2ba03dac02abcfb3d3115eadfc8925beb78350ee29626fdaeb3958f3e935921b

Analysis

max time kernel
82s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89023fe3d3c7ee71cc2bedec0f785956_JaffaCakes118.html
Size

23KB
MD5

89023fe3d3c7ee71cc2bedec0f785956
SHA1

bba2e45b1b84c748c7381c7a46cdd8d1d8ca56bb
SHA256

2ba03dac02abcfb3d3115eadfc8925beb78350ee29626fdaeb3958f3e935921b
SHA512

61b0957f61e85cba44c4a90871fb1b295fd7a67ec224dc7e5f7b2902b24bff2cc5b8896390a41e1ed39c9bbedd0b679cf8b365fe1aa81321dddf0876cd7d5ea6
SSDEEP

384:9Lc6/zG5M27/PMS/3mafBsByI11xYMK3KV1HojdRQyfhGPHgOv5IvDVyH/7Bw:1z6PMS3xfuTDqdmwGj/f76

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E823F751-579A-11EF-AC25-4298DBAE743E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429512698"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01a8edba7ebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000748f851d960ee623d95d4c5901449c6fc8e5c83c64174268d275c4f36dd6041e000000000e8000000002000020000000a1c01e73e5972c5be7bff16fc11299b1204a24e9a2a6764c3b6f247f275c55ba9000000062abff0119982c88838894229d074194fe73042889c854c55487a4d09f2d073547a4d80ef4799f02edbcfbb978b35073707585f1ef2496cbb29729d1c87aa5a3f8c674bd316d7431ca6946a7ba0092924eef321a8ce36d8d1ccbf58a938e219bfeb318102f09cb24c7b491999adbd9cc0abacfb9ccc91ade668c3f11029c2bb61f42a3b8cb803f213b5d0b6844a73cf8400000002b03edb6310377c1d888d89fb6c2a05b8ed67245c4b3a3b276f7d874e9f0ac07e0eed493e92bfe14b9e0236fb8f35ea50908ecf59f86af523dc1d3950d0e4380	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000ecf6725a1419b0398dc60254df888483e55251c72d67b5d29d3a2d4042f914ec000000000e8000000002000020000000ddf9e14bcfe60675ad14e053299f10f15c86980128501a2abbc50dc6f6284412200000000d7c0d218e26d9ffd459d20ad96937906392c37250232ae653b929e7159de7a940000000d5b8cfa5387b5db67d15a4069e53d571296be6e5e9d737b0cf656774e5e1b189000e1aaca6ad9c9a8d35e5922addd5d91fb6b497cbf1a8e76ea3a6fd55871ab5	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2224	2420	iexplore.exe	29
PID 2420 wrote to memory of 2224	2420	iexplore.exe	29
PID 2420 wrote to memory of 2224	2420	iexplore.exe	29
PID 2420 wrote to memory of 2224	2420	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89023fe3d3c7ee71cc2bedec0f785956_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
751fd8089ce8ccd903b95247f8e6098a

SHA1
1b3449380c8b9556af1084cb31650dc6e970b9da

SHA256
02e0e126e4ba760f57c7d1f07c7f84cb6f6048e5b02727b0e3cdc153911c44da

SHA512
ca4d77db57ee39b6e03fd0ef9f7db0e31e108d5e6b3927ae1f84a1c0ff582e68e7c46c952488fb4cdf47b23a5d0570dac6d0087ab9d08dc46384aa82b0685488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef7606cf79468f3d2063de58877b425e

SHA1
b96040c4e54da4189af2e7addd25096164e999b3

SHA256
164dd229f5661c34d56237e33a1b2efbe13c4fa56e6514f8e89efbe4cc1bcac8

SHA512
0d58e0adba0bf6a2e05152c615fd9cbb9e443840f752af5c8e6bee5df91430c8b5c7bd248585471f93d406fc922f0fd05b2e28b7fb6fe6124e651649d2cda8da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30b9a1acef04be00145454cb94f212c3

SHA1
9fd64589cfd1051f4ffb677702b580b4ecfab1a1

SHA256
460fb157e9b65ca95eb1f6a32690b13e59e890960dcc01db42175033adbf6dcc

SHA512
f31c177f2bdcd24ffb5e375e9b02cf7f62d082cb861963e6cb39b1198b7d720484cfcf6727dc687e8b1704cfca80de2409dfbb61de0a415c63b954f970729eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03fc4c1f9e52944ead57676bc38fe304

SHA1
5f90f47f51ed0c6cae0d1d423235aab4aa5763fc

SHA256
d5fead2611c591248fa99810a8e42a0a44ff548d1cc7d429ea93277c137ff20d

SHA512
f29305d9cfc8636d22e107af2cb1258f5e43de495493394b33e453cc2da53e82338a330d6b93a42406b4343306224ffbf08c44f6f8f1535854511c0663c0f3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23beff21d6a9dc6e7a15be63e805a3e8

SHA1
058f5b191378034bda9229d8500aba945a15e745

SHA256
d468f59b93892d3485a7e79a9ef12f4589e53aa37ec66cd5d8138e87da726702

SHA512
f15e3a91af89d7aab9058225bba28e5ba379ca3dfe891bf902cdb790d218683cbb5018583dccc5c378f1feb04e834749fb7e31ec21d0bce1db74e72f1bfa3ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
775ed3f771f5a9932a0d0325d734026f

SHA1
5f78639baec8fbdf391dcb13596336f3045f3133

SHA256
52c79f10aac941a37d4cf103f3ea84f3dcd1b0c58f367dab68c12c4d8c2020cd

SHA512
6f736bc1af7b64b3cb7e07e523ef2482fd18329682631e2aa5cf9f0e1f6757a6dea5988e88c44e7d27a968ba48c0f822a2a74ebe577bd1993dab4ed1b119ea04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab3ee04d419e0e0688b48db9058d0b7a

SHA1
6fb310ea776caec879f877ea07e96c04ff7b9789

SHA256
dfc9ae4b3109e9bc0a9f9aa9e25a2101918cc6663d1b2db1c66d2e44eb97a416

SHA512
f53d3131e0f3dfdcd3ebf51f5e23daad9600d47781c25cd3e45c3f90d78cb5540b9b4b41322becc3e00dac5ea970d3d793c0f6d2fc535552a2effa2e5c471bab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03ff3d88b0c7b3da6251def682a0f19a

SHA1
b4f05f6de3b88c478ec3357d1ad37963a9636068

SHA256
535c9f9f4827e7a29b4b0af5f34d10e0142bac10ad331a9e00d53ff1b5feb8e4

SHA512
efea60f4f55dd816d566b835ce36999e6b3c29d096a5af554f7234d6ce17940311ae169daeabcbc11a8c0f249c7a9c28d9cb7f2f4d324545c3e9609cb40696a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6666620ef502e372c7c35e45bb1d00fe

SHA1
18fcecfaceb061ffa3b6d8944f1303b47c9ab0f2

SHA256
04b5ad6a7407ef4867953c08b0b6a053411e294dcb819b88fb29783e66736188

SHA512
c8c7a1880e3582a7e419ce85457094ec28f36b9347f31a5f190d2f0c075f38625c8b16f5ea387c2a1a723ea81a593535ac213caee71111fe67e308ce6df3a541

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02e52f3e3136996c914c15400fa33b31

SHA1
0ddd76ac0aa54e68ccfa9753b48006bb972a9bd7

SHA256
86523363aa82a5bc792884bf84e8be1d2f2d3ada6d8f3e9134eae6caabb5fb04

SHA512
69dff07bb5d33f4b74020a1366cbfbb21c58177f14f99c2bb47b416067d110d8269cbe02fa804e24c9b4c581773eeb0658a010b60511f83caf010c742d2d42c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ab077bc8f2e9874b493f79aaee0b302

SHA1
51960dda45a901dda752213029970b315278c469

SHA256
19b5c68b49aa4dc1e77ca821c1527779aaf6f4e5235dcf71a2852b8f3e94d76c

SHA512
a16517d8498ca7ee2b84012e39f2dbc08761e44913a1c12cc39ab22f2d025833d17289930bb8a09364dc674128260107dbddf45c127a0fda95c7fc8508950fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
130163dd4f8fa57b349867feac82ab9e

SHA1
434e0d56d1f7b54b0e2ba94ac9a6cc0cc176c10b

SHA256
536681e12d61332e87e1a905a9cff7843bc474ab67319174b044add8b89ed85a

SHA512
e1d50aeaa9d0f5de1c36f4da85bf1a9c9b5b5f7338bdd9a2f31d151e00b14a8067444586ce05422d00c1284846fd9eb65def15fd5d8802b7cc91fdb9370cb5d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d547fc95230b611ab14cd146958e64e4

SHA1
f33ef112b60e7648df8a80ce05600f8d74541577

SHA256
a3e784abf468ff8e2879341d86a3acda505dcc694195827279359fcaae6d14b0

SHA512
df9dfefcf8f36295cb4e080585674a810eed551135f8b2532bed627da2ee77b3ff6003f0ce052e776ff43b9d661ed4b339fe9570dcb064dbf21b51cdae5d44cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35b955b5377e629dcf78e297b157b02e

SHA1
f21d6902576e871bc433aa7e69fcc2400ae0f066

SHA256
9af36697cc96480a81e62bca13d4c690db54184dc601b99f23587d3966e78f49

SHA512
a832f2e924cd3126c1a4cbb7a27594a81878d27a9e0cb37fe4c7fe176fb8894f755701845e849d219bbc06432f2872671a918e857d2feea739786a5af367e558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f122a28350c0ef6b400c2f556ba9e1b

SHA1
4308416018b35482770840833530e7e532558b19

SHA256
3a340fadd7dd40039026d07bc78441bb6c089c6e0021b7e3209908c28b440cc8

SHA512
d5b11adcfa80384e20d21cf46ac1d1606d8e08642aadaaba828c47ebac48f6648587694dd8c26996592a7697b157be7c02e6e01dce20652a7bcc6d929e75effa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDDB4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDDB5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit