2d9d40a22a7dee98b1adb5100a95d320563efd48cf26485ebbc5ba15fac2599e

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 06:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77325940ebaba96c5194eec75811f437_JaffaCakes118.html
Size

53KB
MD5

77325940ebaba96c5194eec75811f437
SHA1

f0d1f7639eecea1b3560bf13087ddc8979c060d0
SHA256

2d9d40a22a7dee98b1adb5100a95d320563efd48cf26485ebbc5ba15fac2599e
SHA512

0c65c1eea373c6877520a8aacaa06e49b3c4c7d8a73c8aa88882d054ef9e0f97e7a28306650118676e1f706eb53fac337b38eff996bd0ab51a9c9ec059777141
SSDEEP

1536:CkgUiIakTqGivi+PyUGrunlYm63Nj+q5VyvR0w2AzTICbb5oL/t9M/dNwIUTDmD0:CkgUiIakTqGivi+PyUGrunlYm63Nj+qx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428483895"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000042763a2cfb5b5037078dc89a82479636fa83abb22e6a05fece70714f1f85bd68000000000e8000000002000020000000b937b559d9f0c120db91755506d856db88bbb9e901e9a30f7e8404a081bed33b200000006c6387e44a142c9f676274d7c8d7b095653b3348c536852ed97f4ca6fcefe14440000000d935a8581750b94b65b565e7a20b897d98d52850f3846e34ec9a0443655baefac6ae2c26a0ee690748e52976324dab96b6dec96dc73e8644b9b21ad4b63f29fa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9027e9624ce2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000049d550e8d8a70fb41ddf59b99a4d26f21dcdd870d6b2d811f9398ba99daf6daf000000000e8000000002000020000000bd97fe4ee67fbf291702296a7e2c03d24c44901b64aad5f172ac56dccbb15ab990000000450c7db28a01697beb79f0d2ff08148fc2f6a376f4ff3fb60318bfabb00846cf5ee6b0a6849615d5f25d2e706c98057112b548de3bb04af1bd667b74107b2e782e72292d34389b252284e9246417bf9a304d6cbee8b8e4946b0d218874f4f12c6431220bb8c3f94e6766132ae43c015a66483a10d0b270894cf7eeb5d2388d868f02e4173442c808c08e16a25cc5d300400000001748d077d18594399a9133ef439e02cfde4ff0b6ba4beac67c3c0054db237247f97035226af24e7a71eb7c40bab44b44f523425241b4e614854837c4390997a0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A56B091-4E3F-11EF-A550-D692ACB8436A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
980	IEXPLORE.EXE
980	IEXPLORE.EXE
980	IEXPLORE.EXE
980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 980	1736	iexplore.exe	31
PID 1736 wrote to memory of 980	1736	iexplore.exe	31
PID 1736 wrote to memory of 980	1736	iexplore.exe	31
PID 1736 wrote to memory of 980	1736	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77325940ebaba96c5194eec75811f437_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
580275ce2754d90394f0cc48fe43bd62

SHA1
f40b089c6600ab232b8bd6fa9e2afcab4099361b

SHA256
86aad3e9171300831a02eae50c7f3616ecf4dc74199ed5b540331bdbcc255f57

SHA512
627cb9b43f3829ce57a27a9fd613710f183b51dd19ff73801efe26aecd5d239f2e1245291382e28d277837a0525712beb851f86953ddfb06261af07a5728c1a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e252869f7ee1e4c5e5254942e711995d

SHA1
cf87993f33e50307e19442254c41ca1100595daa

SHA256
4301745c17e3fc4bef231305bee14dacee3996af8cad1a8db9b5076dfeb33de5

SHA512
d72a7428790caf2a58c25d4e9e68e929d1c8e5793c52af930c07a60cabad654841764d1750ee4d2ba96878afe28aba5e34c36ea7545c86533d7696f4276ed4dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e48004420080741b9dfa12ae99c8810b

SHA1
6a6cb7e1912b9742f65f330dfb696e24e8240ccd

SHA256
35630e7947fb06721d1c8962920384c0cc23981dbe0d2deab257323f9fc976ab

SHA512
15c1fa6863f36c7f937cc466d602d233b1a3102d9c13ec3bfa172c440fb8f8243b82d2d2cb4b82d9ffd6d32e9fcaf1bf8215dd9ef2aef0fd717784fab133305b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f9bd1782ee4dc1793300033f130e0b9e

SHA1
a3573c4d6071a94045f10e9540b6f83a826e9d20

SHA256
e4c7d4399006e427251dac525ad9e12749b8a863a9a2bafd5f90a6f193bca116

SHA512
12eacfd4769c6b35c7c1c4b562d4aea7c172e9e71e3d0f17728b559954fe76ba756ff8e6b4e5f5ad6077bb3b6b3217fdde8c1c3d4da2ba90bd307064c29399b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0e17a42eedd9f6335c416b97ff4370be

SHA1
027460d58327dd8d667378f4f501f2adebc3b3bc

SHA256
a3d01e278f24c2051d36f0c55b515e272e80ac50d7f26cf7aaa47c8253924e02

SHA512
328467c59bec086488d3d0d0ae2f3d7cc845315bb90f2a74df4b9758376aebdd4c588aa3ee6c5dbf4acbc3e9d12b98f03c85bb0342c321bf598ac8e37889a747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3aa86995317753b1e2f00d463a83a42b

SHA1
b9adae9e0dd3be614cb47dc80918f5eabe44e7da

SHA256
32a9941e629730c182c11157376c4da1e510b829d1609095ce9ce6bc6b3eb4e8

SHA512
f293d41eb0d49a6126633f6cc1b43150d5dc511043f69f4bbf6309e8a5c9ea4f0674ffbbb945cbf4802ea8c0373aa6abde5546af9b950f2b587c3646d8fba397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3ce19b836d808c8cfefffed00f8e9fd0

SHA1
35048871cfe3407a394a8162dd4abb44726e0cfc

SHA256
0cee4105d320dc6003db45f64854922830bf1d87a8bd7ad609e4592ce69d13a3

SHA512
a9fa715a59a75dc502017fb1b6aff57450b3488cb93319451c77f0deef34652d9e4f59f0f9aeb27a97376bef2aad3c3f81e5d68dbf55977955f865ed0e1da3df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c65f0c2769f5f90be937859a4142f37e

SHA1
f8d5a9aeeceddb95d6d2b9204196ac1cebb2681f

SHA256
9e3c67a34593231d7cc395fd67b0d9c391bb6426aa6b6a4398a526c6cb050b6d

SHA512
615ad7ed06c662ebe0fa183460de963c2054f5527d03f7db844396105c8520119fa91a7d0aa9ce1f23e53218d5c944284d19b697941087739f6f345f7b6c056e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1fda9293b50e40a9b941b91daf1c7f93

SHA1
7eac217f81b4f3d5f6e6a91f16cc41cedcc8ce5f

SHA256
6e256ca68b92aea1bb04c9b8b218a3a1395e3c8d21a47537b22e66e0ba84fdd1

SHA512
00de60167de451e38475d24674cf8c64a677d834f90901b0079e7a828d63d888cef4bf9438718e9c656d24cfd9558ee41afd8015a54bf6af9f9c9ea3c4fc863a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0503d355d278068ae943ebf894d8692c

SHA1
cdbc95302c555cb1e70dd10f30107b1428b0835c

SHA256
e12b5f7b2eff1b5aa8ff1a1a506588f983f1bca6e2b1288355696cbe2d046ba8

SHA512
01d0aa189ccace1b5deae71338702e1e113f351b26af1e8fc681d7ba877aa5daf2002f233d2b605f7bbea9e75f2f7d699fe3228f15c7b5871c5de4743d92d94c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5bb0fe0f325f34e8424c8964240959fc

SHA1
0d63a339e5ed12c5ab4ccf250ad573b10fb2051a

SHA256
944be454e05e90784a5c067eec50c17a117f9e7878ae1e1849b11f34ac9755ab

SHA512
369a444c2dc0bc09f9718f98388524fb5aa20b2e85c7b6035634df0060325eaf111e3121d8d70a3bf8c654fc5aee71cc798e9318e32cfd0e554717826b57b817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bffec432861a6651c59770fe4d987817

SHA1
ce823058b2457d3224d4545399aa461ff392373a

SHA256
750b21b3b9f47e385847d60e5b54cdd203fec6260e1f1645635b9bd7ae41e9e2

SHA512
8d9d3ee1029221422ccb54ee2d4bf83d4558a49c412173a60c361a2fba28cdd314fbad383706e381bc5a801d83546897fdc334089f70cae522c7f7f1e883047f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2LF9I1AK\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar277.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit