6c5ff8afaba4c3e083fad67d6d5840b1dddb75a42a629d112a907038960be525

Analysis

max time kernel
72s
max time network
156s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b3c489684bbfec2d8878086d83e577f_JaffaCakes118.html
Size

90KB
MD5

2b3c489684bbfec2d8878086d83e577f
SHA1

002319198d6c345ba5840d435d8f65a3dfa28bbc
SHA256

6c5ff8afaba4c3e083fad67d6d5840b1dddb75a42a629d112a907038960be525
SHA512

8fd7b66a8ce61bc67548032589b0801cd6e150a887123304a809319ac4d59fed7707a79d079acd233901f64c5651467bbaaf02735c9413e918e9418a0f85d49d
SSDEEP

1536:gQZBCCOdg0IxCPzEqQPjWoNDag3Se6Hge2i1Y/xlckBSvGFjT46DrFjQ6bwzuqLD:gk2O0IxaPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09880df591adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000003e4a1c3c3450517e3fa8780db6ccf1f7c0f1e10c39c9d9e99d06f91044fd55d6000000000e8000000002000020000000836a088848eced6406e6045f511a3439f5a05f560e9eaadf20a39dffd686c07e900000000764aebe60f172732a7d2f55d8b7db705c30f5d66f621ea026379820aaab9ff077158a4f978c9734a5ed1c8dbba4605b8f78d40a155eea67c5237d86999c749adbae7a49e62ca4e7bdf5a591eb4cf5944917bbf8024f5356f9db4d0f3c8fb1644555f2ff5e30e9fe7588a70f91a00a5fc21d3029fae786bfd53a10c7170381ed7783c65618ee834ff352a782b935f58f40000000aa7eb5a3b8f5d048627918776c0fcfd18cfdbd363b88dc393619284520de246df6dfb7fe54a6eb63335e5d9217e733fca854f7d16f8338739630085f3a4453ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0773CC81-864D-11EF-9E99-E699F793024F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000e597e33146729de5bccd8baaa24f9b6d03957c9f39ae1f866fd0b9ff7631c7ae000000000e8000000002000020000000985dfebedae0b8c0dd64abe2221997529a3fb913ed77d7dfc58ccdde55a188f820000000e9af768a650b5ad6bf38f0d0fb3df374d265e6efc6e27cfa15dbd44c9a7d420140000000a81b2919c6af984c6584449b3348f66d7e203261b297d57762dbf3c39bf201cac35438da6dc2f94d88ca987bcf7f1bef8dc5d39c5182ad60de5ab2bed39d336f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434646959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2268	2256	iexplore.exe	29
PID 2256 wrote to memory of 2268	2256	iexplore.exe	29
PID 2256 wrote to memory of 2268	2256	iexplore.exe	29
PID 2256 wrote to memory of 2268	2256	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b3c489684bbfec2d8878086d83e577f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6ed3903430afc864b693cfbb17ea085

SHA1
529cc09f5413576f98404f1808670ceaa4194f55

SHA256
fb4b786eee0f6b689aa98d6df93a16bfebaa0b1a4c0863b08fb64d149fd6556b

SHA512
00db152146bb347ae458652cbc832e3d8040a74dfa93bd948cc52a5936995a8bcffc17f2064047d334d31ba92c63134d682b6290969eba30550a6a2bd95e6a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
100ff13737a5bb8ad38d815b428eaa61

SHA1
ce297f522906d0fc215adbd705ad413d5dd60251

SHA256
c9292c6728db13daf645d31c8a71a0c9ca9f9394ce3c89d1623a6d38efa30b88

SHA512
a6923ca67bf8c566bfd1b862029157337457731cc5fdf27c5cc09664375b51c3d50d7ce37f934c6e502ce78350e2aa907e554c8ec56defe5b0972135f8a76cf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
873cf845842225f41c91404b097fa64c

SHA1
ad2d3e678f274e8f9596dc491aef3f24091fc0fc

SHA256
6fb4475c99555c9f4017f76f1f344dc1283b601daa2a833ed851f3576510cd28

SHA512
b6d2d873ddc4c627a81ee968e5d49146f019e7d47a8ea7e2cf46b9db2421d3c35c249fe35ad076c36382ad50ff71a5a8af8a811c093c208f7f3ef799816fc9bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
feddd348d461f39eef7cf4bc4c4b657a

SHA1
13c17390a3fe945624b5d2df128ff15694f90296

SHA256
54d4a56ff38c4d63cf40cfe15986286fb3b3e4cd6150e662fb820e39a41aefeb

SHA512
2d635b417e8b1d312800dc4c4765d09fcb7033d03aa36e8006ad39b9fe55f5a703dd68caf9c21811b87dd04fbf42616770a71a8bfdf72582063d371c20e12b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
259fdec1b3c9ece5e10d7dc40cb5789d

SHA1
cb72d9a0e876ca7e2e65fd33693d1433f044d85e

SHA256
bf13c417297beb28c8c6945dcb846267e432974169952d194a4baa8c9a157ebc

SHA512
57f59d784ad4a21d8b83501779c768dc6be90ea197c10c8d63befe9e34b471b540c7f77a0073c3fe3f26bcdfd9a923059576e843c8a9188579794b4dd0bcf553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c6fd3c71bfa5d2ba8d238a99a8a5e7f

SHA1
40d970b5c0b64753c3eb568bca6dd02cf5bf76e0

SHA256
3878ebf21a0f4d150b0df0bb82f0ebc36f79a54bb0c9efd539ee16f3ef6db847

SHA512
9fb4599de9344b0d101a19af9230fade605e1be9c87240e89cc8eb3e59d6e812e144738805e454cb4c6b12417b26f453037ed07dbbfed6265cad1bee1f832e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d34ba515b1bf1b8d49f3ac4b7f4fbbb

SHA1
a15c8c1bf1fcc91318ed5c8ecaba2e6f5a66a6e2

SHA256
0d6b5a14450b6c677ddcba2d85c0ae8393c23c4e27239165d85732fe0751ecae

SHA512
da3b7bd74f7cd90d6b4366c52b77fa8af168ea9890d67d17dbedbfda7d9e54e69e32a55a0b0fafe8ae0b8ef065ebc038422d1e177ef09b5e01451859d0cc2ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8cb8c48d958b8bac4baf8baf5e39299

SHA1
5b296758986998da672d454bbce27c8b8d7965c0

SHA256
01de90d46533ef15880271e2861d3e8009351dd7221263f4f422cd3932fb6c65

SHA512
b973f38cbaed0bdd0b4a6b8703055acc1092172ae0103954e14fec0aa902213641ab68215cf821b2398996e561111aced7385ce15494ea9906320ee0eff8a810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82a5c1f960f1146e433d90812a1a25d1

SHA1
23d105063aab9c1b4aba30d26fe3f69d13d9e62f

SHA256
0c3296d50e2d4b28d568244447bda1ec024bdb245983e78c2ea62f6e5cf06c1a

SHA512
9fe051ae523a3a978e67c5c34f0fb81bdc8e233434234840b7386774cd049b85c18f010677d8fc40b9eb561405401a7e6a91526ba6708077d1bde48ed64de629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d62588b9e88c55f8d4bd1082fdd46c3

SHA1
b4a8df66aea1421bc17f394166e70eeb366c56e3

SHA256
2592eedd2fc840c58f3a095ee4cd06f99dd54c0c5ce1274cb9fabe135e1c5b0e

SHA512
bfaf0f148befc771e0c2df333f469217172fce9e772cf872ad0c429340f46330fd68b60063ff0ae86a36f83e0f3df34800a00e76d44504a86b20801f04824a91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92a8dbbdfce010d2ac03e6bcc05594ae

SHA1
b577f5ec2a500bfc96578a44be509a06c3077950

SHA256
0da2a7d754326a512fc3536b29b932a15f7ed3665cfb892eed210411866e64b3

SHA512
119f22ca44fedd36609137b8305b207feaa12004d8d6789032152efb032fd85f3480a7752ea3c3616590359d268b8f76fd3981b5407ca790e9eb45bf507c0e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ced9b5b695acab7a9add61937f205a51

SHA1
4b23e03e0a426330d7cae369ffcd667fe7aba3a1

SHA256
cc4895fea27d95015286740987c8b39cc88de804efe9c73c371a33126a6ff520

SHA512
59702a5ded934bfcd54d7b362100afd564e9bf1c55fd6c57f83ce9ada81aeab6e62c675e0e64a2d19486f0a54a274d95d26bc0c982340a1c152e17d0c6875bfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b066dba29b6c3062a087d6f8ce4a177

SHA1
0efe8e718670d4f6de9ff37cde2f44bb4619e8bc

SHA256
f8180c7ae314acb5e28b2e2d0e24c698d89187b7d67be26d9ba8303afbdeacaf

SHA512
280640144feba72c9b004499b726dfad4993986f05b27395d4175d704f7733362c5588fc6d7e93666fd3583c2f7fdf93efa64c4e2b1acbe0ea50cdbd742cc7a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4cd433a1248c8dcad53779d8128d8bb

SHA1
57a39223032be20e25957c784c11251874e10435

SHA256
09df8531cb745a4a887039d70f91025ee5de3dc9f4849e2c354453f652cd0a0b

SHA512
41773065f0bcd03519612e699391314535a0366e9c1e1d840ab143839dbfbb9f3bc97062f049308b9b2e729261c60753db99e618c200357afe05e8626f8c6b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC3EE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC4AC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit