a172208347f5029a5a13002444b440636247eadb790563fb65f491aec5e99630

Analysis

max time kernel
79s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d14882d1a8af5c77ebb549a0186dd90d_JaffaCakes118.html
Size

42KB
MD5

d14882d1a8af5c77ebb549a0186dd90d
SHA1

bc8942517b42b6eb295b585c72f2a658cd15bcc2
SHA256

a172208347f5029a5a13002444b440636247eadb790563fb65f491aec5e99630
SHA512

e2c41e5d3951d3bfb481c4072d4367114054529bd1e7c1aaff93ebaaae502f7902cd34c25c5fd05a687870b868085da69a005babe57e17296f5c68fdf578e546
SSDEEP

768:VoYxcixkBnHFOHS7VTrhbrp5oodQ14abAydLyHp1ZfrRJehiwHOkNI1YLFf9:VowFxSUsVxQ/RVkDV67ujSf9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76B8EC31-6CE2-11EF-968D-EE9D5ADBD8E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000031e5332b6fd043fe6e749acf95cad9f01368bcc9f0acdc1666219110920324f5000000000e8000000002000020000000b59c322b4c63cfcf579b65738f38a1d4e5cc09db1af8e6e16e877ccd291619859000000077ea3e7d637fbb1225c88ca9269022c7387698536e28b2c879693bf018f4da999c0242fdf80fd5e239417aaaeab7f602045d2bba1508658f64d187bd7a7205e5732a812d58a4d33bf942d6350ca69ac78a48f9359c7dc890d16263ba8f4d20205c32b81bc1e508e75b76f4ce255e898a93f14049786b7a091cb595b332fc79cc9c89dcc29a17d1018a493242236c543c40000000da74c09a0ad706b434ebc12adc4e62ec388febc532b00169d40d85fd9634240a2d31d4ca62859a3d88aac7ff8ee9a339b9fab56da3e6a042d3f6d7c88e76eabb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000002dfb174548537098f074d5623cc06df263203b837caba84f1e4160064d1eb59000000000e80000000020000200000005ef918018ef7a835e6e1cfcbda8bb0f0b15e2b4b58b2dad30592b1e2accfcfa32000000082f1c7ad96b19c1e445cf7b58089ebade3bdfd95bbacbb3e0966caad9586622840000000eb03c3107b9797faad08987bf3cb974cbea7825929475b5225d07407538a7aa4fec02ca88a7c3f428b5e6946a4d7f51b3605e584ae3440f052a1fd0ceb63a4b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431852417"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402a905bef00db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1040	iexplore.exe
1040	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2576	1040	iexplore.exe	30
PID 1040 wrote to memory of 2576	1040	iexplore.exe	30
PID 1040 wrote to memory of 2576	1040	iexplore.exe	30
PID 1040 wrote to memory of 2576	1040	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d14882d1a8af5c77ebb549a0186dd90d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab0c4442a166b4baee67b714e66147b9

SHA1
88287d79f50e215412c0d3921467a416637e0447

SHA256
3433f7c7e4e0f7faedadde221fa36466d7412313c3b9019e8379662e3a6b0b26

SHA512
9c35dc0b2479287c5fc0d24100ef9e403b479833d32bbca40631730c280f8f816e7237e2e0e1cf1573e32d20ab40dc138f9bfd31750107ae1fa2dd0ab06802f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c839ed6e597ce3f3ce6d9674d72ca67

SHA1
7ab061e7531b46093090adb5296097818351d6cc

SHA256
d98a2fdc207ce934a727ef922b314ed791f6ad9239a9fe6c31c09068321b668d

SHA512
74b87f56d48ce157bf51ae41a96ddeba32045c7248b52e0683fd5fad48b92ca92365ab5eb7e00b28b4679baa328f974061901e612d2866e9897ec7d6ef42d34d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5217ea2771701aea064036d8111064ad

SHA1
7bfd52f55b42841e1999280b927c64f1d0b4de81

SHA256
f5fb040d7bbaed2693cb715a27a3a976e5f87327686ef6f1d37ee87b49eb6184

SHA512
6745c82a0bb2192257d062f66835763706d069e75b847909d592371f51c4526fa32a8a2408a008e2dcfa8c7db5f761bed77baac0ea4e07a770f90bc57687cad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc94d2b3ca985faa4c820111ab8df565

SHA1
ef36e1a38240d2e3fdd59d7ce1a4d7a41741d2cb

SHA256
7b22e313f78f0a1b503b3f38903b5e3495758da69b86243792e934d9ecc17d5e

SHA512
56a6dab5c6ff16ef29c3df5c470348a964955ca45c94c6ac86f59cc3fb7f97cd68d5a04c978fc22772f1c04dacef04c0e589105052a3207554c501bcff8ab29e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6755e50884d7c8f7e412a95b8736092c

SHA1
28ef61273d95b6c1e09c9fcfe0dd13be27f92601

SHA256
3952a98ab9d472c854ef001a03bd03e378890d69560a55b52d244bf97dd209f7

SHA512
bbfd987dd8d856060ea3f3d85aa27d0c8682841a4ffdfc2ed06f12ba3f21d6e786880c482984dbe9def72946ecb62202e176722a6e8a0dd871d2548041855057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8cc3b0b3265d00f8ae6d0f65d187d4d

SHA1
9133488e61b8401300437340613d455c4fa33a8a

SHA256
9413945e0d14b5a26435d31552bbd23acd0f9892136dc2a47a4f0cb372bd9219

SHA512
722beb930374c1a9c83965f743c40cd701c9e2429ac327d700b880652300cd9c3898879bdf5754a4267b0c8b8bc468d2474931d6136fc6a25b7c22d72e49dbe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46f041761d60e18b446dd6b3b88d7146

SHA1
89917ab0b8f0c528616c12d1f4c2b23fa95b4a92

SHA256
fadee8df4b172e42e5bb26bf135342bd72a6087f0bbb3d0312dbb447fcb85d16

SHA512
e2406a69190c7c35fa0927193349a2e6917981438733c8059ee412c15e55b6aad09f63327a26157c30a1ed6f45df3d899bc97bdb57506ccb4e2c6490ddf39da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f931c4738186736f71eb9ce52861606

SHA1
964a577519c173781f66bb995b28d3fcd68530a6

SHA256
0679b1d261e8d1f327655dad8934cc83afcb05657eb02493f4a847b99eff4aa8

SHA512
0a220b68669cc8ce8ac7d1d8956de4c1ad6abd94720ea20396a0a11894ff57c4410b86a8b748ee5a2b4377b9fa254b1f23ecac5e3b2a93262b74c609137b393d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
652ae7ca7a846af8d597fe1a3240aec1

SHA1
ce277eb987d6fee09bd02376fb07c6b68d065ab6

SHA256
894299397687a1a0b4aed12faf256d785331229cb95a00091ad955a363571774

SHA512
c68e669c49787abe68542a80626b7fa7ae0b8f28c9588912b3dafcfe219441530c10fc720406d29652db60d30ea1c3c91a8bc02a1ff934cc5d5423f1fc6a8d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceda3d9b6e85140be2d21569a19658a2

SHA1
ce7a6675217fd87b501935c4d07c4df1db9a0a02

SHA256
94086fc75ce2ad84df659fdf14804fab526f26bb994aa798ddff31bd2e4df1fc

SHA512
a03ff853e3418e55497c9348c77f7fafb1934dde247aa508f00efe41708a6f0eb5309a3053ba4e4bc5697fe7977e7f2668a7df2a734106634c6310d428015a38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
743dbba8124572613d4abc619cc95e78

SHA1
e71c6f625d21eb084566bf41349688479b99441e

SHA256
1c6f2cc8dbaac0820e992460c0db79399078c88e4a4559beac673c411d64bb77

SHA512
257b8f37266af734f8735a17be82ca8fdcef0aa2ea60070a4b3003abdd08f765149331b22494c014b7b232ce997a07506ef48e9986423968fd80eb453516128d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52ad7d291f15988934c5dd7f63936eb4

SHA1
0976d17635856bbbbb056aa5ed77a1f35dbcb708

SHA256
205c0ed19ceac4a960dd74c64f3c21f3ae19a99055ee14f3e919ca04652ff56a

SHA512
e6aff7efd0652aff7ba6d8633054ae57a5f80f236e2ed5cd4bf1264ba9bdbd820aaf03e212a31f6e3047b09fd69bca99928053c602540e8ba692864c0af7a457

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab33B1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3402.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit