958d48a6c14a20914c48e220c2ac34c721fe377cd0e79051a415a67cb54011f2

Analysis

max time kernel
142s
max time network
151s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad230f3dee6aa5bd07b770f9a8b96917_JaffaCakes118.html
Size

36KB
MD5

ad230f3dee6aa5bd07b770f9a8b96917
SHA1

ca94d563e548a937231cad1d42ec83313cc62463
SHA256

958d48a6c14a20914c48e220c2ac34c721fe377cd0e79051a415a67cb54011f2
SHA512

39f4d3f41b0690b85b9714df7abda5cd318b166499b0303bc9df630d2e58c6db15711bde9fe5a1cbed66350f11b1419744e850bd5d4df2b4bddd00b7fbdf6326
SSDEEP

384:F1Wa0/tiEM/go8K8ztXtLPH1J2QSZjOHxTEf6I8IxGXtXaMxKuGRfo76Vs/axKIC:FctiEqi1ptIxlygQbKD/my/XwGhuWyd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000000aa0e556195dc624b0e7015eec8644e66d40a7a4774e76d932cd63252401a95e000000000e80000000020000200000005fe404dae518ecc47a040118c4011f2530fdc478702eeb35eafbb329ac24f9219000000069925f523fe8eb28dca83f178823bdb05cf319916fa44afc50bef2479904eac71d909649fcb24aee09d22da88345f67c2d3284138277f7ec91ed1e0260d4945c1a889bf6e1a2a363eb7ff9814c9fc80492643214460a6e0b847e5524783cf6aedaa6ef27fdf3d429f4511e124da49312fe705e1750f22b4eb2b9887ee4093b73eb8ff14b295bc06b3636f62aadee6e2a400000005e13645b2f416c2738209b43730524107fe4003589b609d77867f3371a1bc9db7fb66756529d940b95a90ce7314d45b75dbb8d5e869ef7b1de7216144dc9e9e6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000d91c459d43b6e3f02c7c03e94e04818f99ce3d870beaad2dd409feaaf61b3698000000000e8000000002000020000000bb859b096eb1ffc9a14f15b389890ab4cdbe4ae6647117029cf9dd10edf511222000000009d4d9ee9721a65a18774ad5c662f8fcf61d1c69483c6765fa474af13db6519f400000003c82baa42e2e75dca256c7c1cd4c8c3d08e2f7fe3e809e5806e7147e749fb735ffc0530f34f433f5f4bde5cb2383eae8796638199d2b4c8a9e4f34fa1d32c2f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FAEE4D1-5E88-11EF-AC25-4298DBAE743E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430274262"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50dc050595f2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2268	iexplore.exe
2268	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2224	2268	iexplore.exe	29
PID 2268 wrote to memory of 2224	2268	iexplore.exe	29
PID 2268 wrote to memory of 2224	2268	iexplore.exe	29
PID 2268 wrote to memory of 2224	2268	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad230f3dee6aa5bd07b770f9a8b96917_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ce3b638eb89e3e33047648e15772dc3

SHA1
27065928bb0d8f59a6ed319b2ef95d2698cad3b8

SHA256
504bd25ebcf32038334d4fe68848ab33dfe8e4b8ce9ff9b12ffde703897f83cb

SHA512
61993cca08920ff820eb39e7c4d740d516bf5c7bdf7adb3bb5ad31d6332059a2aca67fe95e2594aadb51410ac97093457cfe0dacd527241d96b65372a560c51d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e35828a573644e4c16a0ade5387ffdd9

SHA1
2bad71a2ec64b435e23a343388453059b20c47bd

SHA256
a178a3dd717e827bbd13b23637dde52e09d4d6757108e3828f9985af8a8f52f0

SHA512
b382288338aa60ace259633b8653928423a53604105fd45fcfd4fce8640b3f7834fbe7b9f06b6cd2c66b1aa46c541f6807f3388b83be90c8243363c521e37018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a267c84ba195def0ad460f39552a47aa

SHA1
4feaa5fe50219d189ac516a49b5c60642d8af865

SHA256
d4960ad51007db42a97683fa4993d28dd3d8667f1b5d23e2a8c1b04082bae5ed

SHA512
fd68824612e7a2a17f8a2a7095199d95b3cbf71c4323ecc55be02ccf66a761f4f8c2d90944ba226d684937c3ed3f0855b9c545c2d56c77224a5db05dd584dbd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d893fdf668a8f0be9add5f67182ea74b

SHA1
1574fbdfb7d2a89afe2274f6eb234a3dcba95c23

SHA256
82f0265f48567a3caba025290eb956d868e28b3f81c80612033bb9e0c909a89f

SHA512
dc761c7bcd8697f2d38dee35fbeb0d3fad7ee6fe30bbf5bcf5b529a85141ff328741c9d8d66738f289b40ebd9845f10cbc09b3271f09e0d69afe8c97b7c10ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bfb6ea5ce0744e1668ea645c8326c82

SHA1
808771e8fdd8240eaf00e8c71ede5de62ff928d5

SHA256
8723f9ea48ce52338515f939da6d948c5e02b5ab602082f6ec9a2b101c42edf5

SHA512
453f2ccde375cf6220d56ee41ae6b86b84713ef8c538d4609e2e66bce6f6b695eda798f12d847b201a55378432f562db2488af1bde7cb7638608645b007fc273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
065d4131c7c2163d59240d25fcdafa93

SHA1
41b0e83bb7881a65599bf0065a590532b0705742

SHA256
f0ebb6c4cd34f35c9c10ab2c1f2be26b46a10058d605948c562b71a1f5ca202b

SHA512
5d45cc78bfbe998c8b1c542a8d93ae8390748604b2d0f0583a78d14c8193da71d9ba365bcb2e4fe34d7d1e995cd91b2e1e218777dce6565a20c99561c234b5ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc90c9bd5c23655fb415c2b275121dd3

SHA1
d95a6514ceb6d7df9f85281dd84655f04e606dd8

SHA256
d5455f0df79957fc3dce2c23e9b7c9df45840939ea82d5c846497ed04edf33d0

SHA512
c4535eca894de192cf888a2e6ae2dc73649986625315a17e4328bd81e939b84976deea8fd34dfc752ac1d1b61033ab6ccf184b9b5bef0e36ccf2a0651a17ed48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5275364b2dc5d5204dce7e04c87dc5d7

SHA1
3077b52031b6fb5ecb02364f681830d0bdc1e176

SHA256
7ec77de4a80fb32b614bdfaa1cd46a4b65bdb214e2099eb7abc34a85b5fb770e

SHA512
8c812d13747556663c9f2f99e658129bc7dc838b6b0400079e0ab69c6685c130848b0979ccf5a820c8a070496515c11880c93d0a063b1e9b3d4304ecda561775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3048beaa8d87091c302248e7bfe05ee5

SHA1
8cec9100bdd1fea7c5c9e31a82effc5076e37628

SHA256
f19434c2c22f1acb19b0f90cb0f55ffe4e945e67488b0e53f530d04d879cda53

SHA512
4c09e30aa3aaab2035aa9a26ce27d8f97c39973e53f1ce77cbeafc6ff89bc2d71660b16355d9331e549272f19d1eed35b5971812eff813cb18e638aa736700a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbae8c6247db410755284aaec42335e9

SHA1
ea12efbd1d7f779ef0232cf49cf76f36423d2907

SHA256
0b5f7ceb37e54b9726681abeb052b3b96c8222926065441ddec80ae0a0e87b26

SHA512
469c1a72f0a2a83677016cac259bb5e6de3a680014efc64fbde831771d7b630970750e6a6e2b9656ef77d45522751fb3d19010de3d0c085908ab0ef96431ddd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97bf8233dd7bc2bdc41d8414c71559b8

SHA1
7c1e56b6929143776e0399238bc91ce01229a254

SHA256
45b1dbfe095caeb581e214a95e169e4d232e16ac51ec53325a09ced4fe1fd923

SHA512
40d4c583a4206aa2f58a257423b9970c1771446292212032af9c41a7a6489b358932ccd5fab1c2f733d391d8490aed1309c4b91e5f5604233a7dcadce99b12cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e7b5c5f178558d45cdcd645d68b80ac

SHA1
48489111b4026ee668fdde09d3a1e0d19b98312b

SHA256
75e92e843a88e73000d6328c4175d1608f9672d7c5a2a245d1ae9dfea8b9eeb5

SHA512
dab99d9f6596dd1262657ea40ad2ce91116813f81f11e9d8d697b685c2c95871552ed75c7df190ab6f417590a4627490deb59edd84696dd6a843a5f7c51e8bb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f195dc11983b7ff0453202ee4d7d8cdf

SHA1
577e8cbf7951e247b7d154c653246563129ad6a6

SHA256
05f538f45f426b553c1976f6e7f805b98cba649a083ab0d30cc2006ba8ea0524

SHA512
f27e6b033a32d4d633ebd5ee2657fcc4c1ee46d9cea52c4a3290c1e4660eeaa3cd396d83f96c012bf873271cf7b1f2936442e51c2634df24b4af6b1c66d0f449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bb577d76d2e58435095aaed6f8a8025

SHA1
2b308cb26b630acc2feb02ae87c4fc24174535a7

SHA256
1b3c19f17fe9b04e8d433da2c94fe6244139894924f145f0e614e22d5503b09f

SHA512
c3b6d65aee6fbad7c4e077602ed45771365619aff9ac7fb4e98e368664555ec64006164919bfa7662fc72dc57686d781e96544d6e9dd9f6f0f7e6fedfc2529a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3cf9301d9cff744d2f90a5509a983a6

SHA1
f6ec9c6ae092f3599a53b6ecf9ebcfc598ffaa6b

SHA256
c1557f4d1f3aa290c99fa099d9ea62a4cfd94be0435d289e0cf668c6836c2d03

SHA512
cb179d3a772271a39a1308380bb9017d7114aec581f7be409dffe80a2847470450a6f93e350b7c42f453b576cd289098477801516f88a41a1cb6df312a82785e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4CD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF4E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit