b677d2b805b8e282a44d55355d599023232b9a17342e6ac703f0f260edcfb423

Analysis

max time kernel
67s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13a5ad1e8c9ce51d78ade8c56ba06d09_JaffaCakes118.html
Size

702KB
MD5

13a5ad1e8c9ce51d78ade8c56ba06d09
SHA1

04b1a8038b744bcb920fc6a51e9fd670954b8f1f
SHA256

b677d2b805b8e282a44d55355d599023232b9a17342e6ac703f0f260edcfb423
SHA512

64d444d2c6fd481df95a5992e9a2a845b8a9659b7e0b3110b15a225aa2f340b41ed209e592363e3c7781fd15e4099d7b9c411f1554e66fc6337707c9e83f363d
SSDEEP

12288:nk8HcBtNgSPNgqEj48UPuk8HcBtNgSPNgqEj48UPuk8HcBtNgSPNgqEj48UPuk8l:nk8HcBtNg6NgqEj48UPuk8HcBtNg6NgL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66590911-8259-11EF-A817-DAEE53C76889} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4086d73a6616db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000134ec38f56e7dac819eafb767afc8a09d34b60f963ed8e9fd22ee9c61dd358b7000000000e800000000200002000000051e8ac217befad73a832d1db0c49e21ea3aae8c4f875469caefcf8879bdfdbed20000000b2fd3e36b94dad68ae73191965c3d56d9ba817f8190f2cc5303236f28d3beb58400000006b30f692a49f048ff3812588ed1e6cb024612a8d8b3a2a39387b1b7b0f26e9d78d9d6a81ca21853e18b1b74e63ec69481ce6ffcef6c5d99aa5843aedafd91aa7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000f8159b83f3a6ce6d0ef2dd6ff658669639c2d56a8501026f2daaa334216105f7000000000e800000000200002000000004f656730cc66a84caae60c5155eb186dc5211049915f309403948194b298b7c90000000ab57625effc3d6273b85141204b7c43c10eaa26b6b95d541e0d520e6482128f969dffb1c05634cde421d0b7b3a7733c5e703fe8e3e54a8e376e1f726f28b8023daad02b431c55a82dbcf36a75957c6a9cd56770375ae153f34bf92b3f38dc5ba72e013c78ad0e6017bf31e1f4d48aaa3b39621af70def12b40aa2894ecfff5825117c40c660c7f8de1f400c3ff1059bf400000007ee29f47c3c2dd3cdff78599406b0f0926f15ffc35366941e24d5538551bccc58baf47e0942472966a25edf4fa13af1b4dd79e3e9fbdf03f1a4fdd13d47b3e82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434212463"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	iexplore.exe
2412	iexplore.exe
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2020	2412	iexplore.exe	29
PID 2412 wrote to memory of 2020	2412	iexplore.exe	29
PID 2412 wrote to memory of 2020	2412	iexplore.exe	29
PID 2412 wrote to memory of 2020	2412	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13a5ad1e8c9ce51d78ade8c56ba06d09_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1a147a8d689c249e6cf19e78182ada2

SHA1
decff5be1d37740b667aed39eb631fe80a4cdedb

SHA256
48796bb69ddd02fa41f06f8082b81214bf025139fe55fc2adeaf956585d975a5

SHA512
6df5a3c4ec903ae1d47f1a5e2cf1e3f14aaf0acc1941ca97f654191ca92b53d117d9b14e47cf3aaa74b16e6f23999a49063a777e4085531e874844a0bcedd45e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a231a4d17df7a77cdcb8a53722ed9e02

SHA1
9c4c9004a528b698894d6f2255fe9275f9ef7bb4

SHA256
ce3ce10de18af7e6353b1e5d13d4f7d055726838361c698e5c007a0f2d35f37e

SHA512
e03010595fd4c0416dd86def56822fc5bc95d9cbfa28156513350dd76336d6cc040e4b798ddc816f8e2b17c2d00bf90876bd95053bff32942e6131a806be5e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f24b92775eaf703054d4c9f8af30936

SHA1
8380baf79b0fdac3e09f23aceb9705ab1f367841

SHA256
f2111f85f42fa02b3ab3f7efbb720b3c1c40ed32b745f9e37dc136c55f9f2716

SHA512
becae459b4bb0bb4f79c9ada52b7b54a41d0cd0837c5e17456969893ea6167027263e80a8f916e0af4c8d2a97089cf87e1671b4f5b241671fcbf3a3bf535afc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be854de614b3a2fa0e3db65a00eddb87

SHA1
818b088c15c8bb1a87b56a6d6162d3f07a747072

SHA256
7ed5ee7b33fcf66bf7706e7e16cd3815cdfb5b8b35e308a158959265bbbafc90

SHA512
243f287823cc1c2ddea557fa437680dc196857f87f769d4fbd4700de8c5809d7e5cacd7a6a8bd039002cf90e4af68455a11fbdd562e4dd24703d62341707e9c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72d824e5640e952df0bd41bf5432cd0d

SHA1
1b22a227ca94f804b0d554b3441393ae1e16e124

SHA256
7469932acad20e7ad5cc0cd644a51225f4781f4a29beffc5e2c077321441d3c3

SHA512
ae6304300db7641418651f29d59cf1a30dae8cda21b97e0b243f2fe5bf45cb22b8b5c38c4767df10d524f6ecbcdd0159de83a7203bdc6deefd5b045cfa291039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59eb2e0e04c756c319eaa658d41906a2

SHA1
7f5bb58019cc299de057fa93bf4060e252c4b120

SHA256
2b95d7a0ebe5eb7fc791f4fc98f7a7b429cd088a704fb9a2257082b138e0f118

SHA512
2deb847a03df22398949cac63784f3e8539fd41f1be76f3aae8af24926f19c5c821d337a4ae4fccf48b233e55bd9b85b0be374da1a293278c7f8afac48e57a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6c19da20445243e9b6ee9f1a0e07b2e

SHA1
da53022a15f415a108e2938f0d93d413aacb14b6

SHA256
b6cd05544e1718a8e049c7a1687108cacce337cad1e6f94a3d120ca8f23991a3

SHA512
c60b0713d16ce2ef93f4d81bb8659eb992bf615510a8e856b80f4169372033c360e5a32742c171175bf199b497b0b14985fae63b4831b1a80e7a5919d55ad57c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
898bb4c2af0e8b7aaa90f915d25642f6

SHA1
fefde5750bda0e67507c4212f76566f1362eef62

SHA256
5f260769ebf2b4b790e38d0dd4f841ad91b13da54499eef87207407f3f9d872c

SHA512
d0c0dc9f1a66dbbe36caf4f05ebbe107e7fad4251b253043fc0a58c396c86194cf114fe8b546c5cd278e38720e0793118078a0823b11f69e5cfc6a10407645aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27b6f64eed23fd6be511acaafe1b63ef

SHA1
b0b50a7934c0d700ad06321c2b50fd24efef8888

SHA256
08383c2a066334e1aac250ba751a5c407931c33b34f514401747b6ca367d976a

SHA512
6441bc7a5ff425c854d1b0e57804854582b3133a79601e968d09e55b75b02803724f4111d3a843107c398648ee87b2aadd891baaac62f43240bf96d30c29c346

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC86.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCC98.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit