aecf1dac695740cf9240c13f202efa574d0e80b51da88ba2768052496a80127b

Analysis

max time kernel
147s
max time network
147s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af2b1c3449e8dc5d6269d834694f6324_JaffaCakes118.html
Size

139KB
MD5

af2b1c3449e8dc5d6269d834694f6324
SHA1

9b24e406aa139d4f15f85dc9e609abc5244fc8e1
SHA256

aecf1dac695740cf9240c13f202efa574d0e80b51da88ba2768052496a80127b
SHA512

fdbf823b1e3508498564f4344c37c1e4a990d49f7c3373e5ff9a08f045dae2ba5b7739b8b9f4005fc5ad48d6c715dcd491932e340c952dd313f78146d8f80308
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fc4QwHAl4CLo0yF0CMcZneuMKp:spMLLLCMG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000008cebab83146548c0c1b6536fc446384716692e6c3419f733795682a30344dc57000000000e800000000200002000000080915ea0b1cb16424e543aef2ea9dbb7db05e731075aa6541b95ceda426b5f5420000000b4d7eae8b0f72f8fde78854517dfd565f50cdd46350a43d5c5564446d58a2b2540000000463414251cc50bc9fb331d0c5d3d157c9fc39ac71faec9ccb1e11a041a394b0d579a84e66f703162ca4a91fe94fc1b5944879c7a416d1baed7338d20b13cd01f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430317850"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8AF13391-5EED-11EF-B90E-5E92D6109A20} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000078168d4aab15a657f7ebefcb61070c148b0b8be3f8469873461ec3beded32001000000000e80000000020000200000001777a4ae011c71a92cc6ba475192fb306ffafb284bc1ea9b8c3a94dadc7caf0090000000acd24a3f27279ccf177fe9f376a792658fcbc055d7eb12e909928ca37a9ae8ec2c65512c6d2bd89fec790f25e99e53bc0dcc4aa7c11b9ce836c21f2f0d997356be566c2872ca054b612992e60f6472aa227b7386a0f03478a9d112b9f14cf47094dd5df3bbf448570632b6684c121742fc0c32060dc2575bd422667151c9cafb723aa0c9008d699090a4671db89fcd2c400000006375fc1028a6de33bd0150821233689b58664cda91ac0aaed5ef4f8d700d6b347d578c4a368f80a61bb63a2cc9d00d6ebbb67449bc1f7f4846b4e05d3042d9f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00bd6e78faf2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
280	iexplore.exe
280	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 2988	280	iexplore.exe	30
PID 280 wrote to memory of 2988	280	iexplore.exe	30
PID 280 wrote to memory of 2988	280	iexplore.exe	30
PID 280 wrote to memory of 2988	280	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af2b1c3449e8dc5d6269d834694f6324_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:280 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
593ece2b401ac8862958fa9aa83293fb

SHA1
4b36bdb5596ccaad7dd85ac8eb6be5887f11ab0f

SHA256
2de77f1bba561b3fde67571fe53bb2909d45f47a07c6e04abfacf0c5ade78f7c

SHA512
0db8bb71c896dd861d527bb3adbd4363c39d96483cf03db2f4160f174c922a92afd9a634fb8a2693cf1691f395f480a5de5370a06b3dbf1dbe30549a53639d2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c28daf011f3903c432aba965a43a5c3e

SHA1
5c6b31e742dc8d9bafc8e31ea756bf6ee70a55a3

SHA256
b4a7d8178e789780f9272b7ca43b5af16ef1c82c6d5db4e0c82dfe474a48201b

SHA512
31c411bfbd486f6cdb5cabd3b3c8c49ad0ffd63a0a8c4a98a16f058e6ed013bbf12056d47122058a3cc8060435d189c7126245ebe8a5b2766d116ed0954c765b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6570d0ecf67f4d4287bf572904d34ffe

SHA1
f8d77e7b188ac8e3a7873ea295c1455012af2015

SHA256
3273000fe29535f7717402b21f6c873970e9f972684203dd341ee3b943233d28

SHA512
5fd48147c235826dd6a88a6730e72e0fc2a43d19cb3dcfe57341a9b86b364a30752db255bf687c8c2e2dd3f2c5a45e19c423b49e8658635329a0418e22ecb6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91a76844caa16fa3f69f1a160d388058

SHA1
96433487a9d7577f544dcfa83f1ff35302c2cdf4

SHA256
f92d497504e1161a958a5c485cf1d89419a77f5fd0aa8d1fa0875124bd6ed027

SHA512
ad37c83429af0f13eaf0858c042012469de97fb847c0525f1527e5742bba7c250f4de35128b62ff718fa878052c159f5bc7cc476f3841bd2831e42358cda7afb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0faaee7481b2a61afa7052bb50a11a72

SHA1
4f34c4f269fe8661a7c01ae107a7f281b0dfaa17

SHA256
dbfb75933f96fdae790a153bf06440ff2ff3f11204edcf787a873734bb28addb

SHA512
f6520e7786c7b301f3f95905ec89b880892a3640b641ffcd3fc442309b4ac0c585c0e1872feb8db00e104dd2c5e72a916ee4b81bc9c92bac023f957c3708f1a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28d4d059ff920fbf2d3598202041ec44

SHA1
cfc36a9f8b6b2db4569bc65eb9aee53231da375b

SHA256
9bb03b9324dbafc472082ce769a3c7ddbdfc05ea8bbf1b2187e68497649e7001

SHA512
fdd53222bea7b2f6f377e6f713799e976fed12c4cf6ddfe00614a324673cd2fa94ad1f177638cdf7f79409b74eb2d12e3be63305104720eb96573904b207efdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fee3e7d9d578771ff2ee4c97411ca386

SHA1
e84aeec0b01c2f2d5b6b5faa666be8bda8bee718

SHA256
c51b5c7e2daed5fb8503f7f1567db66c3dee056166a284d108439a47991c7940

SHA512
8f3dc7e59d271862d8f13152311666add586fad17f6f6e7a1f894b525ef3089113621d7637ac050f2b840ce43860830aaee4d57cc44dc9024cd64fae6d1655d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d32d90c891fd33478fe42ec90d6771ec

SHA1
091eb447fccd7ebeaa4c1c0cb57f6b18e2c87e04

SHA256
f2c88da3a16f80b95c60116684d2069430841a30720f022e7e51b0275914502e

SHA512
2220e47aadf9ff9c61044acc5ac182d899bdd839b0feadd57c7b62717107ce86445d9940807d4cd4522ef44e13914b8a3bf6602d5c6b06d8018a1ab71b342964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
685cb1174d06ee04b6ddd1d8fa50c157

SHA1
0185acd4a6879b086c589682cdcf8f7a3b63af52

SHA256
cd536405522076b12401cdca9337953be01619205c6996946929358fef9938d6

SHA512
07fb878a2e98d3f2340396bbbcfa33a28de31a0e3f4be40d4b388bde9e8a8a487af2b3f71d4ee6bb46926dab3cefb9080d703f4a5c393a1e9b5118beb630521f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC331.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC343.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit