752939ffaf4eb6a61aa1d41f58da6c348d0affb9aab2902638fb525af02b5522

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

304d2d58ba40b618b98049ea476df93c_JaffaCakes118.html
Size

68KB
MD5

304d2d58ba40b618b98049ea476df93c
SHA1

c88cda6de3ae7903af367689853919612b287929
SHA256

752939ffaf4eb6a61aa1d41f58da6c348d0affb9aab2902638fb525af02b5522
SHA512

23a3fdbbb24940e33e453c6604b25acd1b6bd3fa51828025eedb89049c42e9dc59fadccf84197139666a75a9e55073648f11629b8e7b833ab15197b075d76a07
SSDEEP

768:SB0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/VX:SDJyQIk/htnwO8gJynfucL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d2cb511f1bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E4B3191-8712-11EF-AAC7-FE6EB537C9A6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000007661fb5f53160b2be37ecf7681abcd751dca746fa9854bc6e28f8d3b465071d8000000000e80000000020000200000009f7d293ec7ae11746afd47cef5d2d7b8ee10dfdef8e088a538deae8e56a1af2620000000e5d6e8d44f4ad22079cf7e0fb7d292c4f8324543d43163fd0a8d21ed25e0ca5e40000000101bb4faf3028a7ee6c5ecbef3a198bfacff9c92b3991bd7a93a01c484077b8b1b6fadbfc97ac4a39000cd6bc9d5374536f9d631faec9b88932b1668fe2f2e1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000ab18ff2d50d0ae14ef3ae856f7db06701f6e6657c76eaa7d0773659f6c6b0a4f000000000e800000000200002000000050485b24c565048492765bf379f8303c9dc3674347995ab5ef19f339ed5647a29000000031ca7b63ad9fb66b147e38f68844d83f59e14e4f1557ec9e6237b9b6519e2e5e2a4431d22c83dae234e25c7690fbe3f8ce7d17c1f1d7d8b48b87ac49384ba1cb251d3fbddeaff64956bca34d456e59f4927f875d73963765d9e466f4d7af665d07f4578e263800b6428268411518385c917aba3247545af3333d9b339a0016fa4e8e2cbc45cfa9fc9d3d294ae8b6da4a40000000ac2806c64e9b43d2246cf8754a333dd7c00eb3861f5b2b6f7bc597ee4b35d03cf34291668598bfe15b10e3d1324bb0982a5ec6ea8b6c4ca1424c46304f10fd61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434731721"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2328	1732	iexplore.exe	30
PID 1732 wrote to memory of 2328	1732	iexplore.exe	30
PID 1732 wrote to memory of 2328	1732	iexplore.exe	30
PID 1732 wrote to memory of 2328	1732	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\304d2d58ba40b618b98049ea476df93c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
6ba0c14982f789027567e51523b9472b

SHA1
1df580ed2cc1996bfcc5a32214a6c6616de89ee8

SHA256
fcc9938cc44f3de281a31f1a0bd81eab58ad80f20437d96897368a090990e3b1

SHA512
ae9c85590797b37867abc474567a63c6d36a613de36b09c838dd245ac788c7edad7bef8f7a3e8a9d06571e8b189e62a670926a53c6a3b9b74a869fe10a9efbf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
7123ef2c0f5ccd21209ab3ca6527b56c

SHA1
94943fa4d712ab71cbef5edd58b80170aeae8d8c

SHA256
16cdc3640c76399d1c7150d77aff38222c02baeb4ad1719a0d92d0c0a1e55f03

SHA512
e0277c1b7a1197206e07c2cbf2174fd63cd4fa73033d7287750b2845f4af990392107958a3d0b2fae3848397559e0de064a7d7a6f568c9ad80a881a1b2aff044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be5c74c46c7597b25d80645a992e7a05

SHA1
a74bbcef279a21af423085ea15ac4cba4352afae

SHA256
3addbeac990f72f87d179dbe795f1f714f5113eacf8f762055c4b743e939ac92

SHA512
ecfd7325ffcf522fee6e1959ace323778834fe028fb1f9a5e564966a35953ea357a5f2def1c2492229da8d468a793aa82882b11ca77824120be03c45c28fa9a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee66171c61d0e912e91326402cceebb7

SHA1
6a0e8ae587256b80078527425eb26b5d4242b1fb

SHA256
8dacbe4a1090601837c8493e155a03eb9f66bfadb1e4ae659d000e08e597a438

SHA512
7bc999f460be12fcb969ad6443547f3261e354b530249c19e9178f42942e6ca52a1cabbf0353e850534c38d0f014a45897e60056bbb1a19fc399eb17cfe9733e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f94788951eb6c8606f1abbc44e1e9a09

SHA1
3e1787fd9f3635ff14d4f3c6751c20670cd2b47e

SHA256
d946f5420b1fc21cf78726912bce1f9e085f3f94253ea0b93c7fd3f87de57fa9

SHA512
a2a0b989536258a6de4b074433f4c24b2b76bf3c50bb87eb08ea059d1f8a3e61defa94a2b4b648a45b85628c96ef765be6b31ef5d5c2e21eec1b9f6c3cd665ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d86ffc5f956986226781734da1cbd9c0

SHA1
fbb9ffb2ac518ff240af2394895aca81541a315d

SHA256
273a45fa6025358e3b3c5cd47bc29ac3bfc79fc5cad1daacd8b3021c3877904c

SHA512
ecfe374cb6c22d428e00126e8facfa2cd06ddb9b209f6e3b00bf7e847dc0ee5205e936ea74d991126a80f89305b78e78ac77dcce7a6ca597b68460f226b86e93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21d3ced8332861571c580f6245a20d53

SHA1
1ef3374b396a59d72a73805c55d7a4c728ccd6b6

SHA256
5bde31c4768c88cd34ae25fdc84194e721bc32f1847f540bcee83501e5fc3a09

SHA512
51be34580e43cbf8f7fd4787d18911775e080e5410c827e75aafd6c970860246529a47d33390ee2321649a19cdcd567691b4811d19cbc61c8519c03dc3067abb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2a0c69c0cd243eedd879c89b3174914

SHA1
21bf73fff34dfa929a670e258b2ab73aa69abe1b

SHA256
7c71fbd2a4bfc06e8d2994992d7ad4278af3b9a58ae74a08f905241c21324991

SHA512
30e7b2064587d9ef9693bf47fe796b438af3aa52ff8a525001799679d15c7033560de6c04a51ea3f3686b509a55db4bb0c41dbe26717d295ce2320baacf3e94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d50176723e4cb10321776ab936986bf0

SHA1
efd057dad1089a0c99c5a62d4d0e143e5df40c99

SHA256
c7879176c038040b3be90edb1dd261900e4b9a8c37d21761f6eec6ae19d03cdb

SHA512
545bb1555687aed2c9b491811e870eda3c9a7706bdece74174fc37485200261a07695e7f741e428a0b75d0eb276f5779988f13a3956fbf5f975168f7066df165

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8996dc8d040ec83ea4c9a339eaf225c0

SHA1
4fa333c89854ccd84a97829bd687902026b1622e

SHA256
847e06ad559b38672007550484c3a22b29b4a64efe035244497240eb76a13390

SHA512
de86ef4d9cbfb4008c5d370740568ddfc5af7f106ee16e053e0fa39b3464c99e4025efc07b5d2edbc8e5747ff0cfb56e93ee621078bc4e7e05f72ccc0c00afbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab92F0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar92EF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit