1b80ab059e158c87cdbc5513baa47ad4d45dcb3498659511ba258adcbb14550a

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d13c65894a04cef630d2a9578c78e672_JaffaCakes118.html
Size

139KB
MD5

d13c65894a04cef630d2a9578c78e672
SHA1

ed14d650a9a5358a718de121d554c465fb7b274f
SHA256

1b80ab059e158c87cdbc5513baa47ad4d45dcb3498659511ba258adcbb14550a
SHA512

d4841feb4ff83b362f419a41b0d59195d7d65012ecadbf3bbd2cc590775bddbd4f082f3b360bcb10f86c9067fafbc92faad385734211e3f9513f0a2c42b79e05
SSDEEP

1536:S93jLEvTIlfcyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:S98vNyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000007c7c04fa38bec2ac67772c08943499d251dddc2d4a5ae7bc9259850e707c8b21000000000e800000000200002000000094e9675cad092da4fe7f94c418a3ded3d0437bf45a8143b4bb4c96c5a4538c4020000000ba3b1b6344139e0248bb205ba679dc69697f86771d7155b9ca06ef2c9ffd09e140000000acb1b1660e102c0a60df5ef69f170e6b80974bcc0497660f4f11d318463e95873147a0dc3a10ed4721c97d277f0027c3ede2633a7ec37e06179cdb6a28fd9dac	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000ce21ac50f2fc7c7088cb06523a227c8a795dccccb9d0bf877e51c2dc6a92223c000000000e80000000020000200000004596e88772b925da2fe2b0c4db425f9426e3d395c566b861356d9ad02f37c3be90000000221eabd2bed1d25531b236ca09af7fd83a8393629e541f3f1c7aba5fe46a2009f46bc453e859e3ce2c14a8009d73a5be4f17bc21407fc84c30064a3e4aa0c4d166c7aab89f0c28f30a5c4dbc58d398ab77c3a0aadbf520035ae0b247fbc515638f63bf34e0808225b0291a56f7712c45648b473acf24f085307f569bd55d06675f986e5ee139f9a16ec6f3d47d31123540000000b8bb940dd91596017d4bc53d7ad0fca21ddcf9b02aa1acb30970bb208fed20e751d08e79448bc34726f9b6a3a799ca4d0b6fd23834da6fb088450a2915f5967d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431850787"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1C2FC21-6CDE-11EF-85B7-D6CBE06212A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009afac9eb00db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2568	iexplore.exe
2568	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2172	2568	iexplore.exe	30
PID 2568 wrote to memory of 2172	2568	iexplore.exe	30
PID 2568 wrote to memory of 2172	2568	iexplore.exe	30
PID 2568 wrote to memory of 2172	2568	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d13c65894a04cef630d2a9578c78e672_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a9bfb28093596eb11d11735d460499d

SHA1
22242cfefc629051fbf69e1870a65264f1e8e219

SHA256
2a7a71e5865de8e52f6da8ea808347563bf8ccd3d5a0e810a4b4bc5820b138ec

SHA512
2b90039ce54366c9181296ab67ea5adb86b786af5913707e3f867e708bf309eb415e9e3e5b893fcf9cc49a8070ca94c8151f66d1a9606a9890cad37d3acd7ea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2500b12ba01f4047b224f968ee8f08f6

SHA1
9de5bcd6578b67dcae3dda06f7857ed8e9a8ab0c

SHA256
8ce0ae89a7cbc8e777b884109529b992d2873a4b56d3dfc9f019bd5f6a5242d2

SHA512
083b9bcd701ea9c37f54d482c58e4c277c14a95c1dbdd4e5d7a79dd701a07c58fe3381def0fc28ed66e4d90d87ae63fe6a72039013b153578dbba3437e600828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d11ab452d5b167df582e17cf738fae06

SHA1
0fd23d625357e8ef471c7c20a4ef5354faa5763b

SHA256
a94e460cf8bfb779ae346fdb2d7cd1979e39a0a1be73aab60558002358aa7765

SHA512
973a006ad02ebb2dce149d14e468f68777e1d885a51642316bb765fe87a45398a062804288dcb5459703822d3e588b85a5743b68d5b18ca6f8d75aaf47933239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4e136410c419e36bf438463863dfeaf

SHA1
dcae410f1dbbda1d046764113f4e69d272be9ef1

SHA256
253321bead74cb767140d5647398f1348b2aa8c9494c75ec732f1104762225b6

SHA512
b5acc0bca345f62edc5b7397bd5dd5f8c994cdfecdb139eed1daf9746b49a5864999731a689a1068918332e680587ab2de380a597d758acfecfa72c11ed285f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a44bf97fa701f756a88e39ce8b488c6b

SHA1
a7023f07645bb28cababe8b2a45f145a1251ffa7

SHA256
a7f05017e7380a9900558ffef5f16a66100585a53b53b4776b145a710103f976

SHA512
9d7c28400e1f9284d3afc7336498d02ab792239a657c5daed1bb84863cd77bc22e07b0bd0b271a2de461076b8e5cd63b1dbb2d8b7575f0a0f816f8698b565ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ddfd0f62cb154bb306884c7e085a179

SHA1
e57bc21cb0ba3de6f1efb5390e872290be0aafab

SHA256
9a7ac60fca4d7a497588ad26d2f6c64d5196763ba33267738b19b3f6318e4635

SHA512
530caa8310401cef6c29823691c75120d6fcd474466ca12ee4245c567de4fed1645bea5ddd2a146d09949231c5f5275a108d102a852a880634134c48792c6644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c39e7abadba065f520263aea32623ae8

SHA1
ca147b52b072c00139f8f4dec04b983487f7f1a9

SHA256
176b402a6477dd1b20ead334d915f3beaa59c310114b5bd88e18ea6ecc8fbe21

SHA512
e17ac342567366b794a72d40e4b9aa0f300aa511f8fce31cc58e5738e3255252b9aa61d85c8c1036b20ca118c0a02144d61d04f1da39f92c8ec9f4978d957a2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3e4aacdebee43740ffa6241ac85c526

SHA1
5fa9a433aa4038bdcff8324b2eb883868885fb59

SHA256
8299b5819cab62f3046c8cdda8a599f7f7a2227efbb426aa4e338d0ccd8039db

SHA512
410a083222c1ee5b9a15f79c0a40c0fe8b8c51eb2dba76ec0062aab2da7139d9f9d2b8884ffa58b1e57ebabce6ed63423d13dfa68eec55cb80b62b5a38bbcd9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1078c30df6862a338926eb061694c27

SHA1
9ededb4915fadadaea452b01db9f908320198c96

SHA256
811f752ee90ae0d8840867b8b974ce911770a856d19a575feb7379aae795bc61

SHA512
b07424deee05feab28b967725cfe826e8bb347f75b915734940e4609d22f5d6e2eea5218a33243a320e2e3b421424d7a4a3ff41c92897079d08f4210b4465f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d71c62b005ef0c694b1386f83578be7

SHA1
720501f35647c43d243eb2607741f0cb72b43d74

SHA256
cd8f81a8edc9229502753b565b61c816111a294ba2edad1e2feaf2804ef97710

SHA512
3b08527063e24b2ff0b60a31bd2817d538dcd04cb2e3d2acbfd81f87ea0f2c1c06afa9d03f4c3959055e1589d76fccd2e9186c8a508b82d55ff7397cf021a839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc7c2800ac19d6f5f955fb88abaf59ef

SHA1
536c06e1656c310d27355aca7fadb91780a830ab

SHA256
9ac8a848dfd46f397ed91074f7757bb56b219eb0b4c8cd2af7838a9aaf621c73

SHA512
54614a65f115520c0b0ae807fcb99dfe88777ea43a686c066d649f40a5400aa5fdcedf256b5c78773e7beb4d35c0b6f1d361d03b44f24c9b55a470c699be51a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8013e2e31f61c8eee2c0e0a2108f7a48

SHA1
64512fc766239d6a83ef0e8b8293f27e090019a2

SHA256
a16961b0c979069cf3656d0c16ffdbd181ba2151050db3bf94fbed111f39ded3

SHA512
fc42a58d0c4d538a064551b579685e828ddf73ce8b18b8a3947b6e3850bb9a0b7db33d963e670d7a8fefbb763dc858ecd7e14bcf4aee6c832a7d5c553d6b42a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
710163faeb2e571b8d77d2feef2767c1

SHA1
bb70331df032a636ca3d29bc3c8d08e31904523e

SHA256
2f565a6bb3f319cc0c53c24d6c4c9c8c3c92149fb7e92552d39f95ab75f292de

SHA512
fc48e17e611b3f2c24eade8e0767ad129b68ef741e571f58b40954162b9746ee54d254053388c2aa87f1d1013681a278ae6e66612ffc578c704b7e8d2b359fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cfaeaacbc2a95d59836d525dcf3ea8b

SHA1
afe0311195b107f95774638dc97270399999509f

SHA256
c88d771949e81cc442dc641569cb98c2193f536d8d3d1209a418a781194f7a8e

SHA512
6c8115cf81a575a98ed70a3cbb2e290c3f53ed1f95804ec9177b508dc5dfef057b04248427401738757b4ccb24efd697073bb0ce4a766edb14435a1701fff80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
342c8ea875c587cee1944a8b564e6efb

SHA1
f0017fba48b356d23dcfbd5ed072a9797f5b2a7a

SHA256
8a00488a021bd160ff9ae62cef8014cc17e93695fde2b072f21943d605999366

SHA512
2b05f1bed77c5e53665178d45386f01156be5eb9d05947f317dfbd6ea5629706d1ccda8f21399516b3d27653d91636eab21d81b42e544198dacc7e09d782ab3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC17.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACD9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit