6230acb6612332fe105e89e398a843778106ad5afb5b4b0822d750308876ada8

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72545930b46df1b4711edcd1d79562e2_JaffaCakes118.html
Size

122KB
MD5

72545930b46df1b4711edcd1d79562e2
SHA1

6f6aea1b1f88233f30c0a300044b55d9dbe9e4d1
SHA256

6230acb6612332fe105e89e398a843778106ad5afb5b4b0822d750308876ada8
SHA512

69d10ceb6f98f144f233c7b3223bbc3c1a1eb835c8326d2b6b9c806622b2e1b021bfc318aeccc6d3cb11dcc25765d261ee03da3c9b48e7c0f784f4d550b5d2a2
SSDEEP

1536:U89Tu9pExeW1gAJLtLgQKyQdL1Ree3UZ7iLfi:Uau9mxeW1dX1cueW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428126469"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000099d68da9834ca8d0be32d0a325a7f2e1c3585fa1c7451586d3e86ac39378353a000000000e8000000002000020000000adc98cebcb048654fccf557174d04fc7f523b3fd4a4d833a9150645ce523391120000000feb776009e4b19394aafe9d8326c4447142bc6a2c5a385419b494cd402cbdd40400000006ee6624eac2b71dfad7d64fcb000dd466db59f1fa410d8d4d3aa9cc1c0578f41464ddd8bc8638e8a8cfbbde82f78973763a240a448024963e11db70c812ddb4f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bdaa450cdfda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{575C9581-4AFF-11EF-A1CA-D22B03723C32} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000002252fc2d33a6a2e85b0d5c6f2670fc6e4a4ae1de1dbd605235453bcef0c9aa68000000000e800000000200002000000047d73d4a1e725ab7f5a759691fbcaf2e105c7f49d6e4fd65bf91c7c18aed5fbd90000000f8b76f40839341e2b197d4bc6b4446dcc6e49f0ff073cf578dbaaa8c7727bd730cf0b41c2d326711adad30af3cecdc11b0ed373f0e3982d231cae91c308c90a9e14e6d247ef08a513cad938fe04165ccfdac2220278855e938ee0039f703794326d48a4d2ad27fc0d993aeffe03b7106537d5a9f95e560b2eec9912f37f3f91f7a11b0541b00bafdbbf98076e5cb00a440000000ffeba37ed3009a37209d937a33af09d1498e0cef994203c7a295874406e6409670d7e7e6e12562cb49745819f119612056feccbec78caf0d50802f6d98546ff1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1532	iexplore.exe
1532	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2568	1532	iexplore.exe	28
PID 1532 wrote to memory of 2568	1532	iexplore.exe	28
PID 1532 wrote to memory of 2568	1532	iexplore.exe	28
PID 1532 wrote to memory of 2568	1532	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72545930b46df1b4711edcd1d79562e2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1532 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30146a88e4e1de4f86b9136291593695

SHA1
5ec0feda0812da8fc9dbfdc844fd66ec1d23533f

SHA256
2d9bca5458620d760d34b94e7dc0c187a1f559af698ce45ca37eee0085c336d0

SHA512
f652e8a9874a56e936b48d22ea4080a6398c0a9c0fbfe0364f3749411ce699a1510eb4f537d49cc1725d93c2b6fddbd2bd88bb9dc65cc5181689d12c89cc7a22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c62f7118c9df8186e3fca983b32077f4

SHA1
0f7aa9b6a16a1244d978686403eb9708e0a0b258

SHA256
ef5afa7e97cad687e779d2840e496a49d76779c0d4a2b67cc2e1abcffd4ba6f6

SHA512
29b5527246a9ca23550c34c73d24d3a729f7993d62fb09dd3a7699f36fc2aa3e285e2a70fe53b797c2e2202be2327400a66133ab973ed3fdd7ee17ff7feb8121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0fed4dd927c13707220d057de853567

SHA1
93c3ee3db869515facad6bd79a426ca5904b5956

SHA256
37d66b5e2040e98197e31ef81df57b98a3aee0b7619aad2d537443db01252145

SHA512
5fc7c8d4837212e4d45a926d20d4d70ba4dabbd6c1a36c6e5b7643ded73d535949fae5fb85300b32bd9eebbdeb2b12c2a6c399b143fef7d1c99789318b09db74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cff91c1eada55b8080b8db59e2f1afef

SHA1
2d3008e169a391938a84a7f1179430d969b2283f

SHA256
97dd752d71e5c2f388c0a18acb95f5c4b24d68b2e4def7d012bde347e7bdc658

SHA512
543cde0a177226750213216602a0ee90780d82170c486cc98d495305a679987602505c08672aca6f42d6f3295bd0d80dab31bfbd02f51f60743df6ab1225934b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d301c24f527fe3bb1c383730d780cc09

SHA1
5fc65d3e3bd94fc56bae9f17b46372d14947ae3d

SHA256
e1301fd922ea821b14facef8fc18f5eb5860f9ed5203a14856f7e41fd133ff8e

SHA512
ff49363a116360a35297baf13df7f06ba35aff2c8a3f0101a54b3aace7e7eab305eff964531a4ae6cd2e2f9d2bf19422f05e38f5d8da18a8325f64e1e3989bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3440228c700aa2515ac04742dca8afa

SHA1
2fd572a45d543a29a40ce7ef9ba169df32f8764e

SHA256
9e6b47b8a62f69b481f8a2f01a32daccb793669b1f50d9c25376233f5dafaaec

SHA512
17cc5205ab01422d76bf348fe36ece20f58be9bbef2bb1f1740516e61b0e2b1d6f544858deff718d23fac1616ab7486bcf17a9c85680500a61e9322402ad9705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58b5cb2e424aabfdabb01c219bf49de8

SHA1
8e27271e4fb33a5dd263ef10f1139c1f69aadc91

SHA256
ff8a2cfcdfa49d3e0308413870bd1f73cc59e2cf3fa9be55e6bc51a6cc46a4f7

SHA512
ec19293f1ba019a7b10671ed8787c2aeb6aa10a8137b91bd6d71ec539930407551bb7aa184f45b6249f5eb5bf7a0ea7cb1b3ced23fbac2acfebc61b7332160f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af74f36d64dbe28db52a18a2eabcd0a9

SHA1
bcc2ee444a403048e9a68031eca2eedec676c491

SHA256
b109bb6a93323306ad2c148f189484abc51c883b7f6bac44203f410b9f505f3c

SHA512
66780d965c09148f9830778e6102397377874e6875615d03578db6eb44e6f0128645aec1ea6c04af8847f739aa84d36daff05a58610a519eebb2cf692cd64d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0c07c07e306253bb44ef1d1fa8c1a9b

SHA1
f3369db969b6adb7443a5add7bf0d910e2f5f011

SHA256
052e45ee3bb6bc6dac115ca57b292fcb7bd86d03bb46c7477f98b52bbc845287

SHA512
b7ef043a4c4b8ed3d8cf45c6c61af1ebffd028e19775d7ae343ec911f488050d5b6ba28d07da5cff31247f0f86217fd07ef5ef6eebc54911a6f705954c224ab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a6441de0c95b1612261e02898dff8ee

SHA1
b7af931ec652e35254d4f8fc1960dd0c51e7f584

SHA256
cb76755f82481ab1fc806dc2704e50d41866756c6fa510e1eaf814088ace9c75

SHA512
0210a2f2215409589d5b06ec95a1c45b7520949a984e4fab4e74c4f301cf1c737f99dc5d6cba9dfa1c4812d29e5d290268995c08857a0b9298a59848b4f12a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0620d106dc089b6e9a7601e5ac35b7a3

SHA1
1e49f377ac959e4cb99ce759efd9aeb6f23961d3

SHA256
88738397898a3389ec46dc7f0970a0c61ed578d9b3a78ea3816525f8bebb3241

SHA512
3da8d2ee588f1bdfe011ca78f2d29ee10c9cffa89545686ed59d44ea69ee27dca35cea57eb5d086126b1d2bbc7457906d651888d619229dd2e601084d76f3790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fc6e87f1289cb488d10bbdf43ab7214

SHA1
a467714b7ff2f885ee04fb459df291f2a14e8952

SHA256
97daa5fc0780dce18088e0f324f4dcd306c48e4217f15b42fcec49d4db44a697

SHA512
2d5a2d38cc5efeae0d15a2ca5a9d53aed69c5401a38d46a4ae7f7353c2744ac62f21223f2e89fde1d7a4220205d3e5372cb323f949db40d033132d1a017ee704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49130a9123f3e2f50c81b031eb294e8d

SHA1
1dea1da56d09ee268b7a125238291c94c961453c

SHA256
989d377541237dc3b4f13b10e49de0983289173a4ead37b0e32d6971f971012d

SHA512
47860f6c7b89368ad4b5d8badffaeda7b4ec30926ff20776e9dcb9ae2d5917f00fc9c7c6f1fae4172291b06c8a72eaacfb925535b9d1d1135f0de50d57b3aa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4CE9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CEB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit