621f621719800a8b1a24d969011a3481839675bea79baf2198e465ece5b979ef

Analysis

max time kernel
136s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7144d54fd1d566f8da3b5e39255b5260_JaffaCakes118.html
Size

6KB
MD5

7144d54fd1d566f8da3b5e39255b5260
SHA1

c4d92bb6f3fc5856016b8b779c5393492075c0fc
SHA256

621f621719800a8b1a24d969011a3481839675bea79baf2198e465ece5b979ef
SHA512

f81b2e3a339ffd9865077fe92b453d34ee95190ebc87b80ecc861c80b94db1f614c6e8816a8f8a0382b6b125ac1cb76fd0ce8f6ed347c1483391497c39858849
SSDEEP

192:5W4lIoaNNHofJiD1iImmm7mmmembiJ3+mmmP:s4lI5NHS0mmm7mmme71+mmmP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428104078"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33E6D8B1-4ACB-11EF-BAC8-7A3ECDA2562B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d830fb0a10804c45e87ceecf9fa8c213b678973f7d2140a6f330f25737638b40000000000e80000000020000200000004dc14928448cd25bff2c4887b0f6a90a093ccf0f121ae24753c323fdf4422faf20000000f16216f50e88e0e6663833a61f739c1eee3cfb81de91ecae9c5f15ced581bfe140000000c6da01bb72e5261e0d7a228e38b676a7b8dd65eb3c25534a6a2e976dc7cc84893e2a727a94f753c095c3512fd4933ab1159729ff562f77c3036b8f2abf2b42c3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a55309d8deda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008122a62bd5312fec156f436a0a32477ed927aa6158f057f34c6de394652a5239000000000e8000000002000020000000c7f1b612ab29bd3f9c09ecd22fa15598bce40b800171ebd2f4e321a768cd383490000000828d1093d84d17667a6008143b739871929c996f120a8dc5be9c8ce74fb11f0d51f5d3c0f366e8b048ac37e5ae572d7b3752cae04c87bfbb4356ca8ef97d61572567e14c046783bf89a719933d808422ef23427293a2859c11a959e84062c88ce78f64e34f656b212b2d870d808eeb5f054a861ccfaccbc60fa656302324f3f7e61f6ee0c4561640797508f776a8d05b40000000b018da838201e353b48d4f8138628dcb0615ebc361d9c6ab23b11d6f20701241add0b3942b8628d23db468aab8380ec118909f783142a14c9dd757ab36b070d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2348	2056	iexplore.exe	29
PID 2056 wrote to memory of 2348	2056	iexplore.exe	29
PID 2056 wrote to memory of 2348	2056	iexplore.exe	29
PID 2056 wrote to memory of 2348	2056	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7144d54fd1d566f8da3b5e39255b5260_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ce9ca174aac3e67d912efa0c218a62d

SHA1
a4c83562b2e8400063d2be4c991f48ef8c87bd29

SHA256
b529633ebd1c78d2064a47d31a2ac151469111c0135872060516bc307b4a7286

SHA512
0217838bc2cb8125947e4911c76f6354c8b3eec997423b710fa3b7b98ab0f4985d21a4613910d64686799a04caae358e6b014119f85e61c58c3984f09b2e63a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c989b35025d1b2f7bf649db3a3a02919

SHA1
31fc8d9ffee925698e674f79075c09392155ecf6

SHA256
8ca67b6b18c9c72fe01a98373a95ccc8de7bdcb817b422df2bc8d5cb3f7ac37d

SHA512
66f3b2c15c76423a535a65d0163d8dee693cc6029df6627e1bbfa057e2e46061f67fb00b3189bbcf8ddc3dfbe6bea840e736d955aa4d8c215d736823708dd8a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b594e2e8cd25276fe296438655601ff

SHA1
72f1710b8c52906ff4be2150ccde0c6e7dc8fe36

SHA256
0f2df61ce396ef6d14a72b5403990470a74c3c8c615e682fb72acd92eef1fbb2

SHA512
c500b958bcb5768b97525c74f1baa62f92664463851c54a375f112b2323a50f1cf481a89595973e83239100ba09f5480e6ce6bc3b4b8548bdae587f7a3b65e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3c461a78299f4797d8c303902c52967

SHA1
5ecacd918138da79b8ef083557fd0d39c83acb28

SHA256
110b0c7f5b80aaa1ea0c5fdcfa3acd86d551ce3a8324645d462bde0887e22fd4

SHA512
5ade5ac469ee0d85684f48e426fa5463b023a22c3b50ccb848b32d3dd52b2813e2d47e0aaa087000eaca86b71b78f16b189e8410a3029964dd51a7d9a911a04e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2980c3f1c6bf502d8a1f3953e00ebbd

SHA1
cd431d8ed5638f632d635c0eae410fa87dd1732c

SHA256
f4c6d422ba7487b15a323616f02ebc19e7b47a80cdf4ca4ca71d449dcaa8e821

SHA512
a11bbb4060e108a0e4a96cbbf092690a1a35aa59595822deb6587f94c30f57fecdb00a263ea305bd36c42c15e3c13f7713ec5e41be49c25d85ec3cc3f0d33315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67170d46df4bdcb4186895fb29424e5d

SHA1
8f1e61f63ba19ae1e48eccaa755a233aa840c891

SHA256
93c733b304f8b0e1cd15ce8f28e0e7b5ac439a1033f0569983e08d3dfe972143

SHA512
25e1f96ea014dea0a26037b9f1ad2c31e895fedea68899e4f9310f5066e0a0287af5b7ac43c6032a5e6d6ba9c38563693a396cf5ce33214938ec8cbb8e9bf47c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eab1c4a5b077813614112c22964e16f5

SHA1
f7ace4f8a3d6b5dfa0af7600a23fcfd724a11a42

SHA256
d1e4edaf0f0dd2cafc997d441ad5d6e00c91dd56b2ed13f6de57e219d06d0255

SHA512
778469d1b164e2921b0ca1477656bae642112d33deb35975a3657b14dbbac35f88c698102c7cc0d8da9c487b065d1c3f00ac6669547123f273a09ef33859f7e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c59493b49b5c4f519fe064143fd85ef

SHA1
ffe206c26074f3e26cb641a8b11e833ba3b6325f

SHA256
8471030f696bb6d126100a951029b22c9ad005a29bc927bb0918c2626eadbc2e

SHA512
b00907909902089fc2361bfb9db6a22bd155461f9df6c5e705f7078782f310efc680bb6955217fba1d507da40220dde02b9384c6b6b265be033cdf7a2fb2caaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
810820971a1a02fcfa770e415c22ac88

SHA1
a89aacea2cf03483a42efc530e7c22e7b7ef81bb

SHA256
66a6ffe8819f06eb5bd2ff2e66a49d87b47bfa4db860cc7501e03f495a7dcb4e

SHA512
a06881e6de5367d4b4d89117883e843102ff0e816232e17a6a7186b9e7dc76232c15f9db585e61506741f5c82f999042f6b857b1d8e2ff9bc160d56bd1352a8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71ecfdeaf44ba4c99b9e3a9fa96c55ee

SHA1
2fe1e85f197d60b5096278f46d16d86ff63924a5

SHA256
921bc4e77625ebe22c7ca337eb15a8d5f0055be8470cc68dc7363f45461b7b04

SHA512
1316ef44d4929e4e0ea04c301c4498097027a4d0e6476ec59347ed3e49067e40a21c40f4d79a3b442340aa35d2b6f24f3eb956c3a687baf40489fb6098e2c6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9566228365852679f48fc4105194abd

SHA1
290b622bb4ce435a8b26e043ee4fa1b71b93c49d

SHA256
6076a262c7ebab10b4aabb985a5f3627179020563f3b64b9795f7481a8715f5f

SHA512
efa2e69fedf5cb928a670dd30088a1b07b795366f94909448f3eb132206f28bab64a671276e5ff232350cb35907891cb0e7bf1943b28b9941f19c6405c186262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194c886b0e69a777ceb112280cef88c0

SHA1
ca29ff21d9da9a9559f51148e9177db2d4f99ae9

SHA256
f0526dd8b0c84f0d348f586484b777c81b2490071b7248de49f5bb9a2a9a805c

SHA512
880492973903be5f1b7ff5a2138ff89e9a077bf1d492da338dafdf21b84516594e258545cece593bda7969c6ce5ac773be137b0fddd5089a6e34f4ea985c1b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90a5477534d47a0dd19ee6b899cdc924

SHA1
407f11ba4d32f9874319f5ec1adf5b1b553ce0a4

SHA256
00322dc0ce92bc0e48bc80437edd9d8cf5a1c894d0b4039f8f6699667f80e3f9

SHA512
b40d8a8e7f3de76208249b27894ed11f8e31a3984cb1f0ebd1ba615c8f5a810ba9ff7652f5e19167a9746c9bcde74a3bf2fa59ae59435be290e1ffa687c030a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbdcdd71499d80b5864f95c5c0622a0c

SHA1
a224aec2c409e3bf7fe549f5a479639b79ae61ff

SHA256
2ad621a46bc968fda04170f0ceac662844c86b1c77d5067abb71dfede14020d5

SHA512
1232d7fe5067dca2489fa195f5def582b4ee2d5d2dc2cf0135aae23e0442b4bea16cdc24b19e63d9fea225696af213a6f09dbd5d424826d79c375e6e21bf39b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB898.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB947.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit