10830c1adddb475bc2856051dd1038b2fc74ec86b4fd731ea0592bcb52ab5483

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09745e1254bf4e539440f9b344b8628d_JaffaCakes118.html
Size

18KB
MD5

09745e1254bf4e539440f9b344b8628d
SHA1

408f0afde9af4ff9deb6aa056339a573ef4f5e14
SHA256

10830c1adddb475bc2856051dd1038b2fc74ec86b4fd731ea0592bcb52ab5483
SHA512

787c40466b531545c05ace606f189c495ed86b51f2bab26c654970cd10aed9e8e80387ca16661942e01166c9999c70df71bbf1fc161bd8f1bb819fa5e659e609
SSDEEP

384:K+AKZUZ2XfT0/eUthSo3S0OaTql23Or7PTfKXek+eJNkHmN1v+:gKCw02khRmkl6HmN1v+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000a815edda2b1b755a7802709d5870653cb23ba36b7d102bd67066d2580a698c45000000000e80000000020000200000007ae21da3eb20a89b4e8cc711fb243b387f82474a62253074d7ac47df25382312900000007d92a3ff69a596017b11103c077ce5a301a165c1a37d72fb4ec40bc20917d6c1295ffb5967810f430aeee9eb196789bb05b5a56ae23700a07d880867b582e44e0e0930b8a345a073b84e68e337e7a421f4280e7da2a7148e2f3ef70d9710e971e9e86c5cb724d4d2dc93cf99834b346e1d3ceb737f2783d82a8814845374c8b56284fb8ec58adfadb0f078d3065c3ce640000000f0ff6f14bc4f947c830e9c01c6935efe8870e50a396e2bf3b87f9bb483bbd0695274cd7e8e6dcbd2339e6d14aa8f8e3838027e1a3169b793c0e1047901e956e3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000fd190742f70b7fdaa36bdfad703b831b3ad1093f2c7f28db1373812c74d30317000000000e8000000002000020000000b28fd44ccc35d2a552e5799b905a82e18babf1ca569f6fda97b1ae09a61a51982000000082226f70779b7e6ea4918143577621ee0317d3b266a60e757d7898916b1f2d3b4000000004365be3e863e6d5cdae9be15e0b4efe08ff155fb5e05d527300cfb4afe0d4a11940c4593681ff0807c6f102a8be9e49c6982ae03dac246924e12c8033080080	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434014462"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b030c33f9914db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62CF8271-808C-11EF-A0E3-4E0B11BE40FD} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2692	iexplore.exe
2692	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2668	2692	iexplore.exe	30
PID 2692 wrote to memory of 2668	2692	iexplore.exe	30
PID 2692 wrote to memory of 2668	2692	iexplore.exe	30
PID 2692 wrote to memory of 2668	2692	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09745e1254bf4e539440f9b344b8628d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c6a425e89e45b3bf7b98995a03bdec7

SHA1
9e3ff665328e8988131f702363df260bf2261a86

SHA256
296a34bde91910f0839579a797439a1814c08a96333231db76b068334fee5467

SHA512
bd1b9c80d672754b5960c783d4acea73a17fb4153942063354d42a02866ad954446f595d2432c90e13ccdaed649874f1377436d708486daddb93133a3f5d3270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d963be2c6e5bd0cbb50e4b8ef9d0eb56

SHA1
41b80843cecba6bccf7b0d398a049aef81ce55c6

SHA256
cf2172c8b1d1977be37a124ffaa660425a19a0026438a2f4c0b82d3dda3f2f1f

SHA512
1966cfce7c7e0c88b896f7803d2310d782e3eca13f6e25a5cb0401aeed166055e99b1d4954d1789b77164c8f4abb5fea516b3d72e75f2f7baa72b568d50e29d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c785f7c43a1238f88b81af726da564b

SHA1
2b8f0c96430c7192be2eeab23a2a967d52450084

SHA256
f5a4829ce5598a3999943b9d2fe3d5813409849f62d7bb206f9d530b2e6135f2

SHA512
0a611088d738eedde3d098aec3d1e1079ec5a5430580c8fecca3c7258a1764a908ce26c70575019bbffc02309497a1908038099aa3d4914bfaadefad84adc116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4851055c66beac221369bc0a431f936a

SHA1
ef4b9f383980aaccbde143e07032d6eee836968c

SHA256
3f3533fe939836effbb48b69834041f5a7afdec17fd0f94a3a8512fffb194b64

SHA512
b49a24a72bac45930a2810f941230ae12bf990a630fa9fc5585d7443583cfcbac7e8290aa0b50f058a26b62972dd3bf8b85502f2a009f415dcbbdd4e5762e3ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e875a223514a32cc7b7f5c9d3b545a8

SHA1
db7baae012736cead288023ec39f841d2cf87b95

SHA256
e981b7c420b5184f52cbfb21e5ebeab75e0f31d62c3637f977b6ef4b673ac839

SHA512
50a4d04feac582f2a606b6fc74b002f4275c31e3e8a92177aa0a432e4d07709936a309217850e59e83b77c7598bce7544cde20e5ca2bb9b2145ed0badc9d3491

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72a56cac818dc3560ad0fa447be43b6a

SHA1
cc020f80a014118662f5e1de60bd6870e173fd8b

SHA256
95a713b80665287ff09eec9fead5652e119a7484a3afd03016e6cd395d9ae52a

SHA512
b6bfc718362708a73e6b73c9ad5f285d460b212dea1eeb92f8865d9d24e5252bfac11a5ec134c49195d313dada1bf56948f9bdeb304cd4adcdbadf8867d988df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d7bacbb36985891841d7bf23aa0bca1

SHA1
73e6a750e60f5c4637eec1429aef74571f97301a

SHA256
111333b72304a6093f101bdc4b0b047e894e513d05941fbc93da4e04378252de

SHA512
a7a5ca19b97275946ab02d511154ca079d323b437512048eeb7536756f066f61fedb379d446a77dbea8f29c086ceccf4d0fc94eed3e08435315c5be6343ec6c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ed68c770479ca574a5748726bd3592a

SHA1
35a935574f0244df259c8a040edfefd0e17915d1

SHA256
405e05372abd0635e799bb225393cdc105127fa0a3b066886fb1b24348934b17

SHA512
f5abc89e7a372089b80178f1a654181b1ae9198d6f94654acde47f776316c3de4b829ec17ba5a7d6fcb6a1c804c258981c5c9fc7863647483e1b54416254352a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
403c2f3ed54e80320b77e931f2f84d61

SHA1
acc0569a79343a67567d866f5e9659164e9c4eaf

SHA256
d32405ea4b5d63fd1cfc7959d1359bc074f6b8aceeba071d6d4aeb2555fa3135

SHA512
357c9ea9ea1601aecc0d2f789aa1c23642c78ffa23100a083fb7e1a33d0a5bb366f264c0bac0f81261a717cf27af436034c6513f861b802c016f5379542d1e18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98494f6971ab10e20a8de13f228cee72

SHA1
b56da44ff886cbf3cd7bc1c30010477fac0676be

SHA256
81c190058694c663844da520a875a228dcbe529cb86f478810462e04ec96900b

SHA512
3686992459278e40ea19cc8b12eeb9885011fc1a79ee79f955d8db045ddcff34da95b08e329679312e3414de5d9ded2ded65bc0ae14cb8d5803fd5ee0e0e7149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99fed6512eb3242c6716ae8569c3c2fb

SHA1
6091420863763a2b68bc586c3d87a2f17539e079

SHA256
42052bf7d8b8b08e292591a5bfbffc38ab0174127bdaa76bc4ba50a8e5f633b5

SHA512
0c34f75138a7cda7570814b254f1bb0d585f7a258d25469f21fbd724703ced6661ed5f23fd601b5dd54bca8dc147aaf397d5e5cc86a8b5ba8380e8636b097cca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4c1705c13cd2064f30f32b48c9be5df

SHA1
30908d6fa39177a60791d433ecef20734d1951d0

SHA256
fcf2c7ceb1a5fc26c5f06218c234f57a973ef3e784dd0185dbd53dc80c623e7d

SHA512
3c47fd00c95f99dbd8c257df0188334987254f7849eea81724b239dc91e9d80118fe6052d8e0acb4cfb990cdad41e7237fb5f101cba0e8e50961710e3f850ac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5745924c25decf15b6a24004097d1087

SHA1
e903b73f6a4222043aa7fae1e5e1198fb29b6020

SHA256
cd0b2c1ee483c2709d18d7c4b94cd0bc22ebbd026ecd31eaa35a8bc102e190b5

SHA512
f0ab5b0db2b6bc814317a7d6ca71961f2a9080d4ed89d896da1e3709ea143216edb7982077c78ea3d010b11845a008b77e5e02f21b5a247bfec3f6452b38215a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dab32d4aaa3afca9424e0e8e7a7ac0d

SHA1
36bf37a3f306872de6618b4ffe11e5ba8c0c700f

SHA256
92e23eb814d26778a6bdb20e343976c7ec61f692a7f0c10b52ea3d2860364a0c

SHA512
d0afcebbd5414f85ef358ffe2d85a17dd1411dc2ddbc4530b7c65c424f41a59072a381ee5b887e88a4eca06756aa03a3a376635789cc1355d0f5194560e8806a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f31140047adf3834910715d88d8924d

SHA1
258b960ec1577875c6f5b8f4e02aaf3a2bbc0db5

SHA256
9b9b45761e95b6f83cb7d917b02d3674e67f4da6e1dcb3a4cd88be49684cb370

SHA512
55b7515652481012fb61fc8d5f085bc8d5bfc238f7d5c53dda964ed08c6eafeeb22edd1d3bfe008ccf2b3b5cff69e1849bc3b892f58cb32afeced466fac43bd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab401F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4060.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit