784cffed66ef74cca8fd081a09ee9d2014bf037a93d4d0c6a6bd5d0205915478

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6e393c0b89f73fb4222418c32d8765d_JaffaCakes118.html
Size

467KB
MD5

d6e393c0b89f73fb4222418c32d8765d
SHA1

ebd5fa621fb342e1bc90f9aa8b0a90ec185dc585
SHA256

784cffed66ef74cca8fd081a09ee9d2014bf037a93d4d0c6a6bd5d0205915478
SHA512

84855934f4606478eff96f2a4a76ae0be7fe8fe814dd35535c02f4f2696380559aa29e332b2527fa691179842c431e7df2bdbdb5cb41e818cb9566ddfa0cbcfc
SSDEEP

6144:SxsMYod+X3oI+Y6tvu6xAmzM86P5sZpMFzBtug4r1GcFBU/b:A5d+X3poCPuzmrugwG2qz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000005c18242f674d13003e3b9fe2046cffdb284540b94974e3c0d70dc20ae9e2959e000000000e800000000200002000000029fce86c050d1997de76e795324867adfa5f2397243fd11ec4aa862b7c26f4c590000000279d6b33662ca91f72877f0063fbbff8ea38d9d659caf1e204b59cdb2ecc8008811669109fa23d8f09b61c1aba2b1c0555592f99aecc5ec3c0977ca420b01a2faece885dda816cca780dce1e2e29f18b7b1ecddb5260091bd28428a3a6f74c45bbacc3f876f48012141e09aa2e4a7ccfcda85c196a93adaaec7f3ef07c33d2f23df9db26795c4a852212460c0bbc7adf40000000ec50028bc12f9bb5ce15ce243f71d313780841ca89d90f5133efa32c0ed462dcfae7ac1bdc6dc80e51fbd7a83bb7c22a5001acd5bdcdb6687a50bc3c7d9b4114	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c393cfe702db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000086d479c872681e71eb3f3022dbe7a91dddc3dd2e350b0af4f757e714439edfd3000000000e8000000002000020000000e7ae91c38b2b1a2b47d8db54a58c97a97c42ace9e96eec60c19695c64f87db4520000000f54319222444881a63458488faae289837be7f532f75bcb1ef906be44d27a74a400000003e09d41ee91dcc62ed0b5a950cbb5a50b8066aa6f9ac9e96c66cdb6063bc93d677790c7d6c4c506220cde023d1b39da70b237404499c8f78e4f3fdbcd305f741	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432069094"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAE64E91-6EDA-11EF-B984-5A85C185DB3E} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
536	IEXPLORE.EXE
536	IEXPLORE.EXE
536	IEXPLORE.EXE
536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 536	2204	iexplore.exe	30
PID 2204 wrote to memory of 536	2204	iexplore.exe	30
PID 2204 wrote to memory of 536	2204	iexplore.exe	30
PID 2204 wrote to memory of 536	2204	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6e393c0b89f73fb4222418c32d8765d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85210947f424c5bb427d295ee0a150ce

SHA1
1f0db20cc008ec84986260969fdb07355e66abf6

SHA256
30a561f1cba397024bd397d0d3bcb82728746ce9509246ef82fac807d25113e7

SHA512
1596172b8aa44eecd4033b3c2a811eb35cc0bbb9b2f8d2f4cc1ac58f7f467aa37a86235ca7903f21341f4c59349c62a7696fcf6f63d070f195df88fbb79fe73b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfd5c73c23b9286e62c41fab86d3a2f5

SHA1
9596129156b49c2bb439336937696a872b9a5aec

SHA256
d6378fa65fd562db5b66658762d1a3f2a1a058abf004b1d5c542d57113ebccc5

SHA512
a921ce8bb3834e9bda86ddc8f72f6b65679cd8ed5484a3e78e6eba7c52b4aad5f9a5f8bf9b5f95a70c6405adce689768785f7f80aff7e68c6c0c357abda44c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ea9e2eedc6dab35b399a356e479d14a

SHA1
5cfaf6349a622adbe1f139f2b6c54dc1def160cb

SHA256
9eaf0d281e786f7056a0ab781fd2e691c17c43f882254b35dfdbe5152e9d6b58

SHA512
abf63000332d6c5b6058aa3793206994ed0df3e6482e81a5bc98d7336728799e1dc92556ff30e78a7ad0d01b99545c6270a1535873e0d9243ff4ff9d6f4c12c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
765e05aa0d102894b5f1a9931f8f8b3e

SHA1
b28c0119925c8e2ffb88068baaab881aab5884b2

SHA256
1833d36c6ea5f5d0176cc049cf8555878ddf48f662110cbbe707a557fa8e9d00

SHA512
23cd343ecedd02b4232f79368b21274339ec0b53874e2a68b0eb79cbf8d0eff9daa1707374e6fa806362d2da6a21d68d79006747f5470a017f73c38f5e81371f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
492126f0ed36d803a5490fcdedeb1f82

SHA1
2a7c874b64a58d94747dc7777fda471da0397ec8

SHA256
01acd8213196efbb23f4a00c62625bc6363805fc4a12db814719f2bc21506c19

SHA512
60d528285c9d871294173eae37a96166d79fa4e7471c68dc7f5798658777facec21050905d2a5808b05a686375a14e245d9f06dd875fed52dbf35d205e692675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c058e644cb057bb6e4be11df55974c6f

SHA1
599626b090f8068702bcf6fdfbda4b55e2fdf834

SHA256
63c7f5bf6539a3ab5fc8b00fec12444fd3d8dd957098d2ec4ffd2af96a2a82eb

SHA512
c68f805fe6f5a1002cc8cf3d9d71968d2adbfd08858efcc67ab2f87abe5fc74884b4d9c3c7e556e34d137d915c5fd37f844cf957a025bf976b1b78e7ab240942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab266f8defb064e62383ae78a49d4bb3

SHA1
3f752f83038cf57a3cc72c820b84f52d39200317

SHA256
cd85afa170c6bcc415514fe05712124b0c6b573dc9726ca47c34bacd7f98dfcf

SHA512
215d2d4ba80230a5a4131e97b945c409c10a5f4264921efa07f2c9e52480ab55bf4243da03c860ac7b3a60dc91f7f90f31436e78de61ea9e7d4b7850fd8033d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13bccffda2e806afe85b92e01e7cd716

SHA1
4d0e832e94aafb921ed5deb4e954a9ccee8232eb

SHA256
42a5c10da24fcf0695452ca7c63ef2dda6642f39a23d389f7d8bea41dae10137

SHA512
68df0b58cd681faa59f9dadb9e03743397826baa334ce5184069ee643a3a370f9621d7910f5e8796691f9bf1708259a8750849ff4dbaab711a46906000bcc88e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
663c7c88855da53e9c9ebf594e482386

SHA1
131821ba163089dee8f14547ee9af71ddcd07126

SHA256
f409c12b14aea25588a758b7b2669cf416f78d3ca24a0ff7539b47a38a02a7d6

SHA512
ce0b1d7b60368485de5f9588f42e83dc276f5f16e8f1c08e87cab7f3d4f97d503c29fd50ef4b1e79af14380c88d96d04d47d6cff8eee1fd8c1e23649f95590be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
144685aef3bd36a4836306d89765c88f

SHA1
dfd36288443cd6e3ebdfd19d64dd1e703e714bcf

SHA256
9dc1f151fd5ad4f94721fad7dbd615147b7a47f625cc1cb89289564566685884

SHA512
3abc5f77a309b7d9ee84f866f0f6f5268d9d54d8248d106596cb9da19f2845dcef552f15dd9c298fea45cd159e905136ea30ec3cfe7f0f216f2c8475b5a47736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92e3078abe0499bfcd3758ddb89d129b

SHA1
593cd6d671a36fe17efe7665a4f097231d9f0f37

SHA256
a8712f7c90f32db0f1d5f051b52d094c674a801b336c6aff4cf8a740909a1630

SHA512
150873d2726a3a2c08c34abe7dd7a04b680578237e6fcf42e59948f5d2b596b8fecc2e8efec67f6fac921d88ea46ad8ab54f8c70fa703bef2e1e6d28e50f0a38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fd067328418c7f3df2d83f2da0325a5

SHA1
e52a35474fb6cce96756f7a8aa7d2915d84c3ef1

SHA256
ef7e89ec6a6e41c2d82b5538a590bd4c3466cce2c60cb27e5108cd2706f9e548

SHA512
ecba63923cabd6df646d077fb990d22511c2f245173e2cf5139b3a11f4bf195e10ff01deb1f6e8f94cb5bf49bd60d00b942bf5d548f679908e0e3e48b2be0c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b3138b9649d88ebc9c279d77a427b51

SHA1
1b4864aa43e002585a385e1ce053cc8c13a2a6ff

SHA256
b4cc21ff56bfb2642cb1de9218b47c65b7f18c27cce4d3421808f832902cf172

SHA512
079cabd4e1507f246812e6b9aef4a81e4a5eb0e801a7c3bd458f2f63d7e5be3a37a72d65695f6453ed8bd6c3e22a96ada7fc3b168d42a29e30a69d2ca1154141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad53a1620988e787a1483cfca2810df3

SHA1
7f773c13269d43234dfcbcbde7d78f8a780f3944

SHA256
5525146bfc0fbdfc88c838579e1bfd526489546b9d29191b5283c0779ca3da60

SHA512
6ad930b8c4f68764678a3561863f2ec17a2b0c4ad136af1e6d5ad699f64edf35883c18cf9c7ae2d1f4ef39792d4f539244a4190ca839f6218f0f50669b3b6a61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7208aed6eb1271e46caaa822108a8075

SHA1
4b126fffb33ce8a0de37536b8221ea669f5a482f

SHA256
7d59956f026d980d3d36c0d58abf7d76bc0f67d61bdba6a1a03506a1447977d6

SHA512
76ec0a3b6cc7db96cbf9a91b182d072ad2aa4f860607f7d2b2c279580d04e40825db10f97513f5139272e9c3b1c34e9ecf6eadfa2b3cdd74d5334890d7073eae

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA04.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED04.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit