1c1625208050a5fa0624f7cf679588f70725f40aed5d0614228e700d86aa99a1

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afa6b85070ea91ef0b7d726a551303e2_JaffaCakes118.html
Size

68KB
MD5

afa6b85070ea91ef0b7d726a551303e2
SHA1

144b9aa93e87458a47796512764900e690de25f6
SHA256

1c1625208050a5fa0624f7cf679588f70725f40aed5d0614228e700d86aa99a1
SHA512

f7a6a5086768b386202068508957f40d151251cb2804cd42bfe2a45c1335b691e9713f4662484dc896ebce1d7a95dad0a0385b047ef249652864752143224dbc
SSDEEP

768:SJ0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/Vn:SJIk/2tnwO8+fsucS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48D4B981-5F03-11EF-91DA-667598992E52} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ad235110f3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430327188"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000000ee294c3f8af764960ce4254620c2980490ac0563da1eb42dcd1dd991084745b000000000e8000000002000020000000ddf9963ad9bd9be3595cfc1d8c20e328bd714077bdfad5013873393c38077f5e20000000a5a6620f1a73005f50a9ed74fce7019a1490efad04f3cd4500aa7831ee07ea6940000000b20613f67f32021c8a4ccad050dce39610c3d43b6ae375ea31a0f114c97cdda3580f69baad73e25da587fd1b85484da0fada42a8e2bbe5b22c54c6c44cff1114	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000009b7b00c22b804a542194bca2d351d3853ef77dcc82589d3ecb3a1938d75015bf000000000e80000000020000200000008521e4ae43706a8560062ab28cea04cc4f3a5e51648487beb982afbed657a7bf900000005eff8e3054bed4bac21a92d3d329267b48e7a537b995adc1b350a590622df64cebc7f32a43092f9da66e1337ffa0cccce5e050392343a4c0885a9cc19fe11bbb64781f359d2cecbad9e15bf134495ded827c5361d9df95a55bbde58a35fd0f7fc0f414aa31d636969466b6a97692f197cc6019b6ce73e74430a15020a060f7f8b51b47f298fea8f47160731735bde0a6400000007a140fdfc78ae72c7830bd02fe71817877367ff82584405814873890d898ad402756ddb761cc2b2681a4bd061632d6e37cd35b442b6bc9fbeabce86785d0bdcd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
304	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
304	iexplore.exe
304	iexplore.exe
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 304 wrote to memory of 1924	304	iexplore.exe	30
PID 304 wrote to memory of 1924	304	iexplore.exe	30
PID 304 wrote to memory of 1924	304	iexplore.exe	30
PID 304 wrote to memory of 1924	304	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\afa6b85070ea91ef0b7d726a551303e2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:304
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:304 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec09f557761a32da561d9eafe1038a44

SHA1
4f3923b150548b8ee781bb74425f9fc498e9525b

SHA256
423c8d8465f0e0cd2f6395971e1698776bdce78cc19d7083e9b57755f059d4a7

SHA512
4cd9d7f0ecb5767907a04f1d4b4c130fd81077729f32263a3f3fffcd6d25bddf3842d058c1fb40329f696aa332204aebef81f6ce6b5bc2a9b492a2962248c1f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14160b04faba4f62b66bc6acccb6b665

SHA1
0726b93795fc7071fe14fb8cae6586aaced39bda

SHA256
607ffbda091405fbdcdcf6950e05f3caa6b83356b629b0c426d58ca819c6b695

SHA512
d197d7511ff1b0e92bf6e7f93e3810f5ad047bd1570a5bac993652ca8677a0ccda045eb036decbefc443e9479e10abf642c63565afacf08d40d471c552fb4604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
543090712026bd6ce926edeae76de219

SHA1
1956f2adc2e5e7a605187077dc6506e351a0f08a

SHA256
8a896542b6e1a7d5413fbcedccae7ddad0a735cab1084518e5df4e2727769e7b

SHA512
d4ec92bc0c075665b52516ffc7bc932a6e7ceaaa24b9ef025ad6ce324dcf37c3755efd4021611d8839932bebd5f24bce157ff2c9628d8604dd1b4e3f752df704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
099df164a6840af4daca612049f1c7a3

SHA1
b4b01703bb47a2f64a3c36a09869984102612aa7

SHA256
79b94ca3ab96dbb2e53745e78ffb330a59517b976b5aada573d1de433f9b8432

SHA512
f424b11fbc7c70419de85f58f290fcce9253aafd88278ee7ba00cc1a6e7baac45a591813f2d3dca1bca42f55d2a5dc22bc792ccafedb7c6e2326e4fc8beb3265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a18d3e5d350745354eeede463880e5e

SHA1
1e72817424f843997455b858fae55be531b49e0d

SHA256
057666e026c7d38d0bda9f1244df5a0311d04c2351b7c1e7fa1cd62344245c1b

SHA512
9776f21b9745224f7a4ba92440a52a4e37a164dea91d5e2d0e834b290f28625c6f5713cb714478ce948068831900416f45540fca6896a1780fae4059f222ae63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
889549cc596b7abb9a8dbedd8ce501d5

SHA1
f402defbc5dfc8f0d0651470daaa3c7ec9379e29

SHA256
5cba625d7830d2c92df6a58aec155a2c8a7c7f1eb13cc1ac1f5b3e388da3e6fd

SHA512
230ba04ba2edb14c1ee3ad4b316df9070d29ad73ee83d7941d4732fe5294cbd51b5e16ffc686acc8f90f8932838c9fe63e21247a49b0bd33fb5c76adb9765d6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16baf849b0e6bed602e2d7f1fa427756

SHA1
a572702df178c82123ab5a60d66bedbc1da8fff6

SHA256
60e77a7052500908553afb6e4be821ca0c4a9e828eb41becae05fbe8d521752a

SHA512
22a8bd099da48a5ad8030f67783409ed87c94939d5a520e16bafda55bf4e9fee601c5102708803dbd5c4cc22492fd14487a55cd48ce392f076d20ae8fd74da60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2100eb024fe7c9a211e5b9a3be40969e

SHA1
fd444ac07a835f198545c05b4a2bd2e1bbe127a3

SHA256
d2e1b39df993ed70b29f9a4b16d401ba6714010379f65fe99676260d25899159

SHA512
cebce2792a56aa6c0eea05fa006fde32ab6cee24f76927c0b0c46fe09907753f80b38d2ab6fa2abc440a702b50f0926d6dad29c265a947b8b4ea35a6f30377c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
085f3756c61c34236d2e20a99d6800e6

SHA1
65288d5fffb33486ad69da4af3a4c3401b42453b

SHA256
cfcda9daf833d34e75ed446f85d36963e6327f91a1f1760d43debc075f91520e

SHA512
9eb49c49e90672dd608a0ee26af397210ba4b1ae5e6013531e3cb5a10cd077629b41995c34aa8a9acbc2690d5b2f1c8283f7512a0b611f4b6a831ef3f7d77299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74e6c86a6f828c49e66416d86c6450da

SHA1
24b3e91dce171cb27155a7a404de919982b8f452

SHA256
62e3cdeed7dbb799aa2f27766f942b57a95b21c9941825effed498e7770d5358

SHA512
0051adc4c68e02c349e650bf131bfb72246343748ac168d9520bbeea2c3f72d8638b0a22c5249015a225ee9ac8a8b165882575c4b2c8aa856e0e6854d7dbf940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f95856c0c1ef5e50cf0ac8fc795550d0

SHA1
2f2a5bb2d29b89f0102c64a1925e009f8f4189bb

SHA256
56dc6b62ac4d2c05eef926d7b72b602246b4441a0e3012c97eebe3b1c5a5c9fe

SHA512
5df7deba0e1a4384b87d706b96cdbbea1ea6c4382921cf602c945fbdaf3768ee459c6b1223fe7adca6e5efdd180f01378b73ff8d0b8d726cfa0b97b7b5124ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca10f06275bb69802f58dec61c83fde5

SHA1
555e81eea662f63e644bb90efd5c2a576ebfb999

SHA256
903001d23347e44927ad4afd6c27628916acd3314b1977251836a1773087ef61

SHA512
042c97679ce40deaaf591b09671bf09891b8c72b52b1eb784dc8f45948cc309d1d04a94a46d5618ec6c902a7b1c604daa49076b987d4a9d59289d1e1aa896345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cea90bc60bf58446381b5312c7030fba

SHA1
a264bb2d2c37f7f7d4c72525affda55fcf2afa21

SHA256
9ccd2d0c8933a1f2d43880fed5d583d51615f74bfd98e79774b8ee8d49cb9f15

SHA512
030cdab5c63c3e605ed073f4ac86a6b588431b55e62349414a57b8eac762b61bb38c0734372f55207ab478420a317bec7ce0c9bf17d0cc927dcfc52466e2b74b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0e279698d3efc918ffa3dd891176312

SHA1
318da3bab078f40b4f43c933c2cbb162540f4f8f

SHA256
e802f82cf60759f51a042c60faef7aa72d13751a9caef7a85e906a972d1e4a40

SHA512
2519219f443fd20b1b6e2aba203e2874f2f33487ad932e0642d2ea6658cdb6414af905b76f63ec810c71185cb7286d9767a0dca81651255353a22f0767d9f33b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA305.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA327.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit