98fd326ef72700c281f32bb51ef5df2898820d522063223ed42982d2d60f0ab1

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68169cb25bb7c8e7b9f5a945c0a30794_JaffaCakes118.html
Size

11KB
MD5

68169cb25bb7c8e7b9f5a945c0a30794
SHA1

43fa78f9734864df402290cd08bd6c9960f42f6e
SHA256

98fd326ef72700c281f32bb51ef5df2898820d522063223ed42982d2d60f0ab1
SHA512

b0c9ce4275cf3ecaab2465590a65948574f5228533789f1d356c095e0959ab2a90b56efbee7f27b074f4e55ab1d3b042328fee9410cd51adf09ad3529682847b
SSDEEP

192:rSwi+2CMgqw3d68Va+rYkfY6hJ6b36FyLO3y3E0wwGog2V3uTSlV10lEXytstMtU:gCMgqw3dDa+rYkfY6hJ6b36FyLO3y3EQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d71222cdda811bd6e81ece94dcd454c8a9814ac6943254426aa03f1037892632000000000e8000000002000020000000b540f8a824aa901a61a2959b978ca6ff2994940622f310eb757bd38ef610c9e7900000009fec8f24e3950682c5315261fed6113adb46f2ad4a2a7efac36d8e1a78b6684253bbf71ba0d222142092c3932538c7bbd7110d6012b77fc393f7a20e7ae72ebfd7cbf25647fe6dc2f474b3fb71d9478a18dff583b86a99ce5e3db0a96fe3e3c73ec143ff17355a4f60e71b789993dbb4b6b43bdc80ffd75eac2258c8bdbd34e21600b46a6d35c3ade1deff2ff637023940000000a2448b45e87fa00ca5c7a5c976a416ac8347618505e4e22239beebcf427165a1a132f75d842a3a27406f2f09d38220de3b93fe5fe8edee004b8deb7b47d8a4b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAC344E1-4905-11EF-937B-6ED41388558A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f774cf12ddda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427909418"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000004dafdaa8264543ee499d5b2578138c5efd7a2b3cef4f640d66960e9ac843264000000000e8000000002000020000000a6ea548421d52b6d49a240c3b285bab20da01bb78a1df63f91c4c6f87886a52220000000bfbbc6bb1b841f7095b141c7412f0cf9171b12c487d29154b883b36a3642a5284000000037a1176d0cd9e5b35455b3e0e86b34215627497ff145c500c39cd9ea014b2432da90666bdbfd343f8652841b1cd6ce2a7a65f576aeca0321fbdfb4bf735692f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2728	iexplore.exe
2728	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2740	2728	iexplore.exe	30
PID 2728 wrote to memory of 2740	2728	iexplore.exe	30
PID 2728 wrote to memory of 2740	2728	iexplore.exe	30
PID 2728 wrote to memory of 2740	2728	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68169cb25bb7c8e7b9f5a945c0a30794_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff4b2f38d7963823c44aafdcf09d85c3

SHA1
0390135f53757c3b0413680b203f981877aec5f5

SHA256
b223e0b5bcd05390bfe3ae1257eca80509e9acd27f48b5f3c5f5f359ebb5e492

SHA512
9c82f47c2d32d8ebac205c5b1ea138ceef129a7ac3388bcc7748e25f75f409e5d82142e39be67757efe6f49a03af226b6138e58d6b1594276a53fdac93714f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
700d4e6b91a93c1fed267e7e7c064c3d

SHA1
d972ee60a974265c46956105fc88f5b657b3be69

SHA256
25576aab77b5a84bac870211e77c72b33b8ea28b2ecdfc0313cb484cae2fe279

SHA512
21b6afe9a40d3ae6e70aa57778c3203b36b104cfd9af9a08980f6975e48fd8a1492ac21b4a19f165c12e11dfa1d341547d112e3f38763880a0fb8426ce186cf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95ee9b473665463b1d8c268dacfcb884

SHA1
9bfb8bcfc1c9acaa453744dbc560bb78f8620957

SHA256
4f29bcfa6a63e760308e0f480c0b0226b40f32fd6fc0bf0c7e04ecdab5391967

SHA512
99a822c6690a5d76a2785f982527a74a36d46ea5d36f89f707d4b922450831226523f3b7cf3eb4a370526a9e1781a0b0f5f308ab3747d228e76ec026512d438e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
935ec45c18bf9fb67ec6c7d7632815d1

SHA1
df2fb701aba576b6b67414e307ab159ede9881ed

SHA256
39d4bcef1e6e8babc5ca08d8efe36054be0c91f78050c0c511a1c2237a5e4d36

SHA512
6e98815aeb7f70731bb25ea2616e45afeb63bffca1e54e88e488845c43790127610409228f271f5b7b81b53c555e428419e3acbd1910b903c2dea731acec2f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0725e0a50302d04a96d9ea126f131553

SHA1
4b97a7c992d7ce0ad44fbab001aa6dea25dea464

SHA256
df818d0822d650907a1917dd10f370391cab772faccd7f19a1b520e6dc96ee03

SHA512
60b30c9e82511e7fde301802cbc17102baea257745d49e00c2473e7cd9b71b74cf80ec262ec98267562b6c0f04a6e5dc5b9fd225ed3236db065b10be9da3f467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0240714e77fa0c9fd846c0846982b66

SHA1
baf986601bfeec021099a517090056ecfcd00a6f

SHA256
630b7cdb538ba94e8fa3780a6ede807749047fb728227db6f3a3df0b54e1dd82

SHA512
3c213b2d78e3b2d3170bca09766946bc04c03350d38ab8e99593e8ce9f0265f0a0a73b2c456755fda788e547f2ad45a942c48863efd139aa850cc65d4763f353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66d2bef3c093241f33b34d652cd3b38a

SHA1
0a2e6c36ffe546f979c54906ccde6d2a4a2998df

SHA256
d2da9f2dad90c6277a8af1b035398e544b39b69510f7520835ad3054abf8bcda

SHA512
66e7589dd8c0dc29eabe232c64a1c292a399608f686fcae1bcd8007dd2c27be81670164a2a4358d8622c38c448780a8aad93cd3b2dbd5a7e4399eda621dee3be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af4316ac90cacb601e4832a547f004cd

SHA1
8e5ff277fe4f86012f34a6271f819ce4d835e1f3

SHA256
a71b394f99c823c36cb18b572a6c2bb1c892e6ef2c0d58dc7c941aafd6c7fc29

SHA512
1bc1756d430754d2dc81335d073161304a901f78e97da85c2e5df52f8fbd85242542b29ffbc99b6788785242cd9fbcbe1e2357494cacacb0e9c046d10cf5c008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9929d2e00e9eb30474daf54f54b8cded

SHA1
2a674a8f076ab62916dd76020c5c411de13bd5e1

SHA256
f516620fd3993de2358130bc4cbdc241d330fa223168f9aa690b965e415522c4

SHA512
e10341cd0da25bf60710f4016897485078cfb043858f8c8685433f96c2599226cab1bac0834e1c4fcbbafb5afa18ead9383464fce24dab68237471adfc489efb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0ff7656f8ac40787fab2788d6866521

SHA1
cfcc91d054e4bf5c0258e31d239c92919c544178

SHA256
8e726671c9bca92ceec5dd732d858226a85558d6e6dbaadb398f21b5f93a64c8

SHA512
2ce1bad04a058327a2bdf7f8c677d64b5f451db12a483a5163b1a5c6e34d17c60bf7728acd10f5fb93c2a2f285fa64895280a2b184b6178b2cd867b0de795d34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d61f7315aa3dcc5af8f04a0abdefdf2

SHA1
268f3de36d8e32c735e19c9606da0fb91a4089b0

SHA256
6c9f13dcf038b92921e1aec85b00afb74db26fd9e7b2ae09f214cff18d072f75

SHA512
dffdce498f18657d2a890082d37c6ca54ddce7f6a32e573c75d9a93717d8705f1cb2f7313e932c3483e100c00e8eb88a659c47b609da74101952bf0d787ae15a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6f08d62578e3d561c1f5a3112094a51

SHA1
8e4c7fe5f17ac9ebe49dc2b9299f1b77d56bda08

SHA256
dd9c13292b6c20bde6a5188de4ebbaef7b4470be231a06e99dbe9373dfc4b4ae

SHA512
aa9318a5c6dde84bb0cc2e302baa92cac82278f6ca117fa97f33559fc4290dbb77f6e2e25a5809f4291a101d0d6ec71561c2439bcfeb4ee1cd9b486b793bc531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6efe45e66076abb7cc19dcb36dd3bfa6

SHA1
67857e39c3caf9656d3eb81e401cc46723e9b3d7

SHA256
45d0e426d9d52d927c769fa822ebd3229a8529c868bcbd1a5f2189a4e3a54e8e

SHA512
d92feb45de077eebdd6b84f908729fe3c6dac6833f2148ef873c6b7277e8b42b6360f164616b26a407d1dec24c6db1378eb4167b8adefafbeb1099f4ce551be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c8fda18a0c524ae72e77b1e5bbccab7

SHA1
74c8c3d5c95467775024861346e37af1ee7e8ec0

SHA256
479e893adb34debba958daa761c362d9e94a950f99b8eb724cb800069db2c45b

SHA512
35a0d041ce042260e1f2a2b69547dfe026b5078f738cf1634ee0daa1d53f68f55198c06dbd2cab6629944ac6b2d7615ad979ad7e3ef8e9c37a323bba0abe5384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
351e305e1401e53d382f0ceeafa97b18

SHA1
af02a749b2f1f6760b2d3e107fd9c4aff02f1d09

SHA256
7262331da03b34d919df5e7732d07d3b33853507fcd4307faa63d7da1f24c13a

SHA512
519720eddf5073a93e03a22f0b23c13cf3c1d019c4fae30db180fa22ed4c65d701a140fb3ef97950b7e8ad1d349d246d81e866cf0de02c0a5f89b379c36d6576

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab66C2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6770.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit