d58869cfa5c13e7650c0d127fe932ba37ee2d810454b86e15e1944c09d64dadc

Analysis

max time kernel
138s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a48447e2bc85f7d6b1eeb024f74ff52a_JaffaCakes118.html
Size

56KB
MD5

a48447e2bc85f7d6b1eeb024f74ff52a
SHA1

f5fa5f0e6e163543b6718291bf0504b966d2db81
SHA256

d58869cfa5c13e7650c0d127fe932ba37ee2d810454b86e15e1944c09d64dadc
SHA512

f624f59e33396df0256aca3c046b0249e05785a768fa88dae715f8e159949983c9e5d952134cdb6e99db3cb5b5950024f2c668c6f6eecd10048f9966fd62616d
SSDEEP

768:Zcd9QZBC7mOdMglpC5I9nC450obKVi/HUlMPd:gQZBCCOdh0IxCm1x/QMPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000008cf7987ec2aad9f70905c813cb2a02bd8a60e1c23d36f8ae6d697ebdfa52a483000000000e8000000002000020000000830454e3068a9f2454c60144b27accac05ffb3e6c1d8e02cfe3410198c4f6a929000000008641e45820ea85d78ec8fd517eb372fa59f0eb57a30f02c63c31f6be8ef39a9f51df5b5ee2cee2b302c14a1dba1c4282e2297b8f8df968dfb6458da081399d6431f1911ae0aeeaf2379bbe411f8049ccce1f9692efecc394db3986b3c6c278180737d1feb2026541c213e13e00ee302f9f4860836be8d5ac1d59480f8bf513a710a4c3da2a1678347cccb05b2896cb840000000c44b3f6074cf7c9d881b78d28a06e62d391dce6bc22f8de2ccbe03e8d99ac2f8c7ecaf54aedfdba73463aede08c985a54ab0802e546bea91aba0d5caea4b9bd5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c3dcd0faf0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3783281-5CED-11EF-A3B5-DAEE53C76889} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430098125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000531818e3c4e6be8d80f23ba38f334422a081e08c361747b4711c26d2105d37e0000000000e8000000002000020000000c738afa96aad83617d85a009dc24c3312c9d94dd68d0275187694ec25010c1f82000000096dd96b29d7a2771ee0590427da5c5cc600c8624342a1a8b33dd6687a9a351be40000000ed09d4adec6db764cde2c90fbf241c6728b345ea792f21890be326c9cb7fec28e64859af2f41a2855c2e96e86f42b8839885e2ce987401f9dc668f49e0d22252	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2756	iexplore.exe
2756	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2680	2756	iexplore.exe	30
PID 2756 wrote to memory of 2680	2756	iexplore.exe	30
PID 2756 wrote to memory of 2680	2756	iexplore.exe	30
PID 2756 wrote to memory of 2680	2756	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a48447e2bc85f7d6b1eeb024f74ff52a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31364c38041c4babe2d20427296d7ea4

SHA1
4a6775c13ab7452f4001a9a530dc8cb1d8abf818

SHA256
67ce43b04d2144efbe87e5452a53bbacf1e27d2b013f3358baff5275b860fe0c

SHA512
f4261bd92c1f63ebf017a4e8ee9874357aacff9682126de7314735a3dad4a1a90fe52b76c24a892fa196bfe6ee9db4f9a616835ca2d2a88e7485d947e3680262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b0911b72a67e0a0383682d2aeb1c11f

SHA1
17dcf12fc81cad17c7b91ed7913dc242b33c5f3a

SHA256
10fd36133f6267a1fa2d12e31ae224dd1f432a490503361a0f7f50551eee88e9

SHA512
762a2a86c6ef74962a87a141486af0799cf47040d965d5d38a58a58d2f75873f8978ad1985d74013a7ae1e60292ed55045e872dfa316c8388889719e1768aec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4b3bc4eb962b59bddbef9cff26443c9

SHA1
89d6668362988d84c3b250c17c14f7886e6c9784

SHA256
7da5efbb5e0898b21dd22b3ce58e97cce6318d322106f519207bba6caf060292

SHA512
4b431117f32e618b778cb37c8cf2fe4e068424b1589d7000de478892f2233b162a11a32de22122d007c9864551ccdf0083962372a52f2a426b131e332e0544f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca22abbd2af094da1b3dc65cfd76aa0c

SHA1
7c4292375c8073531ae80a03fa13ea60222c75ec

SHA256
c2994542b55cac320f1216060c27100c03b78198d5de3a230e954b60235ff54a

SHA512
190244fe02a2a3dd331c3f189e175c0f62dbab1a91e13b481d520ee2353820e3645dc66347b24f3ba2a9e50716ef4943b5ad6cf413ac0bb4325199c7bd875817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85eeefebce4a0f38b4b564c73039b397

SHA1
d04bb6b3685b46cddc1bdd868be6f76823b2651b

SHA256
d96318dc79e4734abc1714ef7bd12a2cf535477a16f371701236a4f18def10dc

SHA512
9d687fd516a58d94f1dd4a737df37afcb990bdc627d4beaf5c7218e7959353aa761ef453ffff9241f01f8bc245becce1481fefefe0b0f4f107531ef3be312555

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60616b14d26eb3fbf7bf01869e58a148

SHA1
706ca3c4c10cc369daac39d671007752d33aadd6

SHA256
485f280e6b3823ed2955affe7ac690dec279422ac549b9319ea7025df9f58a46

SHA512
d966c59504b1e13492ada9509591732153cf4acd8df1162dd4b03622a89b4b3c4c8ff8714f9aaf6d61bdeb27cd7202f4e2634a234eb2578970add33205856d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dac25960a7dc81ebe39212a4fee07243

SHA1
56e7553e0ae510d541305ae478dee7e7fbd74965

SHA256
4d8dc4d242a57b5be9e997d42d39a57f54e676ca580ec45c5f384f1fa316c638

SHA512
79015c2ccce7e20a02adc405a08e225b700dc4f31eaf3c6bce46eb533cca8b3f34565d6ad2e184ff876ce627f28f269f79ab688912786fe108195efb3834c636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8c69e7093691e1bcd372740bfb7bc9b

SHA1
e3b87374880c90d401e65088dcfe824d253480fb

SHA256
b22a37541facd82bb031b412ec9e04913eb6bb648477c3becc63ce78499b1426

SHA512
7bc686a76ad407835b0d5d5956f5177acee799667c4fa9da854eb7846bbf95e0d0ecaafec96e7bb14fe1cbc114590a02ba6fd71ef9bfe1757bf594bf8a233dd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db81153022d6f7515d30ef9ccabe6482

SHA1
c90576b0d1099accd2b229afc8d980468d9b8324

SHA256
15530f5dd6b224ad4af675ff99c93ce62b1f8c9ee12d5969117164222d2ab88f

SHA512
bc30902dbf6041354f3927313a7cca092d726c5f2917e6f424dc73b4ee00c76fe3e2bf36b8a304e0af313b79c7e1948540bb170ef10a4b0477366d7261f0a4ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ced2013c5120f98e6a140301d53f70e0

SHA1
e1e4f046508362cc9ec6cb64883286aa4c3b6543

SHA256
2ea4a517842f0cec3672912a9a4e7b0f520474251bfd909468ac69caa155a5ab

SHA512
d0ddb57e5acb31d80ab54e1664af0c9e2f72f5f876e93bf321fd132428043404dd432b7a9aa21e6c1588ebf83b17edaa09d0a223b8efc983c84ef3525f1f5083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1b197ed4f5f565a5b1ccb23615f7724

SHA1
80a3fec94525a5e08365c52451f11a2aa847880c

SHA256
ce995d92262abc20ea6d9495786b072e00118221e80a31a4d5640345efe9364a

SHA512
fb494219c38b4249a68cb12b59b050e0276a4769c5ee6f8e02493b03c3985154064e673d05be335a53e479c9f805da2e9cfc2791a98898e7de9155d6ccf5d04c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab73BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar742D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit