d015ebb9a585e80f2ccd084f59e1b4c8466fb6baa46a128955f9930b5f3e3c77

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e199978298c0e9e90fa8272da84d39d_JaffaCakes118.html
Size

52KB
MD5

2e199978298c0e9e90fa8272da84d39d
SHA1

49adeed719282e1466317f5ceddd0feb47f3629f
SHA256

d015ebb9a585e80f2ccd084f59e1b4c8466fb6baa46a128955f9930b5f3e3c77
SHA512

9726302f5609e52c7cbf74f6124a6d448c5ddad5c91fd4babc8c03e8d2835709cccca0498c15063ee10f61f34c683de787d715759ff917b622d9c3fd602b6b17
SSDEEP

1536:kINmRNaGU9PrCSnW/cW9VtC5Z6P+ZnNgv/fr0ePWLv:hNmRYzCSzX6dfr0ePUv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000725714bfdaff063dbdcc7dd22803032266fb682d0c19e2a43b03a2796e14e0a7000000000e80000000020000200000008e54aaa01fe2bd831f4a8c346f05a83c2cbb70357b69e80ed09d45ca184a741c90000000b5b79915d06440c23844a1a2460ee3911d53a12f6e841cac4cca7d98d3aeabb37ca8bcb0e87168581e43893e5e7e1a56816db30b5084b7898f19d9312c2f0c3323e765a30a2e365c2c2ba31484ceafca860eb1283717792b889d45a87d823efbaf33e242da1e64f8e17f4b3f95f3e9f1ef0bd716201b2f210a9c090c7dbc3398d6de1f1d1fc6d6c46def3f34adfba28a40000000e10ba745d26a57b6732c62d7e1d9eaf431e03e0a79ad8cf2a0e405978152171e55705705f8b6fba6ef72dc6d88b33662714aff3a38a35cc08bf4c4ec7b4024f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000064817f0bbf961984690455fdb574712e8d54bce3d248a6f9642ced4542821c31000000000e800000000200002000000093ef1d9c5ea7e19993398362416725314bf631ff7a198c137b7babd96bfe76a020000000033c078dd405a68621a65702806a846e2d1725fd79cd030523ed8a8b78bc29484000000004e44a749396efa0bb3596d1a973205cd590d75a5a383e0a8d9c491596103c13f3166c1d885498e6ae49db38d62c161ec30a9d4436d8c4c41344b1c049ff26e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5283931-867E-11EF-9218-EAF933E40231} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434668399"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5071dfea8b1adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
280	iexplore.exe
280	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 2180	280	iexplore.exe	29
PID 280 wrote to memory of 2180	280	iexplore.exe	29
PID 280 wrote to memory of 2180	280	iexplore.exe	29
PID 280 wrote to memory of 2180	280	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e199978298c0e9e90fa8272da84d39d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:280 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1705f2076ee8dfdb755298ef7e2a500d

SHA1
46f2a56a2ac902a2b428bfacb9ba5a114c7b6e60

SHA256
867d9851867abea0c011f5595d21e46dcf655aed1e16370ce68e9e150d69dca8

SHA512
5d80d4f44b7de22efaf1ff1bb8b6b60712fd4c3b6cff2130e0336c4d399dddc63d1ea048c0c43ed74ce6c6f3b393a94705389a0c16c8e7fa0db0ae420601b665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec7f99c42bc2124b13390436ff149207

SHA1
291114f62d35cb33897bfea8ef878dafcbda9fdd

SHA256
419a3fe5815dedf5267e1bbe572a1335680cb095459232febd6f6b8ff5eeb93c

SHA512
9a90f2c37acac7234012f203441baa3cb5722602e36b783aaeda686755ab8524b0b95bf697df3193af6a024f6a0a8b9358535592609a59f077333d6c45882d4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aac7490c9a3a5d8a32f92e732459d5c9

SHA1
e635829cbd4c56ceb593ee84f40dc067dec62fbd

SHA256
c4521d67db3582595891a881fc020bf55818b770a18a5455bccf4ca187e94374

SHA512
7528a7e44125f6c6e1cbe03a0461e4e856ed3e121c4acefbece096f5927c7549fa120f3c4f6ff44d32f6e78685bde60750195586a793e899132a14c21ed37639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3aa659024205a6e46cbed85ac8dada42

SHA1
87062980d664af8184ecb2b2e9b6e35ab8cc3568

SHA256
803c546a97a8adcb232c9bf414c0fa709b73ce97bd91f7a155d27f3d446f7226

SHA512
a9c17866a73104f229de18a0090aff03f7d2bad6dcaa5da9c0c5c7116dd3ef917e77d09124b942e647bd0db25d60bf3c266f5b1fe5663ad52063091d0e948490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a9ff107606353c08d4eede6ff500f18

SHA1
cca846c106b9a729358ed57c043b5546e3f0472e

SHA256
46bf6234f29a1efed90393868b0753d13bec92f893a1c0a3eb1bc58e9373b7e4

SHA512
2373676a382cf550dfebd8ae257f72f084643088af657b5bbc46d164b352d6755a324944b70194533bb51f60d439235bb458d1c52cbe77c2ac5d58ef2b071c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
852a08f4ae641ba9fafd0e9e9ca1e98b

SHA1
f3f031ef124281181bc20e5cd3d0cccda2555eaf

SHA256
7708a001de2792b95552b652cd9654a0a011dca4ba1d9df52160ada4806d45d6

SHA512
7a5a33548cb555945e1c1b3e73270a1aac10ce8a5e4afb871b9004d4d0fc9ccf2a4bb74cb6fbd22a57989376fa6881d45ccb122512d6a3c6817bed9b78190050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
871e20b17c6a8d370de22ae7015e143c

SHA1
8ec8072eecfc700dc2453f412f94bce2ab684ce2

SHA256
fb4f71b2fa17c080a02aafb18aee8cc2aec774bc3a6a6bcc0b1bc4ef62da147b

SHA512
59d2c0b2ff4c7b76d921efe447d9331ebb782247e9550ec6dd3f823548c5a461b6b919c91bc30ff04b196c6895a0c3cf1ee538d3f9b1e23c66cf15842d9bfd93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4edfde30d9cafd337c702a4e0b1913e

SHA1
59f00816726d9dcefb5d8e8746b44d2fc8556052

SHA256
fd95d0cbbea6953b35afc15e1c2803e43bf27508307da6e243f5f80f7922efd1

SHA512
f885a706d801938fe6f525b8dee0a09426d032903692701b8e86d48091d90540fd71d528ef907024889be8983ceb1220a4a45db7ba381dacb7ac7207b815c8e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3bf3f95195616a4cc7bb566a0da0210

SHA1
286f9cbfb5a969001af05b8d23f8e9c2dd159d24

SHA256
99bd4e3de767f50ed371eb42c9ea544aba8ef7f27c683832883b173ccb539396

SHA512
ea5a016265740875928580547fd4120c24040e6cdab1706080c80cce71b0af18c82f76073c8a8f17869719f993b1d685822f9c2a156f862112cfbca459c96df0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9555499a0625b65384e0010c1f29bec1

SHA1
f80e7912f06ca275a1e9b6761e18e29331d07425

SHA256
0920684d1b59063292af72cad49a4dda3522cb0a8748be394d337c26575ba3de

SHA512
5c4b23fba0c1a3f7df530ce968b9a60311b5ceec89b223589a7ed9afef2c17e88d24e378967101da1949192ebe3c23d309d72b0ae26b181519abfaeb0fea5921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8ab0d4ab8bf7ea9b3824c369d310cae

SHA1
d3a2c62da03fadd1ff39cd7d2dd1ba7cf1ba3bb8

SHA256
40a0b61d4eeb4fe62fa0005e607b0d41677ca813763076b8409f8056002c4c93

SHA512
562c9eb0297511e16f3e490cb2879b8a2ed63872bab1a4f74fa6bc90bce39f787fb5eb5c5a0f9ef5b9b273cedcf8336f43cd857c2cbbc141b347181d74354999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c53a2b7f9bca6beddce92040654e1c1

SHA1
040de5b2078ce07e15ae86053ddd8e68c934469b

SHA256
04cc8bd45ef4cfce5ed4d57b9efab7d10397f9c72b8138116c30ae46ea92930c

SHA512
c633e0705e92c72fb467206925309e78a96bf12abe40a46c6e142f5054af6b63baa86febe576ac9a859c7f3bad6e759a74dd8e4fccb66a5a7b458f72349f0b97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1406df05e246adc75ca092dfa96da492

SHA1
b8abee8f3601c48a8627763be65eff474f4666cd

SHA256
a7d60fad60106df18cbab57fcd8445948548001148ab0f72e800a77102badf67

SHA512
5bfcd6434d329484c91d0c938f563f5fff9199a45d60828f25792a2d250571dc3598cc361dd447962657234873e2861566ca8d5f2ef525eade15622da8300e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9d0b723e05a0aa9d699f413708b15a7

SHA1
ae76c160a961cc098a538439e473e9bcd4aec12c

SHA256
4a3f313ae60777755d03c76c59d8a1b6399d358eb7b256c8bf7cefbc94f7dddb

SHA512
a2ec6567cb666261fd6cd48421abd0732812e4860af9aa1d8421e62180085430855a2417fc47494352cb5ccb9cc445365b018ec849d351467778b110bd57e355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57e8fa60560e3954a18b9aefb22e81fe

SHA1
d82ca7e3366ab8415cee4dadd69acbf59a87777c

SHA256
142b3770555f4f2da46d4d9c8893081303b574fb61555654209c4fa672ceefc7

SHA512
0f6b02898b3430037e29630ea2c93f3f769c2a556503dff4b4433cbe71aefa2ae32559f433cc5b522e7dcdd01cf27994253a6d578780b9d039b145213ff3ae7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEADE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEADF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit