2340f2072aa1a20ad35245036321cfd7066be8fd52401ec677c1252069a6781f

Analysis

max time kernel
139s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a67ad5e5f8ea26ec43058ed4e69b76b_JaffaCakes118.html
Size

139KB
MD5

2a67ad5e5f8ea26ec43058ed4e69b76b
SHA1

ed26b6a0bce7bc86d3ae0cf7dec892c9111d55db
SHA256

2340f2072aa1a20ad35245036321cfd7066be8fd52401ec677c1252069a6781f
SHA512

b937c9d0f0d9aceaf27a3bd342418ef664d31ce47d8f9739c590bd3b437890303efd319068baed55019c9c95fd75db43e492c274d5932d4bc6cca584ce93fec2
SSDEEP

1536:SoRpS7qlWVyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:Soi7tVyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434640461"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E74664E1-863D-11EF-AC2A-E6BAD4272658} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005a5dfc4a1adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000011be3e93868bc947be5a0accf0035c2900000000020000000000106600000001000020000000375d84c1494b340449eec0b13d11f5972edd55478a9780b638daa9e3acf70f67000000000e80000000020000200000003798ea3d0d0dcbf7c983b34b69c97e3ffe5620b7d8b6a866f686d38aafb2df9b20000000f78395dacead1d09fa0e5c522152f2f0f414a9b5ecdd977ec2df48e54609bd75400000004d7a5b39ce49808d884797930f534ff0e8bfd696921a68c6948fa72cc9574109503ef1a615abc14dae205e7f9bd7b604ad89ed8a65e820def27574fae73740b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000011be3e93868bc947be5a0accf0035c2900000000020000000000106600000001000020000000889daecc26a8570e98b6a53abdbc5f0525b57d20ebbc4a3b9e1e68367fee2f7a000000000e80000000020000200000001ee499cd6df139699ca3ca2a5ebf2160e89033b0ba2b7a9f542c3166afa59afd90000000d85afef32cfcef71c85a5e7e9544d4fae9944f66cb7f97f33e07767a0eed55718c4f7ee25ca32389bd1f6a4f88a4432231bf826197f24389ca3424f49813df2ad984b0d1b6e7263cb004c57a7a73d90b23c3900cae481707535ff9366e36ec9e650f4c97e18ca2b82227c0be0543f98bc5e63aab9ff5062504c382cdb7301791bd9a172f6a6cc3c515a0de21daeb786b4000000056709b2cc486631ab7b362239cda2889e37c362df153f4fcb8eb67a0c0b5e0d5e55720873fca0f93ca2bea52fbcf00afb4368a441f088afddd26a180c18bbb71	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2412	2184	iexplore.exe	30
PID 2184 wrote to memory of 2412	2184	iexplore.exe	30
PID 2184 wrote to memory of 2412	2184	iexplore.exe	30
PID 2184 wrote to memory of 2412	2184	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a67ad5e5f8ea26ec43058ed4e69b76b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1caffefce6dc1c1d6b8a5302a96795d

SHA1
2edf9ec29309275d440a2c535feb0b4e818b53f2

SHA256
fc9d744ffcadd6b37baa7ae42ad4ece022c17ba990540b57d8660d35b159f4aa

SHA512
857737f875ac9cca75445b07d50d7209a3330a3ea289e2884d248cdbcb7ebf15d6c683417873eeef2c10d0fbbaf0e04f3b1dba710599490b465c2f0b963ba85d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b12a74e23c92554b62977fc077e2e2bb

SHA1
3e0da4b6076c72b204a3028cec80adb3ac63c87f

SHA256
877bf0fb6c41cb57e4fd2378790fd09c9833e89d873ad888cfc4ed6babeffaaa

SHA512
e5462bdcd8ae5dfc86f2bd648c8705d6f539be9a4e4a0ed9e5634816127b5dfecf7ca06a81d20af4b57826e8628035b4b5b8fb94cfb09bd50b47df4485bc2510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74aa5871bcf21e984a2562f51d96eb8d

SHA1
cd86f92ef11bb64e20f2509ddccace394af9bf66

SHA256
18fda9f15717e812619b8ad80282d4e9dc526c043b4f3160ee7b05e1d95301fc

SHA512
3d10a40bef9db21556dbb07f4ef78ecd9f3f1e32eb1fb6fe267928c9b444cf3c0bf33bd36df509af9b245cf10686eae1efc7017702de45625b92794bfb0021ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5120115da040d5f640a5ee6a8ceb76f8

SHA1
f699b3da58d03f76db5ffefef7590ceccf43b9db

SHA256
408755319beca66889b468b8aea2bfd8db62fd3d8ffa6101fda03f98e5a35ad7

SHA512
ecfbf398a5bea084b7ce6631132277bcaddde66bb05b03b2831ddf1f2a22bc21e554327d96c4413d335e6007ab9a3746573a993f979ada10e8061993a0a1ec8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ee7fc7ec0a405a74460df37b337a7c3

SHA1
a82ed7515b907b7299b2327d99974e82d4aedab4

SHA256
1e5edb98c1c1e5ff762e8ac9bcdb5173adf748e87d8ac4dbc938c447ecbf0c98

SHA512
40e79937af1a6abf09616c74232a19dd16ce0e5fdbda84cfe392320b685ed8c3cd384015d8c0efa719b2f9b91534e593066a8b64f952ce3dbfd405e49a12e4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f50656350bd7cc0bd51b9b2a8e87785

SHA1
399e4315673f4f29b74cf11d54056913e0c6cfd3

SHA256
0f365d4af911cbfa41fc55aaa485b3212a95b7219193e4c856337aae00184df4

SHA512
08fb7261ec269c9c6cf9dd883fa238d6ef8cd6152b846a603e636544f2c722cc8f1be6927cf5f2b0e88ce99ba136552f82daf4953e8ac06693a1d90675687c8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
004ebb5dd712a7b313293147d63240e6

SHA1
49cb142b37131a036126b703f1dc2469b8d243d4

SHA256
f21ba790ec2b76f2d38590d620945473e7f99b5b9d9a9b0cc6c8b313ecc614d0

SHA512
a4b31cf05aa7b856e6a8a9e3b4a39eaf87494173576f9b6d504ef67e62e4bb50f438bab1a1e43c11a83f96366baaf06229e871595908536036f21973b7b386c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc39688883ed3a314c9c1342cfb66d92

SHA1
bc8f07d02672857b4240d3a941903eebfa67d7ad

SHA256
b49fa687a6b579ea56e5423235502b69a67c11a3ae813de5fb60cc128c16bd9c

SHA512
9b7da5c266b1cd316051a79a9be973765bcb51f09d9bafcb8761b91e98ee7d19c90275a7599d820c0826bf8bb7ea63c3156759a61cc1a84ad598e75fee6deb9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a53174d29922755e0528a400acb79273

SHA1
085fe73bf523129d340fb01d4395785edf14f37a

SHA256
7c329e302fc3fbac894a90eb6ae3938372e726bb7efb2d4b6117d775adbce61a

SHA512
6f3996c604dd0cf650526b4a93d91e3db34b14d2be864c5aaf05331bb93bb13fad876e5577df8f88c0e069222297269166746864e3b0b7423bf987eada4a1e18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a1ab5c42aee6d7e50a0f9866fe0aa7d

SHA1
f27a144899610dc5251fb9d3068f5e794592659c

SHA256
84f0db0a53be509ff8bf5015625088fb7a006d98ce0029aca5b3be4c01257d1e

SHA512
8d47702971c2acaa202e7b963859e9da9716fcae2bf430d0790398a0d85a2e6c05e573052247c8f2ebe749b9ca3d09e20e24f0f4711579d6dc492b17a2aa28f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0765a70e82f57234ae63292eaa721d4b

SHA1
925be285c01e014fbfaf38232d890d36f22f7aa7

SHA256
470869e56838d6f62a4682540e0e1d1fa9ec3a0e50b01e858cb09d359cad2bec

SHA512
4d91ce73d84aadab49c8eef3969399623f7dfeae8d68ce6021c3c6182a3c21cb718f053698339ce763a9c78a5f8796e3aa845fe21eac7ba01ed5900c40386d8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D73.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E02.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit