908627ec3ede9bc3a94b222fdeb3c0a464f5d4ab707d49f412c4004f0c28a514

Analysis

max time kernel
136s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad8578006384fd68faceefc4f7926846_JaffaCakes118.html
Size

57KB
MD5

ad8578006384fd68faceefc4f7926846
SHA1

5abcf995cbafed22ab4aad54a74178a8c4b25d06
SHA256

908627ec3ede9bc3a94b222fdeb3c0a464f5d4ab707d49f412c4004f0c28a514
SHA512

d4617c61f28e9ea82dc0b1452797768b43eb911c5be1ab2e0d0be73ea062afc903902625488f2878a143e32e579934900cecefa6cc12b3ae5c1abbf0262c204e
SSDEEP

1536:ijEQvK8OPHdsAZo2vgyHJv0owbd6zKD6CDK2RVrorgwpDK2RVy:ijnOPHdsp2vgyHJutDK2RVrorgwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0baac65a7f2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000a5f06f81ec1c8927749d7891e7dac14e7c19723def9ff39772cf569627c67f7c000000000e8000000002000020000000840fbde67d923b0cd5ccc64e942a6cbf8b66ff73485df17d1d68cacdce0dfa84200000003351b48c50c0160cecb3fbe4aa4803bec59cf81aa6594c950331ff1c7e9b9f0940000000583657cb18fc12da6793288e595407561381e0efc6d7193f4be80d68ce10fb3dc3e329721d2efd251d3cbe8d6b5584a45b612596e0100915f03ac060ce2280cd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430282180"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F23C581-5E9A-11EF-A17A-428A07572FD0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000009d8352bfbd34d1a4a62aaa4c0a155fe696472e667c8b6bbb5064cd689bf897a3000000000e8000000002000020000000217ada9cfce3b83e26b08ea3c6fc54cccf31b0bac1711c720e390d29d5816ce5900000003323c670dd53e8d65c3589fca60e5afb388a0afe2bc68ca15670347e9c44fd37b734ccf61a1582f36ec737c766ea0cbdd47c4f8ff7c6d8923cc51c8d9d90c0a69e411b40d43228355097eeaaa5f841281f21aa66ebd186994d076c42ff0df0e620830c6f59831ef81af64662396de8f44f6c2016c26e38c36ae06c85398744bc164e598488902a5ed018c06c4282f9ef400000000c362e6abea6020654fbf6929df4fa3edf79cf8ae559395db8c4f5c05e6087c5c1160b43016679f438dedd124de320f26620d5fef3e5560421bc9320690b20c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2716	iexplore.exe
2716	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2732	2716	iexplore.exe	30
PID 2716 wrote to memory of 2732	2716	iexplore.exe	30
PID 2716 wrote to memory of 2732	2716	iexplore.exe	30
PID 2716 wrote to memory of 2732	2716	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad8578006384fd68faceefc4f7926846_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ac1e54d9f2a256141d7ce5213c76252

SHA1
8f1d15f23d37f733f5ff9889f8f56f50631d7173

SHA256
84019d45d7b6371c34dcb167a97f1948609fa0d6a8b70f70bf6742c8dc760004

SHA512
1ce0cc07ab1e0ac65f95dba8091673a18721d42e9bbea1bd9f9ff220fd2eb7049daeb2c9f8c7bcbf31cb64a546a4b52f280a3ddf7eff4f83a495d8b847f2f15b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb8a0ef68163a01742bdc9dff1e2115d

SHA1
7e7ab75771007b9663aa47cd2f9cefbe59b8575d

SHA256
48389cf47f1852b26452663c8eadf139f569977a8413d4ef67b662db50018bc6

SHA512
8946b3d37420ef1e5844ac1b3593fca9dce5835d3b79d6174e24e8fcbeac368e088e1a77045a2203e8f7854693aa7587bb1bfb45b21b777879292c817251f7e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc29d0525398d6f31a433f4a5abfd125

SHA1
1a75753e7d311b03195d357a3065ef423b596124

SHA256
770d7594e4df2d434ac054de36020a05ea2067ce450863d50616f06ed09f6f6c

SHA512
fc6c8e86cc57def650f5f2998b38d20ce01107996e6d6eb00bcc9d2817694dafbc0a6debda16b2f6552e1c7f2b2de713718220a5ef913bffe0c20cc0aaa9a19b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d37e1cb4297dcfdc4e7324b4229f001

SHA1
75bedc20e5d75c7e82761188e485ab92b4721204

SHA256
3c1400f50851bf5e7e1aaae324f0e901a2ba59bb2af9a4bf32120842b0a1d1ae

SHA512
3a70f7912ce7de14c431e32ad3ae12294939a8ff530c351d986f15fa54ad87084712607db3b09d9116a1c96740b00e452ddc254c60a019e9ce81069d1f4f590e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86a64cd771cb606632f75646d4a256f0

SHA1
66c1e4b1be24997c31bcaaa752d4e49117dec3da

SHA256
e81608a46694baf32687cd9cdb13bf29ad6960809c331009d42c076f431c0a07

SHA512
090d4437360be6a258ecd97182610fa74598c2ab7b541449d980cb307580598e6a23bef656ef1dca92b6d954949773b4d209e8c43df28aa563a9cbd80139a1af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0c315fcfb62c0c149763fd918906079

SHA1
06aa81ab5a98fde556cc62728feae2e10cc1d197

SHA256
8fdae27b986de7cedac25de762565a4900dfddb8973a0b24326aeed8d5638d0f

SHA512
ad1c830d5868ce49bed2ae5c5a39196986589fc1aaa386751cfae14c85c16e7682e0df393fdee306de8df54ea829c0d819c004b4fb4193bab870e9ddcd72d296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac1ced18d3029f8533b9b64ea4729d1e

SHA1
9a75537949f60a2d3b9350f4aff1229ebc44b2e4

SHA256
3933e45fb1519ff4477af9d3f67efb2652ae6219bd97d181630cfbb3247816ac

SHA512
cdff50cdc376d431bf54106fd1a2759e81b2e11edf0ef8ad1c95e892c1add14a90cdd19a0c920ef5c4ef77e4ef7a3bedc9c4da3134ba1a7e6ef2756c13ca6f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
610c2ddbe023d9ed9151512f2b5318ab

SHA1
725f5dc4e91d7d28b01cd970770540c0dd5baa18

SHA256
8334fd6d2c1e8a65d82de26b12a17f315ce7a9fa973c8aada017b3b9058ae8a2

SHA512
bbb9b9dded1abfd358ea8d9cc5979b5c4acfa167af7856d92e17d4794ee6cae82295d0372ad5b70b78307650b4f9cdc6e5c5dd6ebf671fb653097f6dac8e719a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a04564161c43cd761a37d3febad76b2b

SHA1
d9f128a496ff0b0f74dd20164a6f3e49178db357

SHA256
a58e84d3ef40bfaa2e0ae021dc634b75e885d0a6fb866b61aba0f29d103863e2

SHA512
88972b64b941a24dc694f8c0589919f19bf697f0fc675f0721f8b1dba06e7ca4b6fedf304ec04da4ecd7916e63f8adac2ffb622eb1702905de2c3509270be1c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e0235fca6ac47f2d73eb9bcbd3a959d

SHA1
6181e644cf4d2b405d425654f6c9f5ac4f5f7388

SHA256
c4aa64bf47728c900fb4101d4e4a0ca2bf7ae564145488dd9f1be3a986dd4d22

SHA512
0ca3f2819ad864def59d1a337f2d6c763a1c02a403a7d132d8565157e40ba7c362ffad3c2b6ee34c6794baeb710b2cbabee4c393c083bcb6592612934a23b418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47addf67f10be27f6f06be68d38c2dd7

SHA1
8b39b850c4424fb3d9843ee0065b0d351d8fb668

SHA256
8aba0ef8cb7acf1914422c7f21f93603cd046d57e06317302233d0c08fb58444

SHA512
39f605ec331eb51eef834711f8632b9589a7d58f3e480c7ff83f1844d11a3172fd38872140d746ef67f7fb35b5168af11ada92d25b8de7dc84d9135ca9d5ea4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
753eb92106a50ed6674f09c06a922e38

SHA1
57ff32bc0a1d5d823da1aaf25186df90d2092d3c

SHA256
2b2116bc4cffd2838f9f5b55a354466372994b4e790e3b007353e040b9541af9

SHA512
5bf104e0c2a77722d1fa49f453df3f46456a5f1d9cfd884f2475c86238a23d26cb4f49a084258e12b76b0ecfb1f029e9b8b5af94e715db8b1fb444db8e2b8413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GL24G53\f[1].txt

Filesize
39KB

MD5
dcb821fda716d84011d3904363df37f9

SHA1
1ccf023d678ca27fe80a56a49ff45a716c703101

SHA256
bb76eff912d285b11f01b012864be2af0408fed7993b109aebc29a1e8e23614d

SHA512
279fbabc0e532182b076fac601fb0a403e04f409a71ce027c9e06c95037c7029639f8d7d9512f59cabe0d7bf483ca517156c38afb9fd36b19b53546061b23f5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F82.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3FA4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit