860c017c7d4f8a2b909b86e68d1d99ee5d28e31e252dbe6a9715abc3d91c8623

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 13:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86309fc0c4c698f1217cd1bc04f1154d_JaffaCakes118.html
Size

44KB
MD5

86309fc0c4c698f1217cd1bc04f1154d
SHA1

1a14c07d244953ed8f3c69dd535de61409bbeb37
SHA256

860c017c7d4f8a2b909b86e68d1d99ee5d28e31e252dbe6a9715abc3d91c8623
SHA512

5ebf8b32e4d149bc91ee1315660d09b182718d4f3ca8d1a2c3a3456345881f9c9f16714f984f0a4e67932127f86a19bafcf4fc19f9c23efab2692e6aaca539a2
SSDEEP

384:7es0hLNAuLJjhx/hYvEDsjA48DH58HzulbtCPf3qLQPx8o2FuA5rYs6N+lYlG+SO:7o7jhxmvbjJKOziYMQCor3uutLEF7HQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000004131785041c4e72a47e3860da313bd1487943fb58d127501b3c4c17024438145000000000e8000000002000020000000e5c4e507425b8cb556b299a22d25c5e0cb1dce1e911d55c4078b9a206fb8d1002000000039b15586161c5188329592d54015578da60910e829f7a7359bf9986e6223593a400000002a9adcccffa3da9d697731d716364dd3f99664b7172d6566fb531283091edc0ccd1ca64bebf8fac86b6b227922094b0741d6f38da993dc442c9ad07ca4f403d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000005a4775db1930d48ef048b0afa6818ca8a0831e90e8c4a1ad1772b7e7d3c0f153000000000e80000000020000200000004933b2f4768c52a7ac35ce1f1e0e9a9c6b9a74efcf841833fd15130ee0ae869590000000c19a98fb84a531d82076dfe4221edd0b60d31ea8c9961bd87c98fb4ff1e28df01187a1566dfffff7be556e8890807ef99dda0911876ccc00af08f02c4685846f9f2357e37ceae33f03bd299e32f43c1c79565fdbc160a409dfa26bdaf0ee12ea324bca63684204782a9f3d31fe6a635f915afaf6615337bb9503842d266fbf79a7f749289a4eceabd20020b795a660da40000000b8f9aa50fb96b1852cfbe10d7a5df494a6ef655b0b6e3d0b3eca1da9c2d6c5cddffc5aa7a81164d87ac9bf492b3dcf1faae5eb9cdf29341e0402176e2f0d9206	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59712441-571A-11EF-B19F-6A8D92A4B8D0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fb0b2e27ebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429457486"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2312	iexplore.exe
2312	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2892	2312	iexplore.exe	30
PID 2312 wrote to memory of 2892	2312	iexplore.exe	30
PID 2312 wrote to memory of 2892	2312	iexplore.exe	30
PID 2312 wrote to memory of 2892	2312	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\86309fc0c4c698f1217cd1bc04f1154d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d4c5f2683a022f99c8a2adaf8cfb286

SHA1
1612564501e3373f1273357e4c9c7cb1b62d4d50

SHA256
3b7a24ce18b17a24dad4b763c04aff184634e3585d659c6235cce4b5dd6cd2b1

SHA512
1c656f521549198ad278915566794674131aeaeaca249dbffdbffdd0d31f2298f76baf22fbeb829146712792a1036d304b75c11d603c29f371db95fad3d24831

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07b1bfc0cc46ec381dda0cdf9f5e6106

SHA1
e8f06f38194763ff1250befb7e5cfb728b0eed3f

SHA256
053ad2151850dc1033e2bd0e5e315ea11e94020b26a5f0e120804d2c9c9a4ca9

SHA512
c6f7a851b0c9edf18d085cf85f97ab3494c8aa5ccc4ade5e9fca60545c30dc5e104e7bb613f5668b0ca8e25e5b1fb6e381d78ce0684e47c1e8de717debcc3d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
264126008fdbae4414ca18619581ea0f

SHA1
eb5ccf1a72c334161d5d3e70c6f987f53ab1c280

SHA256
51a47a916de4fbcd2f7c6690dde533e33208123cb2c0c14a0d2fb782984f5dcd

SHA512
95932085a629b5387aa0414afb091b1404b4b2624b7164d57a62910cf6284aff2500f6a867f739ffb3bc7274b884071ca02aad3189634ecf0c58eab6ecdc8355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2062eadb6e0af0b3c9a868f78d6efe6f

SHA1
f8c5c398825f8fea66e6ead35a34d9cb325c8223

SHA256
06e88103ef6c8e66c786ec1df521235528936e0be50dda3b47bdd262bb96d23c

SHA512
ac8815454ca829c33c1209997d1ab381dce52023a5f27299d3b2a6cea37f7afa331248e8e909061a5a6fd407e2613f6211d338c81f94e98181bb8d5c26405655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caca8804e698be831a95fa7bab95fdcf

SHA1
f1567141989d60e94ab03ba8aaa103a65bba6c24

SHA256
72997454a2526a929073448d5e83ff0e9c29215e329d0700042d2194bc9fc378

SHA512
81523f527178aac7c7d2f5ef7f49aabc2bc475328d17ea37a975b1226689d5e2d92737ac0895330e9a806a02786189671b976ccac50a208cbe48cae680c022e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d89154271c78eb8ef43610399eaa03e3

SHA1
dc748616e59b96ce26d43a47ca8ae8d7a2ee17cf

SHA256
56165a0466e4db494624650b7fbca2f877d626da5ff86bd77e0009048d997832

SHA512
5c3978a4b39f2a35f41eb265344649a6181ffc75c972371133a27a6dac23d0770c45f7ca8e7f8d8285be1b7256ca90898fadc71e18050c21075b39e3c92ebba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
823a066b87bac01f1b3ed5c64f451832

SHA1
a09de5a06ed8ee22b8be483f0d1c17a17316dab3

SHA256
8234ff198cf62d7b003cab01993a7269dcd151b5f6a098cc2eeb00326cfef217

SHA512
6f5d78d7482a48e79cc11fe823870ee9982eb0563668b7f08e514b0cc8abafd4b836adfb13e02e9ccc36d37dd5b68148ef5bc90d360c4e0a6467757438dd9f0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a8cbc5a29852c20a06cccac68199854

SHA1
2e0a76520411a3e7b21829969989c4520ddab2ee

SHA256
d9184ae320fb239565423498c60da207c3a1d4f48cbd32fde146be4eca9d9258

SHA512
faf366d60fd5eda2e594f6a1f3ec15c06c742dc6b70777e339841bd5131adfed0fe02be8f0e7c0e896be188c89da9682df3f534a94ff6df85241ed52059c0d33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a5350f353403e796db79bcf45915388

SHA1
f583d8ed79ebc63851da90c2ef83c0bf7ba5eec0

SHA256
4a8d1a4374678b5d48be42913fd12b85d1e1259674e54d953916f1e92116eb20

SHA512
41c3801917b17dbe879755a116af0e6bb92a34f9fd4d706b957fd9ee5da2f7044b055dcaef8c3cc58ef438fc4f26c9ba983a001c7d784f47b756d7b532fef1c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7785cb4a843b4b0a4e3c51a8c3215a48

SHA1
127bcd980d8e0c8f66863735191dd951d3d10187

SHA256
58ee783dbe28f1c1f32dbe2ee93b88ca481545bbaf4f5648bdfa91323a3182e6

SHA512
1d8fa574c39f60e3c2ee2a0a804456471c4322962e522a9a66c7ad594f451feb11d688c90d2ca594aeb7436baf7a73fa51890932f64a0acbabd82cb2b7eb2218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74b5291a577b22c6c2b40b2a7662fc0e

SHA1
c9b447fa5652e6b1876a9777e3337cb3788bfd5e

SHA256
cc26ec1dac2a70b447dd4bda0733500819c418e4c549736baeabc646c21fd92f

SHA512
38ddb90035346aef71411eae94d6543db509991a1f58d9ce08425341081bfb7cb76817284f5e730f4db16fe20135b6364dc29daaf8283724b7d290aeedb05bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b052143377eed945d4b365a680e9d621

SHA1
9222f245cc7b25dd221d188c8dc74bf0ad4c6328

SHA256
ad95aeb269743e4a5527039542950e20caeeb2922ec659b7ed5eaac9072b4e5e

SHA512
9693af969af0097675fdabaf4747c33b5a0c4cc293e30b0077eb5191eb0da6837bd214558e8126cea2fae8949338fe70db928ede44f25d9c294ce65f1fb70d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3e3c2d56bc6faf50dc31035ea18520b

SHA1
4776c816a0ed5ce8c8e5979711b2e2c034dd33e4

SHA256
9c7d8266410f098d4efac3f85a43c62dff1385d13257ab6b1c144ccc663dc6a6

SHA512
436d72f8640e09aa050d59727e91c127ad27d234ff220ee43862dc39166bd526f8d8661581e5814bbb30a0cf80b1e28e58470ba3dd217774e63deb247edfe407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
386259f9f8c718e12f5aa353656870df

SHA1
bcb71436102f859e016ebc9cf587b06e2b6a2993

SHA256
6abfdfe4943130ffc3a0bd15dcc48cfad7339a6f80b169280df118901ecf17d5

SHA512
62c7129012fe3099273b4094cd7eca99d6907f1874e34e6226efd6f69d7e647305c05262a3497013fdf9449cad5d0229682c1963f23a03c9588522f6f8565f6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec7f5d0f2e6b5fc99cb0274dbb80727e

SHA1
99bea147421b624ab4c1e91c970ca71eae1d3cd2

SHA256
08d37a158f083ad17824f5fc83e6101b48cd5f99d2c20aeeac0f672246d979c3

SHA512
ce76ed717303d26b93b9ebdf20a4a5cab50c6686d9743330075901592669b6996ce6d2d5f2538f96a3fdaf7dd2a56869a05b796476e26a92104f870213d6de5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E87.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5EF8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit