d114429fb39b4cf29de06058ff52ae6a623740f4e6b19738905f1e3431d403c0

Analysis

max time kernel
135s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baac9f675eca0377e16d2a61b19ac116_JaffaCakes118.html
Size

53KB
MD5

baac9f675eca0377e16d2a61b19ac116
SHA1

5c48c547e0dd5490a33840b2e6948c1d79aabea2
SHA256

d114429fb39b4cf29de06058ff52ae6a623740f4e6b19738905f1e3431d403c0
SHA512

e07a7f40fdf9e3e21bcc2a5645d9b7cb3a9e678a02f1b02dcd2a22c2ff83a2f512669f789949bad1103bc2a23cee0c1ad90edf69d4333bb773d7c46f90e11b6b
SSDEEP

1536:CkgUiIakTqGivi+PyU5runlYK63Nj+q5VyvR0w2AzTICbb1ov/t9M/dNwIUTDmDS:CkgUiIakTqGivi+PyU5runlYK63Nj+q/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430555717"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F3084A1-6117-11EF-A76F-5AE8573B0ABD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b097003524f5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000003e7a8451b4bf898f771ff5b8da9dd65380b0702776309b9a95d4b01d7171a884000000000e8000000002000020000000a828bb668b0a7917a55a43cd63f2f5a81476c3e68910beb591ebd208b2d0e11990000000dc8cd5ddfcaf3c9fd3599fdd80820c0f410dc7d51e5f41f7fff32d84ec10844c1a66bd938e9be0cf31137a2e3d72c91a6f1f3535e6913bd7b0ea94b38ab679c4e12f7a317d641f4812ac0fd428b6588bd1704b0422f50188f690de398dfd1e657098d2cc487c674117d735babc2e99d64afee2f7d204c3672fd4c6b78a567c39ffbd016e72ec80b36b8be8a33505d09940000000491dde5e27281aa323d3efc0a0e731b881db2618d4f7c918badc6d00eaafd0473163d136f9cc720d01e507b4d4cb6badddff966c7eeed8d188ffbe31c0d1bd4f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000ff906e5e8390f02ad9197bfc9f4e1459a2ca5d48fc0b6f7682e817ec1e569e06000000000e80000000020000200000000dab40cfba85159fdaec4131c7fb9ba0c6e7eb06bc0b3e7cf18abbd7ed2e1e4d20000000ef7810f0ef480d8eca1d4e96279095d2c48936d2a47e51aa907ac13d735ad071400000009af3b2ff807ea4f47db40112f74ae23e18a211ff4c1e4484dc0d194f302fd60a3ad1dfc71d0a2760629144cb951030a64ffff65bb2bd0ed0351a053b639e2cc9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE
1300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1300	2476	iexplore.exe	29
PID 2476 wrote to memory of 1300	2476	iexplore.exe	29
PID 2476 wrote to memory of 1300	2476	iexplore.exe	29
PID 2476 wrote to memory of 1300	2476	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\baac9f675eca0377e16d2a61b19ac116_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e43563cc0ab06e14760d4bf2a1e2e2a6

SHA1
f7468dc62772928163b279d56bf6a305c16a8df0

SHA256
f90db2ff0f6c30957cb68b1e01cc9e4fa1d0548b93d2cffd745ec459cb7011a5

SHA512
f923d7a969b086f5fb7e45b7665f78007ca19146e502bb650910a2ac4a8ae02c9401c5916365b84e9589759a000b8c21008c64be621b7d5b7431d50109053096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
809729f05fc98453e957ad963ca74f01

SHA1
03a0517ce51b01b0664b12538fa5e7679e29c77f

SHA256
c0ec304d668eee313ccbe9f4e05af608324d53a9f47ffb462dbd3af4bde99738

SHA512
81f41ec0bd3002d8409855fc52edd8475335603ad73d21fc23ebf33eb28d953cd40e27f857240874e6172999826552cd880f973874796727a733a6b644c6c162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58dd17f1160264d40f7133425a3ad466

SHA1
3dad94844eb48ced611b110d9c4705b78cea6d4a

SHA256
2dd718b7a69a8a4db17e15e9a8d219b722ab9b2fdf7915c01c5a4ff6bc0a4696

SHA512
91b2ec625a718059c0496dbc901869327b0b28dbb9b9820a3c37a0913223d5d9d742c87e4ff9a637fb2311315005193a4081a918a30333ff82ce7bca6da41083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3d8b804032bddda7ad727d0878bfff1

SHA1
11413a1865124b4329342dc7123319450c2553c0

SHA256
9c767ac77d6908e999d22ee31a4dd0598623469112574406329d1beed68493d2

SHA512
99e7a1cfa02f6d94bb4aa749ed4af6bd26373187345a9b8ae67927a6057d2f1e795a388cdf5fbd03dc4052c35fada1afa33e3928b06ad27255d57944f2ae4eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c25c782bfe2f5df2e0a86863f390eee1

SHA1
0b55334a9bce44b3a1a886dc360cd158d307168e

SHA256
92ab916560224dc96a6a126d75660a23a5f5fde722fae43c1f711e9376bc6175

SHA512
19d6d819119984e1c504cbfa729098fb84d5d8fbf74f19df0e32fce208d558408ddf7baa2fde92bbbbc3677352dd3d0bcfdacb03bb7db94a1bcadaf0b04e2249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ce90e30d51b32b63da78d2d00fa849e

SHA1
f09308f5c69098d645fbca3b155789aa044ac264

SHA256
3fbea584aa3ee7cd9813dbbc825a8d4deb8af8aa530081c568fda5dfdcda577f

SHA512
dee4ae56cc1fb51a72256c70033996037fc0a7e153dd433509cf3098e551e4022505adb2a4c9bc8b926fa23f17824fdedd20c5a506ad035781c2461664b99aa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc612c9ab9ba2d18d1d15a13fc31eb42

SHA1
aa9ba5708c0121fbbd43132c6a30c9e5ac8dde8d

SHA256
1893c159d05cede314fafdcac072ba859ddf1adfb74057732a956e99fc0acfb0

SHA512
acc50e9762b239c36e01c4c088db8bce281d8012668cbf897c50ad25d65abf67a1350eea189fbd6d89cd1c7890027d387218616a6a756f7617fceec84e41f840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10730086f6d389112080c215a9033461

SHA1
72f977f9bd84d244e393cc160a42fa8488ac2f6a

SHA256
1a26e187cbc84b0ff44336318364b706913dfa1b46a96e31d7911a393b075d38

SHA512
bf3e2340822829b96f0326699e22f10eb70e99e8f65f4e5dbce91627e247ce837042f41470c4c0a010c7d8f1034c2fb9a36fca91647663834468961b6d76f1ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f0a190715cce59f0250a1f20d4b8435

SHA1
f1119efcf464a7ebadbe19a581879f7f55cc0426

SHA256
c78c7ea6fbd3233ebc7b61eeb3163aae4e56d14bd34316ab898f04af1eaada06

SHA512
84f95888a68adf271db26cdba527f37408f7c961b0eded604a534c5b272d4bc4fb94a070d488128556ffeb1d289ac9bb739bfd1254c0c33439a5c8d1b9927b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82be75078bf5e956c9c0e81d4af1170f

SHA1
f331467325981aa41f6b96d52d450cef3e3bbec7

SHA256
186a36db71cca5ebe54835d6136e589ee70b277f1e6bc0daead16f9c4b9d13ee

SHA512
a91e713f8ba2087cd52358ccfce40e360943ed7cf410cbda6cf0607bbf76d0f44160cab7b1f9628143cb42128a0b616509c074f0f63f55d58a296044d4009492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8507df6d276f1a0fff70217dfeea934

SHA1
f66dc4eb4c01d1ffd1601b903c556a1f49b88327

SHA256
ace86666eb84eadb3061e03a492715285ed3a7552e8a4b99c55a27601b2fe133

SHA512
46d576160c0f3f8d137c793ca658adb04f445c4f3ea694b0b839aafff3a58d8ad170b80b478e0555b825a9c77ea8f04bea7cd20be7a35c9005e03494c9fe6cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae225c2c453b558ada29025fa4078bbf

SHA1
6088c1ffa8fcf5dc494f4e616d45c1b00766b88f

SHA256
17975709277889082b9dcf60edc1dd494ecb1e5190687df257291b70a2e51155

SHA512
2159181e896fc69bc77ae4e92ce66bd77aa3af0e4aaaf4709c312158d1a8400fb9c11e4183d9b7ee86bf3a80c3ea591b63ec0bd2876e61a6174d8a0e539acf0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31cb1e4d7053a7dae8e6855a008d8c45

SHA1
a0ebff44ecb96fca340ea0f1d4aeb40e7665e542

SHA256
ede8fb5abadfea912a9c273f6ced8eb8b3248be5b275dc2720b0541c0e273795

SHA512
adbbf61aef40354a3467dde8993057d0fa77b3900fd21227274b556bdc4f716528e0676d7d539c235ca27a27692c268236a646c213ad31184ed5cadbdc4834d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8901bc3cd3773d4b957e8d1237d8202e

SHA1
407b7ca09df0f4d5cb260f60eb5e1ee9edb7f72b

SHA256
051363497c9121da4c35fa08c57083b12202b30543465badf7af59d57d7feb17

SHA512
fe41b60b2a157d819f3e2f4846a1257508c1c67febb2e68aba9af2cf1a8e90bcfc045ad503243715834132b53971f5ab6a4c23c86604dbeb760b2c1f466c0ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7885ec42e536795bb51da34f852ad420

SHA1
5e281da5554bec7befbc5d8fc9af746ffe7eba85

SHA256
e655fdfa0bb66a4e1538ac93ce5ac5e6c5bc78338a29898d3282d4fcebbab5f0

SHA512
fb475627173594314c6baf9ece76d4a87e014dc32de44196e870dba9e4ce904f5337dbc3ea1ce598ee0039c7df08accd504d2653ccc0b69e47d589cd5e944a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab30D1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31C0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit