c83eb5042c65f1db5a2387b3159bdd3f751850b5241d230d110cc8931bf26cae

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0a7be5dbf202bf57c60390d600d8c9b_JaffaCakes118.html
Size

53KB
MD5

d0a7be5dbf202bf57c60390d600d8c9b
SHA1

1607c13b4366d9d00e84d0c868bf0bda215366a8
SHA256

c83eb5042c65f1db5a2387b3159bdd3f751850b5241d230d110cc8931bf26cae
SHA512

6d6aee1e24450ee806856a0364649b6edf4e09e9bc411ef2f256278d0a84fae4ea1286f3989eafd80820713f218188e147e8ae50ebe8ed3086db96df95e41b2b
SSDEEP

1536:CkgUiIakTqGivi+PyU4runlY663Nj+q5VyvR0w2AzTICbb8oX/t9M/dNwIUTDmDH:CkgUiIakTqGivi+PyU4runlY663Nj+qB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000c238a1d0deba9c3d879c74a11572f3ccff3c418555de15372a4980289fd11d1a000000000e8000000002000020000000a8ff7fe6f1c6e930f7e34faee20ae2d220ceba9287f3a9921dd60a754f5e887a90000000439f4547a31bdd5d8295dc96ab9e4d73f9067219d724e97aac9df9ae5573123123309ebe762e8eca54e4a4e751dce363dedaea67b323bb907b8d223e763947dfbb0e2d27a69c22ff0a8e1cf56e60f082c2bebd4fd9a9cb7470d8ffa715969d8191026d33ce3d91f0f5fe6708708dd29ea46c24c50e9a316f462a65f4709eaa3faad2ef29a70a6331282d593e45a51307400000001a770d8fdc82a9005de4c47770a2a71ebc7bf465aba91ff3a5ce1f0c20eff7662acf272705b171d7528f3070d417a025caf339c53bdadb07170140d0f6dda772	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431827886"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56D4DBB1-6CA9-11EF-B895-D686196AC2C0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0266131b600db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000d97b269b15adfcdf384e7436be0c494eeaccb246644a944fe220a34978d3e566000000000e8000000002000020000000dcfd72e2b5310ba65a71e48e367cdf64f8f95b4b8388beb2fe2bfcec55ef7164200000001a5f2ba1463909691642c75d677bb86ddf4028828b9cb4befeae05664022075e40000000962520ad03605b4dde02c6dfdc012d563ade175db7a0acade16952a72e7fafbc58cda7b94a49b319526258b21eea1b8702759009e254f62e685ac5bc9b015a26	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2052	iexplore.exe
2052	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2568	2052	iexplore.exe	28
PID 2052 wrote to memory of 2568	2052	iexplore.exe	28
PID 2052 wrote to memory of 2568	2052	iexplore.exe	28
PID 2052 wrote to memory of 2568	2052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d0a7be5dbf202bf57c60390d600d8c9b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c53d46bea4fa82eaac453d3f1a6068a0

SHA1
3c61a3793afeaf73c614d2dbb9bc105d1756d24a

SHA256
2a6cf083c6e43df8afd99c3827ce00884349db2eb46a93c93977ca03b43194d0

SHA512
ac2d148b02e3b33306884db531d50d821781da2fb31e13a9fdf83ca9c713ccd7e55fb9b925f28bd52023ffd91d5a03cb2870b9c2030b22386e3caf1a9fa16ddf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dbdfc3f64840ca7326b8374bec5c147

SHA1
435dab0c87853dfc527ec5e2542e715bfaaa5d0f

SHA256
9b1a209279933fab7447c10926aeb04b5497b5d26ebfc21f9eb2b1221d49b001

SHA512
0e5bec0c4257b57c787b33bdff47e6bcf9bc5d92fc753e9f2073018dad1649e9695ebe95df772b93ebbf8f2c8ab91bf2b4e8e52b989aab1cfb3e7af9a9a13a4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96bdc6e3216cf19b6b83c44f2a368545

SHA1
ff4536fbc48e516dafed5459e8d802c5b7d6b583

SHA256
d2fc13d49dee04ce44a0d10671702a1d02a1ac25b79b3e011debb27897c0f079

SHA512
9f07de71458baddaac19a2d2f14f8e535e7da63217d194d37fe46fdfd020ba32d31410e81845a3e4a4ea590d069f8fb81aa05f4dcf7902050c9fbd91cde59f72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc081be5c67a0d5f53278799bf1c8b55

SHA1
6c1fb59c8384a1f8910f774b4d1e52095d6bdc7f

SHA256
b8ee34da445fcfbfde08be32dbc9d619ec7007cb3004544a1f79f819f1d4b9b5

SHA512
031b2a668b10c28c0f61a30b4ba6dcbbb1eb338975ea76b64fdd2025615ccc80aa3df441497737cac316d00325bfddd7206a38297b16bf602ad0952b0418c760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb14cb02170ed8c55ef114fe90cda1d9

SHA1
e7f6bc6e8005b67dc9f21b3ce0f7bc44b86767ba

SHA256
db3ba1c38bb02d5de1d42f6931a26c5c7cdd5ac4b187f124afd47f8fb3fdd8ff

SHA512
ec04788d9e2bed6f2bebcc84fbb9759b4cda1f2a8c33e88532ef03be53755c067db6ce0c3a0256d71c9f82c84ed2b7bed0cae96be901cfab4066cabaf7a68c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c9d976c3e6d481b5d0820c7fb51161a

SHA1
15b46ce310d1d6b5832d53875ca51da832cd2c0d

SHA256
9dcce183662c7af388422c71c7470931713742b68f069261f08f17340adb7acb

SHA512
73f95d417deeefdab3e616016648a791ead8e00845675d5b8371ce1450691c2df6d4bec85fbb8d1defacc891ec2fc842f0674c7738dae7f40c51abba861b6890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd285eee30a443af207598dbdff9de1f

SHA1
24f27dd4683dc0b9984088f13e56b55fbd35c32c

SHA256
6971185a96bffc79a09ec2978ac0b30aca3102a4b8f077c00c4e459df6dfea5c

SHA512
9410402fddd63f955f18c6ee6340977249bbb0cbc40c5e1566c3e9833eac91bbc997e8828d9f59b4866f6b667f0e5a2ef57c61bc68978b4744882320277d5cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ad77a016f18bdd47a4b828bf2eb0986

SHA1
51a24b703c70efa2d7802df10574edfda71041ef

SHA256
b7e1a252481dab38326ec4353804dff9d94b0bee93592a43908cb8f189a9ae94

SHA512
72e841a4ddd0b655452027ece103defabe1eb0830e3db59ef927a4d36ff0f5825bae54299465960b44687d7cdb08fffa7d2f23421e29d9cc9d8fc400c1174349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebcff658067bcc1e6846705f4cfa342b

SHA1
7c3c44500ebb8f04283851a082fed75f27a151ba

SHA256
c68a455445f45b27baa7b0ca48fd8b9478953eb30392871853f597465f3c714e

SHA512
3f40619972a1498b356fd306a73e827146b02eb159a8be4079b9874a5eee88c9c02dcd286a3c47b3174478238a1ba684d5aa6b3eaf3eeaba2d6b5b7bd86b4d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCATT3E5\upshrink[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB5F8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB65C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit