5160662927939a9a3350594044685ba75ba6badde04970c91f63b7373268177b

Analysis

max time kernel
144s
max time network
138s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88463785f344708eb2e503353bd37264_JaffaCakes118.html
Size

36KB
MD5

88463785f344708eb2e503353bd37264
SHA1

068e6ca89afe29732fe75b0b2534e77f35561974
SHA256

5160662927939a9a3350594044685ba75ba6badde04970c91f63b7373268177b
SHA512

d70d9b8908aba659e1b8ac0915a65f9bc72945bb421e2cd8aa28986346e44310768c10aa63c19b4bbd8c13f70a67ff13198b74829f66324f3db7677a2688a8d5
SSDEEP

768:zwx/MDTHT788hARYZPXfE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TFG06f9U56lLRcb:Q/bbJxNVHufSv/e8jK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18ACBB01-5778-11EF-B585-FA51B03C324C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000989414d40b95db03926b54cfe426f5a81ee655fa547df74593ac073f09c985dc000000000e80000000020000200000003472886d90e38c7c77e03746877464ca3d7d12879faefac68170b3c1c64cf1de90000000ed5773f8a4dc87f44f9690db98b07fbfb9b622205061af3ff80e2fb26c343ac5db7c4d3766c9abead602bfcc5c58e73b79eb3f1cfff5765ec8220d95e1354ee865507c79989af90b3cbf098dd1869b42e57890857bfeafa42981d4dfb5c131780e9fc9cd9e57126f643ce1ddc6fe7f2ee862cce8ff115875816a7d40cf9864b2d8e62ee47fdeaadb2384f34fc441423040000000249ce6cb767f48230ecfd1575e84c2bde37700478af63c477ce0666557c44b06648991864e8d4e93ad2273fb0902e8c869439803536778b90a40dfba5eeb3dc9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000059310cf5a71ca9b20579cbd42fe4d86d1a8c47e9339410f4d09c619f0c694104000000000e8000000002000020000000defeaf16fa37a49d632559090e919ff87a4ec7c9075a1db4d0bf45f29976825f20000000765a502758e84801a51388f771d9e6c24b1e8afcc99feafdcf6a880bbfef330c400000003a9d25ed49b8c900e83d598721ab5b58d98fde8529b681455b28ff11b7f97ad61fe6029a18f33581b96daf765efdceb9e14f584687ceab55e17190e167492526	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50edabfb84ebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429497757"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1460	iexplore.exe
1460	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2204	1460	iexplore.exe	30
PID 1460 wrote to memory of 2204	1460	iexplore.exe	30
PID 1460 wrote to memory of 2204	1460	iexplore.exe	30
PID 1460 wrote to memory of 2204	1460	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\88463785f344708eb2e503353bd37264_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
712f7ca9cfd984742abde16eb8d70438

SHA1
15166bd0d361a44b9feb017c425b6e55d2a70ede

SHA256
f978a4252e03404e67209fddc0a6a15cf2cc5e0426f704360795421cbee23569

SHA512
9bf6178364cd7a657184711dba8d22713c3a2b59cd4a156b8cd69803340edfd45e701ecb3af9c8a4aab0f3113be6e0c9a8f1a5673aef70a59339f4a2b40ab693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ee59b3296b78c28ea3d187c4516f133

SHA1
28c4201ce6478c5dbf8af28358e5fc1fa2f59bb7

SHA256
153341d999397344d5ad961581825d42b58e752f18fb9791205db0ea6c0f8210

SHA512
8b5332ed2bcfd9d38c36a4513383d6ce4ca94b542040c7d8ee7c33803387ddbfd1162245c7e9edf24a075a35f14cc35cf06666f8c72eb0411b0faeacc0668c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebe3dee3590dcf8c27114c8329ff1e43

SHA1
c37205e156ffa560c847d672e830ab8bfb3c16a9

SHA256
6b7c596592df85dcea6509c99ee563c3926dd3e8dc7f84322527d6c93317ff08

SHA512
51acd4b67023681132816da20d6868ddc5e6e09a7839a3cad87ddcdb279de726d92f3ebc12aaa28ce3b455490bfaa2d0bbce2f573ba95f3a5b5eb9b521d62023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4824f4adaee66b0f3e480bf55f5a3a5a

SHA1
7ec62e0157b6be48b8ba42791fe5a75cb601b36f

SHA256
b17a0e59fa39e12354ac3eed2de568c0297e3b8c1dc3219e7c16979e303759e2

SHA512
ce2cfe0d8427386cbd0075ab916ffd88449822e01bbebece1b3e3abe5f41a581569c1736595d017ad9c187a2b53732afcf933b7acecc0ed89e4b6916a1dd527c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a09571424b762ba5c5aab017dcb693a7

SHA1
ef462b9b721c21f14bbb503c66bc3c7f9ab306ab

SHA256
1dc83829e3599aaa7aaf19ec303b20b13f29e7180591a5327459afadb0aa6af0

SHA512
efd29fa60ec255dddbcdcd16d8c47de0a33ce5634a8121ca3a468624865bfff8146356ee44bb190321eec6dd85726ae6b0d49641eaa499eb5b068a8720de7160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de6b2051389d802c7857e8612bc8aea4

SHA1
6414880e7f8c4f8b468dd28beed55f906dd3f81a

SHA256
dacd4364463de25599a13fb065ac068e03ac4d39d6b50686fb917a6442168bde

SHA512
4724924d82ef0f199187905c68924a957edc11a5a39274b88d9c93de76d470b23bcf7537696330ceaf768345bc06d1a459ae421864180fbc9a0eabdd4795225c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
078df161242d488fdba05394a295d921

SHA1
ffcc1eae2bac024b48c4f997fc2cabcbca896ed9

SHA256
b4b6204ea8936c549cffd01802ce37e18a9cb476b242568efbbed64ad4d3cee9

SHA512
54b717d5c79bdb360098252641ca39a2521fd75399adc443ee6b566a7d973a784e47d4fa12f9afb927f421d5ff8336081d0f46db85520cc910230ad7e2df612e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9da2ef31aef43517b440357d99e46441

SHA1
0d708ee665d3c7ae5bd922aa196c2dc5cf5de62e

SHA256
535f99ed863287ff1d174562595f7f2da96eedead98eed57b8a8d0dbc01c5796

SHA512
f6e9dfe3850f8a7179674fc8c7c8adb717dae662b23c776f6d0348745bd63ee4affff5043a2b6db426ac539a433206132210cf4803440a96c0cde8de217bcc43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8867f041f69dc2823f42f0d529d68ae3

SHA1
da0d9c1b970b33133bc0c71afea1507bf9400d6d

SHA256
8f2fe655737b497924427f3881142dfc493470fec31ddf9ea765d16a75e5e9fb

SHA512
130a2a160507a16d43ed7788016c539c8af518ea75956405335c3232493695579bcc4817728de679693967fff2b901bfa4957777e42d16cd8379e562d9da26e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
204cf2b5b133818597dc1fc3c62f44aa

SHA1
7367a00bd433f8e0fd76373078548824588a3b5d

SHA256
17d5ba001539c3e5351e1d298894ea4a56eb4cd411509f8f2193330224fe523c

SHA512
9ed42dff10741f830fe709c6d577f9e28fc24d936ba0294142dc56e201da370beaf43936239b62389f20089c98df74e79c28e6e26c41fa2a978c222286e8296b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
597201453a2b7cd335d32ef07f25a56d

SHA1
dd500b9cf1c9db356650d746ae33139b755678b7

SHA256
b02a575c265ab74b214ff592b0f740f22da585405ae7b8282ac27cd34a0a48f8

SHA512
93e1d44b11fb1ed86111cbbb4e1b9778f9fe140096ca8bb5b624e7a55fcf20f8a55b38d90955ad14411e8d99aebb921b743ccbfcd10059ede78f45b7b02f3612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9baf7e737d7d66093b95eae3784bf3e9

SHA1
019889b9b4ca90a2a313ca7481ba8cb756a02c9d

SHA256
3f07da0a96d638f409a503cdda79427e6f29140322d7aac16529b9e416f3d48a

SHA512
e9041aafafc6fa9d2fd5e8d3f818ce9df2ee493302973777239dacbacfa8a4c437a2b7821b0a06b2d9d52b5eef6e896e1b4d62fb7768ac3304b7e70cf7718d16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
31090f23acdca2f1094acf062c42e9bf

SHA1
b06f2a7c650de9316a5efc97a4e5dcc46c888ee7

SHA256
028c1526a2a96e0af2df7b1f14e24560ea5e045132304bb69e06dde88c961ec7

SHA512
337c7093952af844cf9f21bc934da0f6ca7b879f1b7fa626aa6fa4f3fd6f5f6cf156551c6ae18386d7703201a97f7d46b83df550aa53f729d8d1467c5a6138b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB907.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB908.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit