5f240ac3273690cf41b41e68e7e3f080979b83f43a605f6503b058d0a207b038

Analysis

max time kernel
132s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9c0d5dbf18b899f81446977b9baf74b_JaffaCakes118.html
Size

82KB
MD5

d9c0d5dbf18b899f81446977b9baf74b
SHA1

b9bf5336f08589ff693e441297ab5072719bada2
SHA256

5f240ac3273690cf41b41e68e7e3f080979b83f43a605f6503b058d0a207b038
SHA512

166fc981f8a4f32b4a0efcf40723fabc643a83f862dbff2ab4d5034eda9f7482ee5851451d31660fcd824db972d2ef7cc0c1018a9ec395c6a1a7d50853c19ad8
SSDEEP

1536:epPMlbN6FJbTM7NbUfxt3lSWE5/ezOlSYqKyM4WvsUWZkojNqZnR0pD:epPMlbN+bTM7NbUJBE5/ezOlSs0UC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432196611"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "14"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0F89131-7003-11EF-948A-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "14"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\stripe.network\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\m.stripe.network\ = "14"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2056	1964	iexplore.exe	30
PID 1964 wrote to memory of 2056	1964	iexplore.exe	30
PID 1964 wrote to memory of 2056	1964	iexplore.exe	30
PID 1964 wrote to memory of 2056	1964	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d9c0d5dbf18b899f81446977b9baf74b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1678203b51beb5d7ae534729eb72669d

SHA1
6b593ece0332082b1a84c673d0499448132e9520

SHA256
6ea6a5f1ffbde1d4245dde6827fb5d68b397485c3101ed192b087266ddfa85d3

SHA512
1476334f7283073458d974d7e3fc11e803e265ef03476b2a1938cfd6b8985a9c0c7833f75ef02538a3d4185fb19bc83a55e52313b4369a0ca66275d58bbb2890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a41cc599a4416f3eb46e505bf1ece570

SHA1
13a9e8c31d9fe38cf37c6825450adbcf18113e53

SHA256
69098e78a9151c521fcfb6f1a6c84930875694f4b564b6ce000de09f0f33fe8e

SHA512
74006d13fffd25aa7cb7ce079f30248f86991921a92afc7f433cd5dee60077eb1d9f33290f444c1629e1d43985d4c30cddab2f2978a6b420925db82526ea84a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a11cd20428593462c3c82c09ca5f638

SHA1
fbb1db678aa006741d874d26c3359a0fdbf53646

SHA256
052d27e3b9fb67ca5856adacb2e037b99d0952ac31db50334894529b4f3caf0f

SHA512
edb488fe06f432d09d822d58cec124a9388b3cba3adbdb5e26642045f868db7431a22ef55fef020cd94400ec8b9e29c5c6661e0c6f648601737b474de73e8411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ac0ea3c235ad9a13cf514470073fc46

SHA1
af0e1a646fc70efa2cfc5e58059f0196daf57480

SHA256
3629d3fda5b7f90f37e15a7ad0c324852bd718dbaa0ea651994e2aeeb116ca50

SHA512
b87b507efd3ad4a82fad91a7f8addc3dda614a2ee5fdf8328a9695b4afcb30dfb3c8cc573a37bf1b27ee9c839cdfb82126ba37f905ed49f0e42e85cb2110dd7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
118881cb030e66799fe1c2f4f258f85d

SHA1
1b4cdb293ef25bc07af555602fece9298d7aec6b

SHA256
56e7fddeb24e9a04c5dec77be2018d69e162c8482e05c88d5ef5c661c803ec76

SHA512
a49d9640d0f8e78ec370f244cc3b59adb119d1898102a4c41cacc7091231c984f3412370d617e2985b0144eebb9f4e005995e47a0b3625d9e3ae97b91280391e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe71d5d154f3293138ab983db3f8d3e1

SHA1
7e17675fce2f531517ee673339997519595afb80

SHA256
62848464be5eee6d14d6da48dff5a31cf92558b7d61338a56a70abe290187d9d

SHA512
b0266e458d7c01534a124bd826deea77b2c8a73c97d84b3710d5e83c5e00a8a65fe6a49f913d922bec38716331ca10740d68d79c0a4e1cb4a8c1c645f99b3108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c695f38357bfb97192139212071f92ae

SHA1
6100dcd8fe9f3fce28437ea6ae7500b9b38141eb

SHA256
07165d3754a1a11914f713eeb11e8f435390e6401ee2914c9d89f3bd641a1a3c

SHA512
bfb0b53baea1194b46e1d4681d9645c47707a7f9c9a68bcffc8b6599fbbdfdc590e5037817d1c70b274eed080266285fe171bd64f7129da6d077a3fe096d8a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25afa199c125ef80f719b92082298a28

SHA1
431708c3e55fe1db51365a4b5f26e098c95191b3

SHA256
5d09a5505564b814c28c49fa486efa7beccbf2ef6f52b01706b89dc9d38aeee7

SHA512
e04e01b3805ecd4080667c52b5833788fda81ba1eeff64a2c8cf6f4472a71953c7afd999cad98fd44bcdbdaa842222fd2e3187c252500888394a3f31087692f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
054c1b42bbfde94155418704465d0105

SHA1
63770d2f5651a7fb38ceb29011a9e804f170627a

SHA256
019b68b1e569c49cae2e154df5f358442fca9284980ed58bc970d1ee61fdce52

SHA512
45fdf9dde3592b83822c9b08f413b61c0e22577eccda40b51b62d8bb3c2afe79986a49b5af24bf839f0727fead74f006ed2fd6f6d22a9d4a12b4f0982c217b61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d07fdecea436bfc8e0a0e659807c443

SHA1
e46f4f82fd1b578cb0cab7292cf9f82b2f2cb234

SHA256
84ac42fa0f3f46916d9298d0d807eb6425294f33f7953a4d1c7be62f496ff970

SHA512
147a78873ecae00b536598a704200adb9886c5094a4900f2bfd71b8c77a2cd6997d10f74a3ccdf1e8ba4970a8822d0b1cd8b96cb0b5ff2aa70e2c1fb8bd8a8f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7acc287d4a6b103f1858f8a33d4eeea0

SHA1
c4c03f8d30fd81a86febd1cc7cf6b79bc76d83b9

SHA256
79028c4eeeeaaf06cdacf5de338fe6591aa3ea6bb649479f2610b8ecd4eacbe2

SHA512
28df7a9c00adb23ccbca6f586e0524819fc05fe1d9c9b30a05f4db44dcdad98d5ecba340d158bb9a10a6b36ebb2aec3524e7703645bedcc6c29bd65549e21cf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9db83e2d1ca560b45f745a2ab3d9aa7a

SHA1
ee95f3e7eab54d32c0867320d5aea633924da4ef

SHA256
7ccfcfa0324d0a4c399771fccd35334648c8e33ed8924e3b4a9bf0607f7d4ab2

SHA512
5af96fc18eaf1096c1aef69bd8405b6d29c3d2fc6c2354d970c858ed2400f8d5f71480741cd8e20ef60732db8396a1c9c2efd7f853bb51ab4d8b259e6f0e2261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\78EZXV7L\m.stripe[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E9B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F1B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit