aa134833fd70aaa662591b5c1e1922ac66c41eaadd8006628570337accf14a0f

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5546f4dd4bd7ee23de23bee72c49c54_JaffaCakes118.html
Size

34KB
MD5

d5546f4dd4bd7ee23de23bee72c49c54
SHA1

846c19d13287bc5d768a5783433674e4633e1d5b
SHA256

aa134833fd70aaa662591b5c1e1922ac66c41eaadd8006628570337accf14a0f
SHA512

3c4d57566bd7d3e4992c2bcd7f64e8e44c5e7c98f47b86ba13cc497afce4dc3297eb29a1c666b79c574b9a8421e67bd244f13872ce2dc3410e0797de4a794583
SSDEEP

768://+r1fvHdgGzCGm3+i4T7hcg7hcq/fz2dCsCVuWnUR:+hXHdgDGm3+iy9cg9c/dCsCVuWnE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432001919"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a06add6a4b02db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000072895b6b27dc3d3c84e48212449a487b79b6091e4918da4e8a457f529c37ea9f000000000e8000000002000020000000df5b0a4e97c2e47492cdb45184348102c088b58bc93ec33848258ce1c8b2316b20000000ed7c1930b0649e5845367a12d3f8a1989c703dd52587d58329e5c63051aadfa8400000005124b6840b9282f32dbc8132c341d1b92886f9ca48cd1641e4b5c8daba0705b15aaa57732ad4910f0941fb34ca1358f0a06012d62238ef20fb7eb2800263e0b1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000046422da2ed754bd8c5135a3ecfb796cf3ee3899b4ffda9b2141f5f0820f6d24e000000000e80000000020000200000005360fe1aee9577e26b122a3644a55e55771396d3ae6ccd2fc9c42bb688443f60900000005abe1825b102c5ba831ab84801ad1b75cd2d007e7f168efb42a8a32675f9dfcfd92eef0b897d3a065370273e04180aafb0a8cf0b636e830353e8eb5e2c4bf16d184a273372b37055f63ad8c439a96eb4b875262a886a83f2f012e909d1cc77524ddbdb4766cafbc63d192d7f4a206ca0fea2827852a95568bb9cfa82620a04655a07c98460a3e643bfad0d3ec4ef3db4400000001a3ff33b60a3190601b3f7cdaeb3e2126f5094571c1e0302efd4b8d314d37b9427876c17cb0a0fda6b446889eeaa87ca56f35608eea47a8a83bafe1fcacc7738	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91200061-6E3E-11EF-B44F-526249468C57} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2724	2280	iexplore.exe	30
PID 2280 wrote to memory of 2724	2280	iexplore.exe	30
PID 2280 wrote to memory of 2724	2280	iexplore.exe	30
PID 2280 wrote to memory of 2724	2280	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d5546f4dd4bd7ee23de23bee72c49c54_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ceddc434b21ab2d8e426850c013bd20f

SHA1
2c7e514e348bed6cf155f16644bad948cf4b54af

SHA256
9ad5b7abd655623792006f8291e0b1757d3193ece01975c722c9b036667fef15

SHA512
3f75b940786d56d61c2c2d452eb11e88144d036f12e565c84bae07cd26a734d5a24c35a86642f2b5cf13bdf3f4dd47e1b99bfd92477927037d713b626907ff94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65d9476caeea79fc7e959191100ece05

SHA1
6446b57927dc828ac75ece4e5edfe968d2e9d341

SHA256
5fec38b570cc2330a65f5471b36fdd6731104ecc23449da066a5ff6b01c49faf

SHA512
38a6caae75cc689628da7118e30ac7a8b6575110ceb3ba880dd13fae51d8c8d7dae27fe8890501967895938c80d61339586ec95b9fb22da908a05bb2e4ea3d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db3c7455c3f644b3592c9c7808c2dcb3

SHA1
790da85af6f7fa1d16d46ca348679620e53aeb51

SHA256
5f7e8339d38a80169802b8b660488c361a457a075bcf2df0f26c6d356f08d4ae

SHA512
3e0b47773945ed2979a71ac657ba69bba3ff8b6ac92a7c5f8b6c4de3d5efb34c13708d905e3f6599ada3744985d1f1a46f007281421a90274a9ec762ce18148d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27e6a65ebc5ef28039069306e94edffd

SHA1
956a8588e8e71538496dceb1a53accaaa7ddffc1

SHA256
f021dc8e830c3405455c8491858804f75310fecc706130c827243626122354db

SHA512
91877161fb511a920dd38c6b699d21d3a36f043fb7df83f079a8e5a2355dd3812f5b03e36e171983f8c32a05d8727da86a2d48a3a1148f5ab1d512b5ff06f9fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0249a1e3cc8493512dbb324c749cca3

SHA1
444df2a1ce458ce79dd19b3fbe2246973598d232

SHA256
fed35a937a4aa766f13610fa6db2357222de499e2ede8d43dc6a4d4406a6f566

SHA512
9077fc53a2b881f06998737da8648eb955d0fd55b3b8b358a63bd5170f43e0501e908618fa594a25deb9bd62ef5e282b7e957dfb48b74f004f4a811aaf552f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bf5d81afc938f087ec4ef3afacf6e3d

SHA1
2167024f6d914daa1dcbd71978003313ecb394c0

SHA256
68017821846827dbb5e3470b3614ea37de9521225291f65eed71c1efbe870b8d

SHA512
01a2820308b4855b0c0a11916554b8b8d9d07a43d8c72432ebea539a901d0f31a585e766d533d1d073caa72a446c50d6383415e2d992db9f55082d36ad40e7eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
436817bea35d5e789b8e7539eb51fb10

SHA1
69cf3d6b523fc8f4e5cf0fe0c7e1597d89fa5175

SHA256
fa1fb3e8c7534dcf0fc3c119216c39406b1db55ff6ab2fc531fc56074a03bd4f

SHA512
1130d12ef5814f58fcbe16e2cef9c964af9682e0780417221946dc2166842cebefc35bfcc5d5f7282d698d3f63f21b99b28dd0eac1344f582bc5585c6e0a99dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dcb48454d9a106ddaa8b680d57afb80

SHA1
777777903f14afbe4584a49af934d0153e9e4bda

SHA256
ad045f7189a3a0c89941d3467d95bbc38c7b3b163b36e067a30150d5308c56f2

SHA512
b62930f1e8f31d7ff34b27555dc01d7346ed7d3775bb7de389842d3ed07fc726dcb3a695500ae2b03d9262a5d30281218c6f14a7132bfd4e23399face3fe264b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7551b0863e57f29a0906b1e98118a8be

SHA1
783ebcad09972237c33184520f2c3e921ebc8f23

SHA256
0efff5df49e5db9dff2153c6371648c6b6fd0580d9b9ce34fe7647834204a076

SHA512
22274523e5983e509a46db5a7d46d30570d7a57f94f099cfba8ef82ac87e6ea8fdc0986f4a46fb0ff6fda41000d3f426a65e0fc8a89768e2b1e6964e5b575e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e22b423b038e7241c232a941150ba99

SHA1
3860bca0fc766652cc5a25e6b050891e5070ffff

SHA256
234c4fcf6d474eaf4abc0b655d29fe85f79c3d95be3dfc75aad479463216ac6a

SHA512
6220fd2b07bffcf05b4a9c155e5dcf77ad1a4ea2a50668c67b5ab6c9c3a58361f87c3e656df3eb45de4e0a5993c5afad94aae0690ee67dd05dcc5eb60fb62eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5225a7189b6ca26c088dc2edcde7aab

SHA1
665f7d26d47b253eddefb063ac747868d033e87e

SHA256
6544115dd3461c31d57d9e0277627f6cc727158a9cb20c846627a7f6d60762c1

SHA512
f1a60eab5d070bf9fe03b196c20e01fbcce756f6ffe5f6777ef3b01941af974e67733de63b3df842fa7cfb6e78f02f18d21717791b14799e730debf7f5898c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ad8c944d4cd38b779d81e2b9d397d5a2

SHA1
d7ea867d5f5e9fdc8b01ad5b399bd60f2fe0ea52

SHA256
1a06e85c6dbc26adb7b4e5b9bf6fcffec89eae3cc4eb939f37762e751e0973cc

SHA512
8efb0d2b1890d25c79dc91547b8867159324229b9a8a6a5bfc0dbbd80b2015e5c718cd5d9bcf1f9d523acab3083630ba387f3409c463a12312ced0e54832e2a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC564.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC565.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit