110e31d0bea1b581f0207a444a3d97fc39de54f23480d10f491aae824da64933

Analysis

max time kernel
143s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff77d562621af0d48a3c2653ba08a3d3_JaffaCakes118.html
Size

138KB
MD5

ff77d562621af0d48a3c2653ba08a3d3
SHA1

14a988485041aa7c33c8543529042741ec55a42b
SHA256

110e31d0bea1b581f0207a444a3d97fc39de54f23480d10f491aae824da64933
SHA512

747d96be54ffc1a5372333a62c5585109386cd38a444f9092adba49b4b84627ebf113c0407d7f71a7e10bd50de783b1398e859bd24d6e4bee91b4c15897fca97
SSDEEP

1536:S5/FOxjqlJmiXyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:S5stiXyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000001e474a081d3a3c3dc9021b078ad58447b67824a2a4e93a5b6cb601daf536c40f000000000e800000000200002000000058417f4f662f7238bacc7ecd50349e2258ed947f980cc64857236ac68402a56b20000000d88f3883fbf1d03cd0b8b16f517ff0149a3426dea35e50b25d2ebe7c329699fb40000000e966117efc4094ebb4fc15a3b8e782b90f737a77894c46e962673be6cdd5c552b575ff600d29fa0b1527e3d48770909e9f893a0a31725a1866b4b693147e5df4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48489FC1-7EB8-11EF-ABA3-46BBF83CD43C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433813409"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0fdfd5fc512db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000eee7a2809e872f276119238cfedc2fda7faa181497fff5ee0eb0486042580196000000000e80000000020000200000006c35f21475bf703510537394f8078907367765dae86028a65ddc0396e930ca1c900000007f59235fc41773c25e6c2977be87061746ba723215b29ef9300a5aa8a724e66212a6925e1acefad6ef92583dcd8d6f871c194d2650cb8c61f3dd3582793a5c8a54505aaa133ab8d4a776e7be137c98a894d617c3b37e9dbbc81f283f674ad5544dbb8b7d5e1e8641253589f101fc1f698f9867361642b49a0ea6e75c2833ff645b2021daec47a92c6af7481fe661e7a840000000cb933e09b148a7cd4d62a60fd1953c3faa6df5686d2aae403563fec346020e2c290fc0fa3e00923c09bebf18c127234b4f8e866dc4493d2465dd83dfdb4b66d9	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3068	2376	iexplore.exe	31
PID 2376 wrote to memory of 3068	2376	iexplore.exe	31
PID 2376 wrote to memory of 3068	2376	iexplore.exe	31
PID 2376 wrote to memory of 3068	2376	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff77d562621af0d48a3c2653ba08a3d3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e63655ee8c331a309070bbcaa6f23598

SHA1
c2b62a3098486a83e2bf8f8fe5443e3cf6c16327

SHA256
2d0f59bc5ebe07e8ea367e7047fa937f086ebc30655221b1139277a04198555d

SHA512
29b68d815dbdb7e4fbe3825af27eedd759319b3dc73c7e0c935350f03d2dd6022216f21ef9b4718f6a1c3a16b60b251415083b60bd1a04cc67bfc9685082632f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eb48b8ad480d5c82b3506bdbe88d07a

SHA1
5bc85cdc93afbe4e19681e8abc8d9fbfb48992aa

SHA256
0f78f77f029f223fe291607fecba84addf90c2e3de564e8a534079b322f08e67

SHA512
e9950d9bb6e17b42a6019ee72aea4d7c41b4b9a92fbefea77b629fe5886455a0e3f7334ce8764563ca9793ee82fe878678417266c592e27a039a4420470b7754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53ac92d5e471c30ef184ce553203cc34

SHA1
d2a0bb0b637bfac94ab82d2d68073391bf9df465

SHA256
89f8f68c9728ee8e9992cdef0ed1e0b480bfb0f857f6ab1df59ee1ee1eeb2a0f

SHA512
de3b7d56c47e2f42873b44da70f20f0e8883b1e40a6fcd8ee11075ad5f12796788c9f7b63190c89a3b9a698e929e111a0cc2ea69d5c3792c148b53e1c5819666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f6e1fe930acb362031ea794e1b55aaa

SHA1
2f5cd64bc2e2b7a372761eaeeca2bf769614bafd

SHA256
63bf96e326f6cccabb91d19b725d62177ff8542d2b3cbb8866a10318b9454457

SHA512
4797e8de8c17a69daeb9c71058ea06b49ff86c8e7a57b916c7219f4b64aa662f1eb6bcfb2530f5c892822289f4dec59b2b358884fe81fa0442da4089fd5378c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
453391f6a1a4fd14c7354f2c62edda7d

SHA1
0e4c4d82eee26e5a72c61cb8d0e8c92e593afdf6

SHA256
07fc8a9eb0d094026b6b49e85bd79b47af28fcc26ff510050272cf5e7b739c3a

SHA512
76d4d7d86d73769e041fed748fb959670aa381756b385dfbdb0285aa7f0d8bd6dbd983505d476cb9959ee89ed428ad04068a8c7eb384094e96b5f11822c4da22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b440ff107a5913553722495037767e6d

SHA1
7e4e8dcc4f2411cb6dcfec1e28af88586fa93df1

SHA256
c176f16de5c1bd0af3fa3b0810aefe9cfc6135493a254c9b4b70d5835abcc9e3

SHA512
3a4f0758763dd6eede5dfcf97bf8d51be2dddbec3cc1bc6b9bf946323f6431bc22aad7aca43cf7b08c78cdb58068dc49ae08e7e6f921c819bff923f6ca22bb0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcc4b4cd55adc6d781511b395d1fcb3f

SHA1
b8b1090318c96a240473c823b7cd34535a2b1eb1

SHA256
93a5417b194c7647d21441e4eaa723b56d7bc95f6d87ebd92bf84a5aacf45052

SHA512
ca944dcf4043fcaaa45a3fa3d79fb609eeef2a2e434a16635481b6b140d37a46084d9a5213833562b7dabfc274aa2012531176096c3a9325515af56f7df8d917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
434c64c8770c4d3ef45cc7bc7c5647fb

SHA1
80d6205b8279f654bc7923d0e0705ab770be9aa2

SHA256
01f67f98cc0084d1ad7cc049fb856cbd54ab2e49bc2995a6b46bf0faee148340

SHA512
c41583998af1a73e36eed9b399cfb6d834e389a5a7c641b36c8a6ff4c47777c66ac87ff6571a558923a85070cbe7ab6b622159f8dd2fbc6f71d74f3da1a05346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d838a0fc1b901171e567281692e7f21

SHA1
5ca228d1469da306dbc085f861c1eb398289d0ea

SHA256
97b620528403336d65cad75bb6177ff386d26be52f619f025b0a15608ca1e571

SHA512
bbd95290ff9402d42f81c0abe7283102b5389d0b132db1dc29a782acb473874e89cd5947f1293508ee44f2667a8418db6345e8450868e10d76063495ca23f8d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb5cd3942a7937f2e5317a66858162ac

SHA1
60f260e2f8446c94a354a5406e3e1718d078e363

SHA256
04f5f80f4811ab79aeda8708ca7bbdca5d63bf22204474e893d2ab6cab51d527

SHA512
fdd5667b639af976aa9741788f85c5716b553110e1333b7ee53e5a3578c38058cb03670a34968e03cf43cff0e5e2df8cd6b782b52782933746ca08150d02ef56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5630788bc379a60b07ddea75802bdd85

SHA1
06ea992db32bcbf9627eda8a750cffdb70f59387

SHA256
9b692420de35dae1b0bcc13196ef988db99cbc32eb682a3c1805507da8047406

SHA512
a64b7b26e2710527a4b6517dd14be74816fa33fd51ebaf3cc8388782f8362786e08e61d67b8547e83520906eb4044413a21140e55e8b51abc1ef2d6a02e82576

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD412.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD483.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit