22d7986c39ced3a9d8db6b1363dbd18f97e68c65d9b06902299551f310c508bf

Analysis

max time kernel
142s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d61f365e3ea4b3add23a533e30de5d4d_JaffaCakes118.html
Size

20KB
MD5

d61f365e3ea4b3add23a533e30de5d4d
SHA1

77477744cd683ce0db41abe8c52d98a1784ea9e6
SHA256

22d7986c39ced3a9d8db6b1363dbd18f97e68c65d9b06902299551f310c508bf
SHA512

bc14f3558330f0d0e5a98c6496fe95387cfbf24f164bec1303a3bb6e6398279b2e3762cbfcf10bfda0bb951c8cf336f8b47dfdfe4eb29709b1f2856a1b2c0ec6
SSDEEP

384:CanlVBbjPqoV+zji0Ft0LOzTQTzT+TCTGmvTG8LYqnJTydoBQUj+:nlVBbjik+zxPKPg0GmrGEJTydoeUq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000001b670dc9b0d7dc4af1705fa9d84419d3e839a7a1805ff92dad13b618ecc31a63000000000e800000000200002000000010780f5fb0a557b908e98f5149e3ed4f71557d5de62911d1f1c078d10ec7789620000000ced2027be67c8f55906f68e4df5b48c4e6be7593122be646afffea081d56d313400000006b270b0424a0bddceb7c515b462bf26bfb47cd1a87da0051b51d08f780bbbbde668828087f5d0c60d8d1ecc505a009e7fe8d210b1f83cb37e8bdb0a16d8e8edd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000008dc2c9822e78a83f17b6abe581028e8c9849cba2ffb1a9bde4a882612f2039af000000000e8000000002000020000000f7c8e76472d774c750a76184d39e902f59aa6287c5ee21eb34fbd8e203cb2ddd90000000e21ddb58ba76e707b5b6dfa34763bd4680b2493a81a6e464ea0a7bfa85a52abc7f18c272cd6b33a9327e255e3434c2d566f41863f648ac5738108b199d97294e6afa3d271029168eb63f22fd2e7a21b7e30a8a7304f256d1019a082dfb7369379a0f7fe6e3be8a5936f04f151d820f92e842505ab2678f344a0e7255b0fe9854fe9a6d7e0639040e3d91c81386ae4647400000003bb840f58e83c6dceec73b7611afdd5683d28c198b77e186ba8f76a24848d10feb775dbc1d294c944d1346d005fcc2f5f9a01a048d9e1dcb70b3f2ccb3a6c52a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7C7C7E1-6E95-11EF-999E-E67A421F41DB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432039374"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00fb249fa202db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2788	2280	iexplore.exe	31
PID 2280 wrote to memory of 2788	2280	iexplore.exe	31
PID 2280 wrote to memory of 2788	2280	iexplore.exe	31
PID 2280 wrote to memory of 2788	2280	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d61f365e3ea4b3add23a533e30de5d4d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6245e803c68c10c6dc940b8b75986cd5

SHA1
d7a5ba5f1a128f8b58f28809b539af6ace205378

SHA256
3f2d6bf418c5d8ea6ce01a103d1287c9d53526a8ac4618c1826bd6352b4270e0

SHA512
9a5f28b0c6efd7135345575e2daa7afca63b5e1492a5f3b8e6d12c198937a8b9f5134bbb3cb222dbae5a24d35151a4949d9eede961c73962a098e2ce5531fbda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0e9961550668bbd8f965830072a738c

SHA1
7f810da39e058f536993b5fc36d9506ab1942086

SHA256
0ed6c7a1c1d02d12227f387f8d3a9b116bff5ea0a64c72fd4c6711875b28203c

SHA512
d5886ffd7a3f4d1363a4518b1f297177ed704898aeb404a6e00386e1f2212d90707be9519ca2d080e6ad7f3d51b467062075c692510f3c18ef4ea25a2819c7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1d48e195a564e5531558a33b528c4da

SHA1
aad430220b864fe659c978d2aa0ac502eae2b0b6

SHA256
ab9732ff41976e302736dfaf4e55e633b7398b7d20dd8bada7df36db9c4cb02d

SHA512
affe045fe88aac826efa1f221d537a43e53a042ca2c55ff0b145a5c4704249390c23ed98721949a6a11fc674efc3b4df7d6dea3e0045bade52919ced35461442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03c12d77e94e6cc6a0c8a9658de359ed

SHA1
0048ab88ed389193a0994008ad3170b6df797c8b

SHA256
92a655e449de9140b26f5dd5a75dc12dc88a36fc32a008db6c7e9a8c2fa402e5

SHA512
0558eb0523fdb9b2151ce72538e2e06552bd5149b5caeab6dca2492beab4b7bd7ab87bb3f0b9c8c28bb05caa38e661647408c52b226ac7ed03ce3281f1ebf9a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79f0ee7892a0c91b87413eb7c51752a3

SHA1
aacea769419714bcd5dcea183468ff42dba82576

SHA256
97ca31ad6051471e13cf4e15dbb772e40dce13b385e6d44b9e8ef4000b3d1534

SHA512
d97794d457cda309ca6459f1c3861ac9b732ff95e68dc3d7379d4b595b45193eca4a53110652dac8742b8129877bac94de5f14bfe886d7cbc561fab136e43e8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff3f02cefc64256cab580df2b2b344ce

SHA1
b2cf1e34f6a04454aa7e6030c7aacffeaad16d13

SHA256
8b6341e8701ee74510205b6801b6bc2dd2d51e981ef46ada760d55051ea416c6

SHA512
11f63b4a81323eb5cbe3f3824cca6a51077166a4f187e6448eb1e2fc95e38f42b7517bc8a2ff7df34abaf866bc565a8905ddc4b67ee5ad3535943bc9fe66ae07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0b6aadf31cbf24fb2572fba4dd379f1

SHA1
80383787c664b4ce67bd4ed6b96fba33dfd570ac

SHA256
77705b849a3d6559396fa26ec0d87544640b493456f2b2c8bc64b413acd3c3e4

SHA512
ef6b49635095527ad892374020711b7d1dca054685669aaac16ff318cb6454a9ba08fc0370c7599cd6c61a245f15d82eb0f20e1ceb28bdf059992ef7718df370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18b95ec88cc0ef6e1633ecdd1867292a

SHA1
54be764b14263f94a33a62251a47ce44db9677f1

SHA256
9a2d5c3b0d2b0dc6db76b9d7a3179873f5afd7cb8c7c2c117ba58c1ee151802e

SHA512
44ce809586e749d4f7132df1a810ea8ca8df9077fe53be6dbe168a9b319ec2b782d6b66f06fe50698d317fb75426bb4cf3f1fec39e8b0cf162409165ec29b027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d1720eece8a55a0f84330a979296f1b

SHA1
5789ec360337bf202e645464fb8ef39e1aa98a8f

SHA256
f4463c283ae6e7825cfb75d34ae24606e8c7ee164244aa7bab91782c91264570

SHA512
1bf16d7c166850006cb136d0c6ac6b178ec11cd70626776d872e1439ab86b09ce900cedcd6a1491a79d42a01d22485c1e2a50741321641bee5889e5b2e299eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9211ca54222f44478f0c9ef451f08347

SHA1
a3ed04731c98de0fec4f8468101acb7e3b500d5e

SHA256
958baaae3697af57f1f2fb5ec34eaa08503d8c6eab6da50dd8b5663c944a7f9a

SHA512
11ea7e244f18f0a33f9eed1a8ea9078dc80f901f9f3f0fdbf59407135d2c552130335ea2bb0ffa8890ec20a0aaff07c8af3f238c5780a598f8451c7dec1ec511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f6de9548a9efa6d677fa77e098c3bbd

SHA1
60c17af9ae745860c3c1a0cb7107bb1e5353b3e6

SHA256
77724ae3935e2edcaa609abc74306f2934a864b1298b374d662af2aae95506f1

SHA512
e7c58a9a466432315bbc78f68c7ca376903b0718535805e36a8f6e915981a1046ca4cb4b479bbfd85d82c5d2dad25a5114a6f7c22bac8cd9d97d97c5edbb0e38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b13dc804a679a245f2724a23007a69f1

SHA1
c176221e5d5eb21e3f5b0c09f4d6698a49fbf486

SHA256
7dced8332f455a2cf339248419d22d9f127afab52f0b806cbc3b6bbb49569726

SHA512
3acc04bf34d26f43e52ec88ca14f2f5a7771ceb95aed2a78e31b817db2208ee49db380d0d495c38e4098b8f0554db3ddd850addc88d86b0b3a7f8914839a9ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC13.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF12.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit