a5850ed60e0bbce596f744b6b85e5770e53edf74c3447950d01558386b4f0b44

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff50ccdcbb39550afd470b75e3d61d72_JaffaCakes118.html
Size

262KB
MD5

ff50ccdcbb39550afd470b75e3d61d72
SHA1

c7e46e10e015061f4bb28d295a6b784093b65e25
SHA256

a5850ed60e0bbce596f744b6b85e5770e53edf74c3447950d01558386b4f0b44
SHA512

321dd9f3e43eecd4ade5e9dcf821d54eb80996069f5c499ac684468df842be659b6d16b0b3852fa704fe79f71529bb9a106951cefcc40f23de4c94f56b2382b9
SSDEEP

3072:rml2teniThEN82Y0zS0HdD0bUwHmE4U+ptgD:rmi8iThEN82wD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FD61B01-7EA4-11EF-9BF6-6AE4CEDF004B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433804967"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1868	iexplore.exe
1868	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2372	1868	iexplore.exe	30
PID 1868 wrote to memory of 2372	1868	iexplore.exe	30
PID 1868 wrote to memory of 2372	1868	iexplore.exe	30
PID 1868 wrote to memory of 2372	1868	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff50ccdcbb39550afd470b75e3d61d72_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0088e68436129191ed8a90ee4de327f8

SHA1
0d6b7d7a2d331a905dfec5062cd5a9db187c80a4

SHA256
9948a34e7b908ab090d34232880edec3c725c4314a20b1120c34cc31a2d66abf

SHA512
21ec77430f290aece3cd537519610e87f45a1d24a34e7cb03cacc42920149333b84c1ae46ca1430d938060e7fbc830f46839e1de25a7778c357eb88da6404dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
187d78b6896a5ac9f6f5b1126e93f35e

SHA1
9058153010725729705054a5333c458b964f257a

SHA256
04073589412663c94bf646e257355b54ade1b949802bbc6ac0534e12c39a9326

SHA512
e1b76a8a4474a93e20986c4b55a1acc3cf67a219f683f75750435f98665558856dc68549b5725790840c7e67aa191b867649b090c136e81253f93e9eb6c7b3f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fa9726af3d68ed5214de08d7b20c87e

SHA1
f572264113c643bb8dba2fe086f4e95641fcb27b

SHA256
6a9d4d5bd264ec810771a1d9c1fbbf17a172ec9606ec328fc5a6f583cd978b6c

SHA512
dda9acb003fee05d26cb12896c57d556f59f9b5a8e5f83b390252159d0ed208b1dba9b35bce594428736b7626b8454794e524584f4606273838fa49240f527ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5593deb22b2b0880c72bbf43decd8f68

SHA1
1b43038763c2cdf6a844af37dc1e7dafe2ac1b78

SHA256
7e920d78b87849bbc33c0cc350ae36823a124eb7aac1c35cff67ec396635a76a

SHA512
7565cec507b3c4bf2873a7b0a57319716e1ee3f5f3be5a182405825357cd280fa2bf1ba98cdc26304f54a1d5e8e0520735a940a45278f7b30411c44742eb9aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aeff3dcc0c6f001cf3da8a59a45806f

SHA1
036355d489b896e3b417dba9fbc9264260205ac1

SHA256
f7c4b7fdac46ab9890298fccf256246fc8676f156ca74b39c7395fec4fc36bcb

SHA512
88b55eaed16cb64f69d429b82591d7c9adab91e15ed7e411441cf3359005bc3a9c1ee9c6d3400cfa5fdbf5befbc9d7f1038eae5172862a43fd0d0c3272e02cf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80f8472d45b8c49f4fb9a563912f4b46

SHA1
365f087c7c14855719ef0891cea5fc6a0b4013c2

SHA256
209e96a79df777163c81df56c57252a9b28b2bfb5fdb926eb41d8393c228e461

SHA512
c5b52438f135ab523ed2b613a17be1a6b07aab76c236fd9b088515dd07781fd54b68e2d8f8603b45eee65cd1526dec553dc398854e507e41f2de81eab00a6ecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c32aa44dc778c8e11344174cbccddec6

SHA1
58fc9631f504df13182e7fe6ff71bb1a500b2d2c

SHA256
79917548cadf6a98b2bdc129583193b8c302f33da9fb8a89c4d3d1b267193028

SHA512
d866d693f16e04e6a12f9922936f090834624d8641dd6b226ae17c59783b837bc9614d8ef5b564abda90279676b9886f8d62cc44bcd022675f77489f98bef741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
165d978b1dc9494e31f925b1ca75440a

SHA1
bb462280779345939500c5c2f4ffbd559e71b820

SHA256
c1b51241b2b4d66f1aac5f548d993033d6b1b63e9af44092bf5e10381d6dcf45

SHA512
9109507bd75c8e8c3b81ee7531005eebec0881782860c803195749caaa4acd37539b3e809abe88d60fb0e591eeb9fe77d59989e926e579f826d9d23a8fc85caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b940bb3afaef1f19a3dbb2ab85c593bc

SHA1
667f210bff1b39b76a35c8e033f4ea9d66f6f6d2

SHA256
8402e006cb21db9fe694fd7bceb8b72c1316840d7e3d917c9d512776f26ad23b

SHA512
550e8f09f912429fcbb5450088e44b8ed8acbf047593fc909fd1852ebb130463eaf9af483b1da5d2bdaa939857c41c03b920346675ee929f46597df1d5d51cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a799111eb3e1200c0e64e26935aeb4a

SHA1
45c0cbf9e592d0c5fbcfcfc86e838b9c1a1cfd32

SHA256
26e9104f34135ad62a521c9bf52e3dc6cb8a5a91d9fc706fb6b78a604fa200a1

SHA512
9cafed7fbc5960124e93d932a615dd1a100e6ac9db1c825e19e14150c2b4d6ceb12709eaf39a471c09121f21da24ed1a4dba116768477a37cabc19a1695fcc26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6d247de49958b4ce5d64cfce4a6d21cc

SHA1
767e0db7c63c2610105a6337ed88e570930c13a2

SHA256
25151c4da8c88358c8b2bb6f5a29d24fdc876896965c42efc89ca460c43707cf

SHA512
1f9c95a99842510fda31830e0125be388af2cecffc57c98f0b29f928038d2a4b39363f5471700f124a5aeacd399fd4cbb10ba934a291e25e634dffba5be5b18e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit