251636de4d3f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9ff277f484de965a3bc3f020ccf3a79
SHA19b79c965396548a10cfc3194825ccde6b74eae60
SHA2566e91e922f177fb6b510dbece2f171393d3ac6788f629f3dcf79eb27c280fbda5
SHA5122f28f7206f0072b49a7ca95945d48cffc909c4f889f57635059cecc3d93b9ef900a38ed7f2d76eebf99e772b3f3c674cd62c202e331037c73f4c158768e31a2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6f759cf1443afe0c4341965d53deef0
SHA1cc816e8f907c4a7227d0420af0b7900febafcf89
SHA256594e83db3cbb10c37a503e2d18e31ea88b4d0b33fdd49cb9c6280a0a9126e716
SHA512f01573404cde5ec52475793bf4923c7c258ab05e455b49b566523837be01de1c70022ab76cedb21b655f0c3ef9e2e85943dea580d1607600a67bcb451f005664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534d6566b3d1abf4ac34fbfa94b5ca4ca
SHA1962363cbdfac0310c54375e74fb08919fb4e4ae4
SHA2561aa8aae17b738d1f7d2db75a7be6d24a8db7f9e6f5134f65ea0a99a7b1b873cb
SHA5121f9cda5a583d0b132ee36347cb39dbab64811de08fad2a2b952faf1f8704267861dbba2f21671865b1e17f3e7679c1394987a4d71919b5f024d3f18b1310c37c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57fab928d80112d46e41f55406b70fe73
SHA156297892be9097a6ed00ec57a72ec6fb7c05daaa
SHA2563ae5fc74e243d54d83017d5e01363a166564ff03a0f441dc45e686db0b891625
SHA512c8013f052d72741d50e57df6cc9c540b3c6833eef0fb0a4821c7134b43a8ff65329f99230dc7b9d783c58421009cb3f9cc854c92e67d758fa354239595000a16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af69f53a41bff56c22c875f2c66272d5
SHA1a01f5712c290ee0071ed87aa541276dcb8fe372a
SHA25602cc5351c2c6d9679dca9cff8470ae22f45e53e9856b52bf588a06a50bbeb7ae
SHA5125f4e12866da37869429a54b406f21196667d64db9551d82f452ea7b15dc21d0edbfa12727f49b1e0b63d35617c02c56a3bb1964d56d2aaf773ecc889295bf137
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4c3e4ff7b990ab1c7bdf3da32703bd5
SHA1dc7beaa226c61bab8e64faf123fb639822e09581
SHA256f894a8f28fba6a198891bea37a4c35f91df3bb1dcdcb890ccbcb84677b6174b4
SHA5122ff07069125f72397a21ecc9840f8381a486f5414e99255234cb096085c6d5879c38881db68e923af716ac09d5397068dd49e0b59cc81897284ab725e206c761
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bc553e2861e2d2c584f811df933ddba
SHA1e6a10450a3442520aef767bef9b20fbf6429c0e3
SHA256e191c2c6e377f2a146ea662bbba52b0d0e4c68ef716f0281f49753dc44b05687
SHA512a80bcc1da67b0a626adb5ea8b11cab76c083118ee01ec0ba3e5d0dd39d346d4dead7dbc34b1d827eb06d28d724a587393696d750a8bced3efe2536f70e4c67a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ba6cf77d802649a377421832e5ef29a
SHA1f49bdc8a514dd4b30654fa766ee250f87480bdd9
SHA256882b88d050faf467eb8277c1255800fb318da3d518d2ac4a6b6b567dc58d4459
SHA5129b7a6fdd5885cd10b80dbd020fe4a79a4e5a666015ab809103dbc3dfda61cb6735db9b33ddd144e03b490a624a8220e2f426bf9a2972ef020b850b4c929cb97b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534558f5b916013e9a16f0da8c4fc7c69
SHA1314906147de61fbac513f03655250e581ca8ea32
SHA256f38660cb312443b139eca81012a6c05abc6c0fa3627467ab5d07aedebf9aa133
SHA512121c5321167d5dccbc388117cf3a3286da39208da60c4b8fffbffe6d0de5f43e9c403136a6d451ba4a2e687d69ca7491b2a9067f977020e88978d5b2fddd624c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562ced54b1da46fcf45fa77e17488a334
SHA14d300d8f4d10e73d9f41aefc5b1a13e827211a26
SHA2561c977f0ee429ed7dff25a2e524cfc1205a1bb5dd80918d639fdb396bf67f1461
SHA512db28db7d792689485d4dcb55b63ec1f08f9b2e05d0f2d85e631250e691bc716fb83ead2ab6f61d990b428efc793d9e4a39447d0b6ea80a71586361815d696786
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554042ddf284a63e3573d78fabc6631e1
SHA1670434bd6b0bbbec354b8a141c871616466e105a
SHA256c4fa6868d3fcb89a97198d86041bc0bc0510beecc76cc571f4ca07f4a83ce26c
SHA5128e78db054b74f64d69ac39a0ad9ef03b9c14f9014cb239a6c6d4cdac420da88eadc1269e39e915651534370dc44e64a5afd1a0fdf3b1c2a04e86ab83d5647d2f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b