d58c79b02dd34303b79755bb0437af656da84fca2ee68daae2370e01b257c0ad

Analysis

max time kernel
136s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d146b690f2e4c89532dae468632da84c_JaffaCakes118.html
Size

57KB
MD5

d146b690f2e4c89532dae468632da84c
SHA1

ef31c185dc0bacf9c4bc1d735da7b1fa4339e99f
SHA256

d58c79b02dd34303b79755bb0437af656da84fca2ee68daae2370e01b257c0ad
SHA512

48ed272247d91f0de487723737fe54edc0528b0d3fbba512e7a8252918be6e590b52a6485afe994894a74e0cee3a169ef217264e28e73d3f7526e664657dff9b
SSDEEP

1536:ijEQvK8OPHdsgjo2vgyHJv0owbd6zKD6CDK2RVroTGwpDK2RVy:ijnOPHdsD2vgyHJutDK2RVroTGwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05a21c7ee00db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000001f9212c96b5cc18996465b32c5fed2d8675c628f36b676b09e1bb5e93f3b1df3000000000e80000000020000200000009997cb07847ddacf7e47b6d4ca70d0d0dd557eefe7953d9478c9e1d4b5f32a9720000000e0ef3370352ca1ba1bbf03670fba14e61bdf5ebcceadb6501c8811adfcb4e21e4000000047490f1f7d413712ddfe767e6bbf229a4476f204973e60479faf6fe60dcf29c20db75d0b47dcd85377307739dd6c5ed85f0eb0e62ef33114ad75e04e1371760b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000944a48ab0f4b018823e983ad5820d085db589806149a5f4c02210e373ab2223e000000000e8000000002000020000000f8eb8309675290701920d6511e81512fd03d01fcbf3f11c5a34d205f6b4a5309900000008678b6c284b46af9ad2e4d8fc5a7fe6ce63a93bfb7fdb9b8d759268047dfed126b0396436ce9f995c0ab1c8d04709188b6cd96115a6baaa92897e1b7da46780832b6f7df1fb85973f463b0f6342c71663ae45bd4aa77e596a721ae6c2a5e3e9f74d71d791eb87435300c7b6923d3aab42dd35774eaf9a0925d883049bd2365f2946a4a33b09192347b1332209427519440000000eddcb400993dd0d5f9c614caf3ba804f831fda096101a95558047beeebe6b1258d1675c5917acbf8f84741df98f939230a0f1a7875626ac1a42b946b1a656772	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431852180"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE4B89C1-6CE1-11EF-8F1B-EAF933E40231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2788	1964	iexplore.exe	30
PID 1964 wrote to memory of 2788	1964	iexplore.exe	30
PID 1964 wrote to memory of 2788	1964	iexplore.exe	30
PID 1964 wrote to memory of 2788	1964	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d146b690f2e4c89532dae468632da84c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
5cbc6a7ada0d7008d82054bde7a2c569

SHA1
137ca188f2a1f4da33da19ae8033fa754c701a21

SHA256
219e76503eee37b12fafff3e8847a22b4b9b535dbd5f2a46f1ac82c6e1df0a81

SHA512
180a8db277f565dd6929a4934f13e285efe8fde33710131723b16aa8aec373e6d7c80e2bca5a945ab3614d50b1635cb2fb24a95079db950cf594ee780ed9e36e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7676c8f898cd1909555363e37ebf66a9

SHA1
c41bdfc074883eb014d01cee62b5b926acfa6a19

SHA256
704f138ab233f3e1af818dc4744dc1b9955545dc8797484fe9d59e4c229bffe6

SHA512
69fd10d24d478ecfdd0f107c28a756399ad210a4be4c28473ce097f9d371bfad30a19935076d7264b81a9e24492c9b9988e4b98256b809e3dffbbc6aaf847151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2b2f6dfb1ce8f0a892d5843d6ea18e6

SHA1
95939dc1c43c48a132b791b841a813b65b606d2b

SHA256
3fd255eed56889308b32fa5a60e64b0b55e0a5429879e81bea3fd9dcf7b4a881

SHA512
09eea9fc63399bbd3afee56f74ca355241a0bef59e0f8f9bbc0c823d21d6fc3cdb405a25ea5a1e12204912170797c828c1a00986890b502a0647f7f5b782e773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f68b9b66cab3ae3c209b9686b1f66d95

SHA1
ad6b90173f7384983caff1988647af241c342243

SHA256
26592292c5b6de04593fe105771e4225596691a0347a9f0f0ded8f2017df1a42

SHA512
327b9418551dc3ebff716d809b0a734e1549d08e724941f32f4064341db389f793ef2ab2c091ab3f700429a205238862df99d83a236528a4ac45a5ab7ee8acfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
610fcc1178c1dc48b25f1062110fcadd

SHA1
ebddf5cd5d8898bae89f9306a964a69caf89a70a

SHA256
5124deb13f7956dc958061b600c488f38aa35a6370982912342c8762f0148050

SHA512
a4e1fa0cb2bc5321da3cc3dd55350188f6cce543eb68fe39d440b66cfb9e5c02ef5bd26bb0ade45d380a5858713213902d15826d91344f70ee3af3e2a3bb5176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60eeeef4b4da703e521afe3196aaf1f5

SHA1
29553f9c5d4404e6f7cd4acab0417960ad234ac3

SHA256
6df4b531775884f5335318d4e92c29280c2f40276badc9cddde33ad93955c288

SHA512
700108dd8c7a7aa2ddcb4404deb405529c46e38937c8110b777a6f2d9eae39202a799731873612b24e1f66e35d25507d57eca538e69dc125c8e5e1c41dea66bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95b429ef12b45698662009be9e07a070

SHA1
3e0425d59df22651f4299de1703854d5ad16401c

SHA256
190f728bdf2bf0c1b1350e4929e5e321cf18e8e72421c052a8e35fc296336f18

SHA512
94b4fe46fdefe3eb227248c527608c2eaf694592fa8fb120f9c4e305ac4ffa125baf7b6ace03063c7b3f3336d1dd087dd7ea089a351a05cebc0ade08efe4c446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aac7408abf19be1a8d4d629514c95936

SHA1
6b56d651a7d35f23b58f14ba5599cf4483403a37

SHA256
79f26a15560d1c9aa3a5355953a6152a7d1ecf72ba9d84a3d408687b8ad3f663

SHA512
424ea53566fa30efb1e4dc519da112d4e938d27f9b24cf93931266f992a9bc6c7e1b2e51dea0c2d7bfbc8ca22420101319a8b6a8b79b3cc4b2141dd7a6d1839d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00bce1653c002babf2649b73e84b772b

SHA1
2f35df667ceb3b6363018dec3907bb9af03ede65

SHA256
5b112dc170429b4186aba566963b496830b449ce741e13a01c0d1910d1954a95

SHA512
0810b0197d54aba2340b028f4d56a7300072cdb6b6e089a230d253f0e8f2841072e3f4e0a939db18f9637704324143aab2e8d4e0507c5504a271fb5d94d7ef7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17463785003029504a4a217042d43dc9

SHA1
973d5e357aa7f4a448808c2eacf4d22c3b9d91a9

SHA256
08260f2230f2b81f9a2f38ecbb0af401b872ed591f884195a7f5a863c8158a70

SHA512
89463f28105b640933a1d5be52c53e8cccf873df7d6e1e90a9bba07e84237f5d0dba0de6e6a55dd288e078196fca2491e8b0cc518a855c442dc262f71a7b0447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf3a9ba65953d9b867a82553ff215175

SHA1
31a370398bc19c112b2f8a6e4f64b9bcbd79fb72

SHA256
96f75ee163c46ea6160f612a6c3830eb064abe6b3d4982ea401a30afc51319b3

SHA512
4f56d43a26e966cd5f85c2c1d8111aecc6c88f648f782c55261e48377906c0dac5900c9b2f4c96e3d71a2d48043b449d9442513999cee57d8841fc16ec1986b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\f[1].txt

Filesize
39KB

MD5
87589c438a13a514081c8a6065cf438e

SHA1
0232902ae6526adf4822a40b0d5cd2c1949e4708

SHA256
ddee4df85256edd5f22a70f1692ade0f06d129fea8dd6d539be46ddfd8dd7a91

SHA512
123c5af5d99ebb96201364f7f207e550f4dfe364761f0e5162c93747d83fc6c831262876328435bea39eca4188cfcd9fc37a0b8a992b33f8ae0691b4b39a3639

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF5A9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF5AA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit