02cb1709b7d609a8100005b0308996fe6b8181a788628017d1192a2b72820e50

Analysis

max time kernel
143s
max time network
153s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9fdfbeb2a3b698a60b849a81c8df74f_JaffaCakes118.html
Size

48KB
MD5

a9fdfbeb2a3b698a60b849a81c8df74f
SHA1

f891aeedc30a7ea90d33765c6da512575d4ccde5
SHA256

02cb1709b7d609a8100005b0308996fe6b8181a788628017d1192a2b72820e50
SHA512

3fdd141fd7e332b42c3d98cc42eb025c9e7595f535f89aa948d2cc88ed48abf09dd61bde343d3aa6e27767892d77d398933e4cd2d89075f8803fa796f8ee1f0e
SSDEEP

768:e6KpCnqQwt18pB2F5UoNVHxGYWu/M+ZgKSVvw0YDpvc1dHRPrgit:eZH7ApB2F5UoNVHxGYWu/M+kvoyHRd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000bde500a5321b39723ea311027733f3297fcbd548479e9869ea106bbcb85eedc000000000e80000000020000200000001de905123eb04e694ce4389068889d54f2b5b76f86995717029185c7bfb23b5320000000a02a18929dbbb45736cbf65a9fb16d5ee29f81ec54a5d7714724e73038d47897400000007f7a9dcac6e0e63126475c0f07f05ede406153b64ac5f42592968ae95f67856359d3a91ef556d705cc92e70530f4ab842ba965c62eee8a4d9e85356977b57760	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06e275d03f2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77720DA1-5DF6-11EF-B137-6E739D7B0BBB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430211738"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008e9009f41cf22f5cf300da2fd4827518e418c2d145cf5caa8f6945ca4e305065000000000e800000000200002000000062420dfa69365d78dfc6a92f5ec8ce6b398ec8bf48d1e1eb57875837879be0e4900000002082ae9b8b37007a9424e51b3dec7bf56d9a1da7362a777e34fdd98a1eec5a63082aae8a160c57453275ab692f1e8fa657977489dd2a1388b94b9f3da49e17dbfa5724916f1777931437021991aafe85a3881aa6fce604cece579787b2b5b4b8c7514b52f18e65ac0be76328514c1903831a38ddc0698335494fc118bba7c0f41b643957a43cbbaf09e726f19fef3ad240000000106373f74caad92389f214b377de7682c9e30db82fe33b6da59ab765991587b26c3063e531a6fcadbf5e0caa2ca248ecb51ee078eacba0f0b0ec5d41f3064975	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2300	2240	iexplore.exe	28
PID 2240 wrote to memory of 2300	2240	iexplore.exe	28
PID 2240 wrote to memory of 2300	2240	iexplore.exe	28
PID 2240 wrote to memory of 2300	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9fdfbeb2a3b698a60b849a81c8df74f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
145f95bfde89bb71e2ca8565c8a319a6

SHA1
9c2be51ffa03f9270e47e670c405fae30a65f730

SHA256
d8aa429dd4ff4f72cf34b23853a948643df9db35529ce39cdbd704e54bd31614

SHA512
feb11551f0fe1e3b04362752c2ef4490dcc06f55ef44f5b6b31eba5f34045bff3baf5cde2d39e899a4f879bf23b165abbc357fb1053e8cc799cee2ed40398b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87c7bdb15e6590b1d9f0c87928e852c3

SHA1
462b8ccc0eed9db30118a018ac8192d90189dd81

SHA256
4354ea0ed75bf0635778358dc730fa688fc43ec2084b8ced4cbb39e60a54a08a

SHA512
f11faab361dbf2a8105286b0ce0c77e9f0eed4ef6c82c2a7c0af29a732d2606b3f5dd63454776568cd76c933c4ded79722f8c10bbfb9dfa40f020e8cb9d762bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f220c3ed87101376c074503261941344

SHA1
ed212dbc5911e81436c3a9fb86d760b9d7197058

SHA256
5e0cffca54c062f19c7c1d52d1fb65070ff09baf62ed57fa21dd72305ccc5563

SHA512
ffa346663160e2187350444075cb5c3c8e77e26f34bd348e71b8c882bf1fd2fd825c7d579402938ab1cd15437fc751570b0bccccd2ed5376ecb67b965f516f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5614d646f5b2b4d5b92502910b062c6

SHA1
99327954f87fc280cc61213a5b61bb3088910b61

SHA256
90f348ab43f12e69098c03e420dc89ca3295acc2b8a0b1133c0f68d58d23343d

SHA512
ccdf9e3eeec2f12db2e9ed0d43543a6ae5387513f26a5ec16d687cd85ae5bb41c760f4c360b7d6055249a8d3889115004c3b3de4ec5258ad3b09565e28cdc750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f43f4f4ea9a89b037cc06dc45b8291fc

SHA1
796b591bb8854f1ba1b0186a84a979e96a201ba7

SHA256
a2bde8499f2c860c361d950738e09b22cbf2ee959ea11dd632bf51fe929a2731

SHA512
cd739b3b70d543e492b3e24bdea0592d6e6bb9d7cfc15cf1dcec2689d64598d25f071f55994ebc5ff77a9c85ca6155e132adf315fd9c33d94cd90777cac37b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae4fc222dbd013acaaa095371e07e564

SHA1
f123509b3fe5c11ccb9b992a2191c649f74ff1f5

SHA256
77a17da8534441afb3db9a666aabed6d26c9c8d43d96b36968313c92b2274874

SHA512
9d40f8b01060c7e4df4da4b6ee67f6fe86974a20895de9831835788f5abc7c0079714ee800eec9faadb0884e2963b236bb6cc633cce6fd6da55ad1f8cf0e432e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44006034ea7a3274ff301bc03858e54e

SHA1
0832ed23c0186eb3c4f588b80e5f4141488c19a6

SHA256
ec8227a927d085b1d8a1d6948c68749bc9cffac72a077a944e7bed6b37dca00d

SHA512
22165babee66366adea110ff2672bed2ddeb774de71cbe3a864d16b88fca85e17d1675e05b7c259b251e689fe24465cfd9ae39fc731f121f821211f1ea39e93f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4cfe551c6cbf31a84bfd376911b9f656

SHA1
b4eb1df0973dfceb010dc941813992ecf9d90d11

SHA256
bb3557742505e0962a28cb3c834d53c6d0544983cc9fa031d6ff9d4733fd26ba

SHA512
69dd4fd364fd37c9b11aa09e1e63ffe7f49dcd16aec9063d4857146f3f09a9884648f1c195cf53b8f62f3520e001e9526ef68cbaa0155f198c34f27bf4e9e1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e9c11ea3b482e82e27365748bbb11fd5

SHA1
9f15059a189ce99946ed80a3a64f9b503d2222a3

SHA256
f551681819b947fae48a44dfbfeaa622fb83704c6e73cc816d921f718e370749

SHA512
d05ade9dd7bd51989d27f8322bf55c06cd673a968f868f90dd681f2dc880d2cc275df8737877cf0db419f1e488217c2ea558091bfefcfd83d659fd2d913b08f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWMUP5AI\cb=gapi[2].js

Filesize
135KB

MD5
cb98a2420cd89f7b7b25807f75543061

SHA1
b9bc2a7430debbe52bce03aa3c7916bedfd12e44

SHA256
bea369fc5bdd5b9b473441583c46b9939232bf1f98c1cedf6bc2241c4f5068d4

SHA512
49ccede4596d1e5640a9c8e8be333f9c18812d58f02b2b15adb54172df1387439e9dc5afc4ccd9d8f0f75f092318bed68d3cd577338e88ef4f9373de8a07c44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XWMUP5AI\platform_gapi.iframes.style.common[1].js

Filesize
55KB

MD5
aada98a5b22ec7188655c2c17a083c57

SHA1
7c3c2fb8744e7412d8097e28f588788d91b9cd9b

SHA256
f2f09baa213dd3dd95edb5a30c7764e4a44d9a79c0831f90b1ad8ebedec9dab8

SHA512
a780aa3b9e36f61be8240487e75c19a96fe26d54abf9006680a00af9d1d394e81e517f0bbbc13edff3a7190679260ecd56fd5cdd7c2d2f416ab8982c3277b953

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF8F2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF8F3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit