5ba3d32bac5ddef1521080cee95edc05f77c865faf4bb9dba53fd4e5f9c279d4

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

944b5db1c801805aa9ed170d78cf4065_JaffaCakes118.html
Size

53KB
MD5

944b5db1c801805aa9ed170d78cf4065
SHA1

7005345528b5cb61f4897a04b571991034b9fd2c
SHA256

5ba3d32bac5ddef1521080cee95edc05f77c865faf4bb9dba53fd4e5f9c279d4
SHA512

666b56e2da1b6bb32fe445a4735d55622cc0e7df2b96d124321707da50065fdf90f1572ef72423904196419ea2a9d076cfcc1075b15cd26574f9c852aa13b1e7
SSDEEP

1536:CkgUiIakTqGivi+PyUsrunlYr63Nj+q5VyvR0w2AzTICbbfoY/t9M/dNwIUEDmDu:CkgUiIakTqGivi+PyUsrunlYr63Nj+qF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106a5717b1edda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F58DE41-59A4-11EF-853E-4605CC5911A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429736612"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000003cb609f952ea520687f889cd7ac9519925a5d986ad457051cbc8ab14ea094f2d000000000e80000000020000200000004321108d7fe7483dcc2f59b4ad06d00b338850797d8b68438a7eba214933b2a09000000094a76ca21a3e4dbc257b3e99d39ea96fff5605c72ad5f97f45f74906c4710b7caa66f3af39589b8656d2a073ea99115f594789517725090a9c1a53813bd52f4e050504254fc2395d6d8e508024167abbe6b20d1a64d316ac6b433135c6f11653cc43fc04d94aa54bd428516cc5ac0bac63f1cbc826031786822bb92d9cfa9e7efee243e4c543be131ebd7f428676c82340000000d8314b2339b6cc6743583ed5b79ca043e65a03edf099508005dccfb0113eb51d6ebbf22034d1035a1f534e1f762c1b88cb8659b058089d828e85c183b432f5a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000006b5209ebb0fc5909ac86b5f8e15c74bbf2c81c1a71ab16542b31c601a6ea6224000000000e8000000002000020000000ae2dc45c7b4eed018cbee17c70f54ff9d96d603a15a858042488a3f4ed36b22220000000840dc5445e71968820de7eb7611605a68d4dc92e11ef4fcfd9a8c05e648cc182400000004c47856b050d8e6ced97f8596e18c74a8b3a5ff539f2603a4f5f99a04f69dd0aec0e46e966695360c1e36af0e437049ef28944f34a0ed40a2670f32422ecb0cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 3004	2384	iexplore.exe	30
PID 2384 wrote to memory of 3004	2384	iexplore.exe	30
PID 2384 wrote to memory of 3004	2384	iexplore.exe	30
PID 2384 wrote to memory of 3004	2384	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\944b5db1c801805aa9ed170d78cf4065_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00ccab773faf729fc5c72cf441090830

SHA1
5548fdf63489d1c365ddcf9f410df678c8add06d

SHA256
0bd3bda3e125bd94a413f944a5b243bb5b61dde515b7eb6240c0ba97baee8203

SHA512
3298f84b4d56575cdc9a0c321b8528a9164e1b0758f39e2f1dabb20bd567d9e60752d5f357c49dc18673b9b6a329c378612c81e5382f6e6fe2c36355dbf4aa50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c735ca31a24a7563ed2f388f9386e95

SHA1
6da7b72277ac8234b3956e405e868149b713d020

SHA256
6a5179a93163022876c6153615e8d8ad43f4ca93bb7ff69a4bce5c28c18558bc

SHA512
e6d7d277f5ff3fb828238f5b8752f84d120a24bbf83cb900911d117a61fdc8f0b6caf588a206ca8c067f8d2299823c574364e19a5ed9f776a9274b3999d81d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c50caf609ecaaec75240bd5c78dabc7

SHA1
32aa3613b5cb841ec4e21638af87f5a8297d1630

SHA256
166de8bca2e593e8ede7af4e0cb1d5cdaf9671794c2b41c0f27237f5cda54cc9

SHA512
9387d1c01ac8535ebfbc932d4546be197beac2d442a7522aa4c7c5adc1c6fd2bafb760bb5fcba9abd73e4cd49575dfcc17edb8df165a566d99b2184c70fdbc27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a0170988c1c5d6ce5d5acb410662091

SHA1
3570dfb61f18c7507a76bdd99c2eadfd45e6ea6d

SHA256
2f93bfe433d0786ad9522b5c6ef3351e7390dde3fc121046e5778248a0f62da8

SHA512
32f66ba13f584e11c17753d387f2d7bdc03a7a75830a240120a528b616de6eba0ee7b9832c0cd3d63333b7bf7d565bd4841beaf46f261437b2fc3785f6515eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4098486c5e4e57765ad418a2fe96cb6f

SHA1
dc3626f8999d738ecdc42c5e58d25919767a560d

SHA256
d65e4e972775eb011b2569848fb24fa5680aa11cf7167393c28cb4116afa7029

SHA512
b0b696b55b43120c77e2a84215bb290a4eb1033ee016634357903920ff5d971d5256327a5ecdfd489bfbbea00f0bb7e80ba9dc8d36b6d295760bf8d819f35c2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d784d6eab62b2e5599e36be18543985

SHA1
4533361e1e18d214b0736834389d2667772054aa

SHA256
0409b895ef80302d718dae0d7ccc13d584180af0b571f62ecedb6302f3d0a703

SHA512
0c92d6c419b220935834dd6e119da0b0b576eb909e238068cb958f8ba525c2ad02038d9a216469b2e75bc5b8f493a0d798ad29418c8d953024d07c949dd8114b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b7658a209f65a5539d614010c552669

SHA1
aaf3517477ee1017dfa31e3a531402c72aca8554

SHA256
186e18e9e973a7f79adb72896e7eb2de4b84a0418c2173bcb2e4727b103c009b

SHA512
4c8138d94d41f6222e14891d0b16bb8cedf811aeae4e9c99df4c9e1a6a7c7b5ae913ec6461726df6f6f001912198e9acb1bdd838bbb9c34e6d3b2a19abcd89e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cacc8e4fe6dcac7dea54c23bc138d9d8

SHA1
c03cd86178707433c5750cfa94aee64a235283c5

SHA256
aee020afff4257112eed2fa1cd0bb9cebb3bf552e1ccbfd6618bce0f59a78433

SHA512
0338584704a4f27c95a284541d740012d1d309e7232061fe6dd9e325017b0a5e6178f334e4c0536646484ee990a1281dec2a5937004a93f3ab275d56fa43b2e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efb6b588d3904ebc8c4ea3d2097c4caa

SHA1
05655341dcb98d489e24398dfc422ceb8f19d744

SHA256
581e680be9a07a0f8845cc17306191ba528cd939e7a75578470aa83a2b300b9c

SHA512
dc6c9edae7db49c83c7e9546482dcb003ffaac4b4035651f640a421d4d5f9296d9b0ed0fe858843185b5d4f79bab98abbc9c00f7abc487d4d8d8b8c998ef4eb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64f515509c9619f68c8b4ef2e485fb1c

SHA1
9cd7fe26b91cf45158d07003a63e05777bea7df3

SHA256
2565217ce1c3c8050ac0db58f20e84d28412e4ffff0f42d377d1c8650f3c7cc0

SHA512
732fb51a8bc853e7f265efdc7593fb925813f96f42048b1dae865aac41a42660c5cc335be7ce6c0315c1f954d41c31135c4ed917c53992de5fb606200244a36d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
812fcf460e9449346ada4f360334ae42

SHA1
f4cae095d101b069eb0ba44220fcf4e9784e8de2

SHA256
cf7d9022857949922c3d6778f542fdfbac75d8b4298ec612b4916dfa6182823c

SHA512
9d1da9895be6d4b0491a8e70ef561b3f4157ff2064a1fedbae4e495d3bcfd8e8e8cf20f1ed1723b99d8c7af5747e4cd641212d43424afb1ea88faf1f2ee16d63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05f94bcdd0d2b17788db6ee0140f78ed

SHA1
b8ddce2dcd4990e5e6473cdf0be3e5aaaee0192f

SHA256
3fd165cfafa590959a8ed95ddcab0adb87b3d0ba79b2666309a797e52bcc347b

SHA512
eab888face5e361f28bde1c165e62e18c706b1b315744b134c9a99419226cb83f18f8593f358dd5d8a32ecd65bf214da2ff2561a6d676df7580711ef9ee6315c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8c301cb6c4f0961a58f1919c00ab132

SHA1
8fba3637ccdb71a7e2a2cfb7e7c05901c8cc16e5

SHA256
dd74fdae7662dfb4a551d050b80c8e1ecce7051e89d6f723696d6c408cebcf2e

SHA512
31d66fb31befdbfb3860c94c1cc5e790bf45571c0ae547d57434ad8e8c301924ff94073e30211f501e19e02bca9ae28ad0bd96c7f9701ea1d8ad7ae682812461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a093c52d327e1b7ff5010bbb31c1163

SHA1
34e2af7794f922c80b94eee8512a3fd8a6df5e9b

SHA256
9105346b750da3dd46958f35dd7f2cee4036c9bc64275abe711bf1a26c0bf221

SHA512
1dc54c446762cbea230904bd60aea705ac5b9eb4542ce881a0c77a75a73147d7e2ba61a701e433300b12b65d7b15832404f490614ec3ca087631de666f9307b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
564981292d15bab20761438dc13a3c6b

SHA1
dc1bed5a5475f1481b501dbe59f1ac6e03c9c4de

SHA256
707152a44c3f2075e38adeb8d24e1f6f20e230492a23ef67d1e2c3ddf1ecc8de

SHA512
aef6ef39b3239a9d19b0bdbd1b94253ea7c6e1b5b557fcefb86f80da8897a4128d43d87278d3848accf22fdc6cd3e1ff3d46869c4e85e776af0e33e106949e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA6A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB29.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit