Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:18
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_e2bb4f1580dbeca4a350924e2c956777.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_e2bb4f1580dbeca4a350924e2c956777.html
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_e2bb4f1580dbeca4a350924e2c956777.html
-
Size
64KB
-
MD5
e2bb4f1580dbeca4a350924e2c956777
-
SHA1
6db51a5b969480b1858a35751ed9c951ebef6a68
-
SHA256
716916eac0411ca67aefe187782fe67f46a0292b4424706a42dea8559bde22af
-
SHA512
bc1949808bf8c0b8af10073f67d6faec860c8a0492e5d9175222ad703090ea8fb73994cf7e5b7be5b6ed396590302106c570fc692e6567cc63cb077c55e0db6d
-
SSDEEP
192:mDiZimQ/wmk2hzZdKJsMkkzZIA4iXByLSw3PMer03rmpOd+hnCV2fQLkFO8N:1lehzvEnkkzr/XB9wfl9Ck4t8N
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443526555" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75D14911-D70F-11EF-82B6-5EE01BAFE073} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2816 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2816 iexplore.exe 2816 iexplore.exe 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2816 wrote to memory of 3000 2816 iexplore.exe 30 PID 2816 wrote to memory of 3000 2816 iexplore.exe 30 PID 2816 wrote to memory of 3000 2816 iexplore.exe 30 PID 2816 wrote to memory of 3000 2816 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2bb4f1580dbeca4a350924e2c956777.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfa589d318de4c17bdd6cb088963ae66
SHA15c8454609c272c778e37ec02e0e40794c78c33de
SHA25618dddb4935af44173b861105b701a9a9c69785f5a40732cee03b418a7a7e4499
SHA512e6488db36512ce33bb6289f8fd9ad477270a5055c335c8dc39f03cae60bd73d32a14524ddcca1ca09c847ca50b6a5bce21090cf41e8b1dece076754fed97b1ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d92aa5926638f2bcc75c1c36a805b1ea
SHA1e597a2d63e503980d85bcf9c0f6da6d07f3ded04
SHA256ce0b37a989108d0b578e5f8f1fd30bb1e958595c6e99f070d1704eff900f7429
SHA512dd5d5c272bb22957af4def1a3c207d9dad8ffd8af2c2c3b50feef896c625beea44e86226f48bb16a3959fea7bf0c86c689eb8fae377223cac55d9d3307acd56b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2bfa4041d00b05960a4e333097978a2
SHA1e27fc1b84f3c471db766e580f5823d44c79f4b96
SHA2566cef15476166206c71911928f3629fdbd215c8e674b41d36c4cc2d9dfde00961
SHA5128cd72e62586836d8a667b5ae30a0ff43bd05a79580d28566df1958e64f398437e45994b66cbe7208fdf882e3ecdbf2384f4b23c8b4d53a195fa4093c12e60d04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ee5a3b6a463b6596ba402bec93556ca
SHA167abeb5e0347acec1065b46412e2123a34faab04
SHA2566ecac04944f10f9790b71465e10c21bb799cffa51b0d40cd6e389612afc63273
SHA512095def8c89a7629b7da3075fe6b500f9bbfbc389c5dd84647297c1c214c8376d84177756f59fb24082464af1f11cd4d175ed06a7d41d3b96f2c432b4a99935d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52989450c06ed21a8d5c08c5944dba9ff
SHA18f32249191b2adcc713115d0a3edc11d7cab40aa
SHA25639503e8b6184d1e7b93605c91886ab7a07787b383c1cd9facdc1e13aa4976d18
SHA5124271f3c196a7e2372657e2e38c68ee5e9240afb25936f571e1233d9587a66ddda49261f4907c28c839ce026c4023ed5edd87f0bfe78ec36fda21d987451385a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a06af88d9364d178f9c3a7ab26ef78d
SHA11b610d037a677ccc11bbc852096fc98b5613b9ec
SHA256ee43ce6ba3d845351750fa61bb7ee9a88ccbd9df0264c80b7c7f778f09fc95c6
SHA5121356607f7f83c7905dbf9d28087cc2142916fc9f2f47ffc22f9c7cedc07da2a019f9747e991132eff9697a7e4cf9cbc34204100c41602a1bbc29b79d04223d67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55b8a611783222fdf39e947925f732e5c
SHA125715224fa4e88978ad48521f255da3e793311fd
SHA256c36537a75ad18db80772d720547b1f2d04e6c9c0bc7c9bb9bd20cf789bff9f82
SHA512e21ee1f2260555336ef162a54004ee07323bf79e7392ecad74179d712a4378adaf938a49e602dddd1e4018fa651c7c93f9b0bbc76a7c79246eaa9698f16d7917
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51145abdbf385b99454da698ffc8d74ac
SHA1c5ea32fdb77ce20c49947341f782f789f6918b12
SHA25677ee7659d1a96b4505af951a428706d52973503942776899e3b070a9f982f9b0
SHA5125938b11793a39ae650282f382bf2cd384c897ecd2deaec9d3284a5b42bfd20602f2dafff9604f7be9c99d8d3017e7b43bb01aa2def95d0e6e356c9cd1085466a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59316877ec92ea22e662da60d64eed17d
SHA16a2217152e452a3f49de14ffeb1bc4a217f0947d
SHA25600e77943089bc9e7b611156d5437e45495507bf3796f64bb8ef728dd2282e785
SHA512a76774dad6c95d4c38ec9374d2fddaf205545c4c01169426b2e878d952d4129bb156a4ff2548c99fe010f622c3dd64b9b64c8cf4ffcf9963266cdfea306980da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c61335afe43a377f32001e2ec2c8498b
SHA1026f98ff4309ff344551136a517cf61cf7c1a447
SHA256a2a2c351dd2ae7ed77c64a247cb4dfd8c7e715fe5d9eec027cf7643e747c6ac4
SHA5125af09a8947d7159d7f262695be109313fd62204d85cda7ad4bd593c71eda35e25edccd1ceedd6339a0a55d652aefb62b8ff3d3d9a95480802ed31900240c8399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ecdb4f00d9b7cbaf1d05e7a7e3b55a2
SHA124b51787cfc0d3b884d8fdc87691962968849661
SHA256b7f3302c0f1c65da1a6997f0093a3b6e7161ad2e6b88f8ca156f7a597ea6a472
SHA5120c87e44993e23f6ce0d35dcd041ebe84c9fd8b43e4d4ce4edadf77a6cecdce391cb44a5a6c8bd9ac3ca9547c4e36651895c453224e220d9a84ca0d77a1c511dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54bb45dce805cf6cdcf12e78470591851
SHA160479837b34e911b34c2991b8b7a334a941f3bc8
SHA25613b2cb447600567f83b520fbf76ea06c3fa866f2b3c1f9f0e3b1fc3bd202c15d
SHA512385fd58f595abd23b1730521a1b66b7ac51b3e0d733641b914dc73b0102238c5bf2a10f4a418a2dc95393ab2d5d8d33888cff965be9a29192dc14f950dc2458d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b918f08aa24a8181324ee387314c5967
SHA1b5e91f623618e605477ff0ccf1519fc32f80f0b8
SHA256e597be29464c45af576d4011674c9553f4be339f53ac8dd86240e271bdc445db
SHA5122a5a1d1f5a2157827fbcb7017edb849c684737a96fcc7909cb9780e599d5a33358f9a71588d8e10a10e1a4ecd3bf519017e60d5942cce7fe0984af75a88c3638
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5615ecb22a243917d1b6b5bce978e4fbb
SHA1689e5f4d1d40e8375ab35df36aad4a4bcd9dd584
SHA256134172e88f707550b5c03432643a691190d6cc0b86d104a9f3a488877e1cea0a
SHA512f74947b02ad54c2ef56467cd970eca35b917ff2300fead49c4e12d91dd389c93a50c42e44e9fddec9677f446daa21e995e54174530bbb69e1404e6664861624d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cfabf5c1f6229f9052aefcf95a1668e
SHA1a6ed90bb5ed381699ed1dd821d62d21800198a9c
SHA2566a4d6b0b802c729a5d6937700e72ddcdbb1d91550c6a694a9e041cdb5e9a3714
SHA512aa59530378dca7b9aa71ccc9f23264f15ce5fd242c2db9d50c5cb5fc652f768f26ff090dfd168d99434169188244019250b675d9235fe1290359bf79255c90b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51de8afc8e4aeeaa1fcdea93e61698281
SHA1e30c95181fcb3bb2e77ceceafea1450284f2edc8
SHA256f3d7f065796cf1b1ab6666eacaf243631afd9369f13bf81dc3618343446eaaa2
SHA5127ef2f2791129795a4a9a16a485db39760c2eb50fa00e3c998a23f1886472b241b9c5a750583ee7ebf53fb5c531208afda2bf2c7553548a55ae38302334b2253d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50967be586374991dd2ced4329c16feb3
SHA1dea5ea2d83887d48ad2b0a58de09a51570ffe80c
SHA2567b3d17fb4c11cd79871ba4ed1e5c6b97e92da63cdaa4fc375f3a87af5f19528b
SHA5120bdc213ce665c95b8dbbf5466adf767ea52447bc1169408a0f4b592460405baece1c6e48d73402c833beaacdabd7f8870d0d0a282eae6ebf638485f8a8cd3b74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55155e2329d81014febc412359a30dc07
SHA184bd4e161ad09f795de2fc102b7a43ebcdfc5299
SHA256bfd8e53f556c44dbfc09cba8f6e20bd4ed999d7947ff07397a73c3b5195ab69a
SHA512d9c82944b552b5a47b6b6dd1cbc0aecd35e8d7161562f7f6a0704de166a167fbfcdde5b61409286c4a3caa93d67aa2d457a73d565dea7fd81b28d2a80c7efc48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515fd184c2d59ce6e09be606fc77f44c1
SHA172b9da82921a575a46caab4b40ef0eac9242eaf3
SHA2560d4d67da2d545ff7bab4eaef4f608913776f46956ced95f7fb9568c5ab1e9042
SHA512ea2ef688a2429d92d9c1a915b076b9572abad5f200e566154bc056cf6aa74baa5073cf63fe96b47262134b477dd08728af880f3eb5d94449424125677027d086
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\stylecat[1].htm
Filesize550B
MD5c53071b5e066a5f0a8d651bec7d6a3d3
SHA1e6381d05c697f1ca1ef7190aa4b1e219b94c1328
SHA2563a4af7e572660cf612a66aeca818fe4b3b55ad6db9a9a394b105dd7742ed903e
SHA5123f1ee125e0dfbd5e7792b67fb8b16faef0c37931b0f32d213dcb70cb986299d95dae890e25b8559fa6127403c5ee04cfad9c849699375a2641ee7c238fd8a458
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b