af1bf709025f635e3a0005571c900fc3bbc6146731ed2f641a7121959f5a74e8

Analysis

max time kernel
139s
max time network
156s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53f14bf82981b20e2f78e69e31b82e54_JaffaCakes118.html
Size

58KB
MD5

53f14bf82981b20e2f78e69e31b82e54
SHA1

7ca3ff5ade40ec79ab5bbd670c1f988cca8e4692
SHA256

af1bf709025f635e3a0005571c900fc3bbc6146731ed2f641a7121959f5a74e8
SHA512

3fba1d32f0f48b5fbe77b89ba5ed6834c7fce8cc54e648ee57cea68db1825aa8cf56682deb57a026ab5b463e72f6ac2ed72b37c3119de55caddb0f5ad4827ee7
SSDEEP

1536:gQZBCCOdm0IxCIfHLfxfhfIf9fttfPfJfefHfKfmfIfmfVfifFfgfJfIflfXfAfe:gk2M0IxnpJA1LnhW/iOw+dqtoRQtvIyj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B60EA51-8CD3-11EF-9F10-C28ADB222BBA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435364301"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000083aebd4ca5844448c1b4111f46d8451d33f55a9184262b25ad598d5f1628305d000000000e8000000002000020000000975f5a5c7cac583641ccdc7716c78121d779bf9900177b713e8c0dbdbbd22f8490000000004e74d31fb0242670ffb5ea137d19dd9d0bee7a89018447bb06dd85ccd1492e7639a95d44099f7a48d6246f452dc4e320e6e56c531e7abbb82f2bd0cc0c039e019ffabd61de041a3591f30bbeb434439d1bb45219c6df93ae666aa11d37ee21dcf02335698974bb0291cd1b1d7ff2af96ba2bdabff7f877bdd467eaa1172ee755fe06e3f0e7757bfa33b6acb1d16cf6400000005685252032bc5456ff9dc850e2008f90560eb08ff78cf69b7b2e5f9cd7b3582802b3222b9d60114de71f58b3318dae282bc25896502250db1a488ba8d6902507	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107a4912e020db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000079af54a306c7a17d685965ae3f712c059afcededd322daa2fe4aced1c7a341dc000000000e8000000002000020000000faf1f15b7321a7aa1383c337faecbc066a4501279c1821971e685f218fbf49f3200000006c8e24876140c1bcb2b854ac11504dcbb3ce47a64993bccf05582fbfade371be40000000626e04091f40f32751d97a54aba76a99c9162f84cdacc90325444b2e32b76b3d740a8705a54f8373da2d7663fd1aa719c89e5b2478fe6bd229014ea942a78e8f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1044	2244	iexplore.exe	28
PID 2244 wrote to memory of 1044	2244	iexplore.exe	28
PID 2244 wrote to memory of 1044	2244	iexplore.exe	28
PID 2244 wrote to memory of 1044	2244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\53f14bf82981b20e2f78e69e31b82e54_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e48ad00955a140567565cd324ebbc40a

SHA1
83da85b7e429f3fa67af37f0f67a3ef412774a97

SHA256
056b186c96796702858ff8a9eddb7dd8b6e73c223bb1f6008fccff3f5be4d6bf

SHA512
75fe3febbdf696b19d9c7e4887ed89afe07f237beb6c3f820c7230d467191d90d84aa3cb60aae323dfad8e6612bc8814ff9c9af4fc908510ec2e62feb203140b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79e477c0b941be8a5b7618b4a89dbfb5

SHA1
4c071bfe7846cd985dc9ccb147a73590bd3fc4fc

SHA256
943cd82231c2453ff37a6b05c79d53348d6da20eb434d92457792b902a223c66

SHA512
e5217b4aebd8f73d98e6bbbf0ba487f2ae7546bdf95aa3140925ce2224378bc7ae108529ddd7a137780951e047c3fe149b451fb056fb7bdd5e0087db30932ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8991891f808739958dca4f46560729c

SHA1
cd63d8ef8333589c726604d832bffb2da4ea7cab

SHA256
b84b7f8e691f05a0497fb3e97672fe0bd06cfa794eb0ca3b47424d24775fcc64

SHA512
ba974f4497f1594edc805d8c2722e9629a5d90f6f8756603b3ef8c751629b1b04ab8e454db73728747f48a6de5d436477fa953b7b4ed9fb3495e7938ec22a2a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e6e97a7fd5e286971c4b2f7da4d9376

SHA1
367cd0858259b3f098e22a3847483770806b9205

SHA256
28d4e598deeb9e2398d7f27f5ec6a20cc4565679288ea607f82e1462dcd5d05d

SHA512
cc7465ba930620978378c433079faeabde5ade14f673676b5e84eaad84255500eb104683f5435dd943dbf47e198b5bfe861ae570296f3b0de8b470d8e64dde9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c102790118e6f1b88205a312735e56c

SHA1
d3091a8c6a432f0c8433005669f4a51cfd00820b

SHA256
0d90c34f74d421a4ae66fa94fe6cc61909357ba7929702a127e005b5992994d7

SHA512
a1153f5cde06d0ae7debfec6b2ef391f7352553c240c4b0cb9eb4ca618525aa23ec574bdd2c1f647fca58ca12da0da752a239afd060f2048765f611458d76e25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d381de59be032ae75b4040355569481

SHA1
652c63275017979e63ecbcf702d2d383175cc760

SHA256
f72b3137720e8c4fb76fcaa1ca7411ee9aacd91e4bbee642717ee26a24b37f99

SHA512
44f80f0fba1ca81e879c45eb8b440ffe7019eed01af07836cf13980dd73337d233d711807377f11b47e9ebfa63d4809849cd31c24738bf82e9bc56fa39c7e94b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0632d01c216277ceef7b43ce5f8a130d

SHA1
749ead339b6708d4528255bdfc15f2ee3bf74445

SHA256
0402122fb9293aaab7a5bf565ace5c877df1e7077f5be43cdd3376d2bf35a75a

SHA512
9fc008f0d0300d8eb08907bacbc7b260050a59a664322186ccb62a23b92df03777455e447901f7edf6f173644b2f1bb7c3be01fe50d8fe7ae5a8be4be133c530

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c1e16ad2d15440493e836c69756e354

SHA1
31e01c22c161f5459a014736a32d0312488189d0

SHA256
cc7fe4f585cd64945b81d067fa4ab3115d579ea818f8e236e134952d943a5bb6

SHA512
15ddbc94c1a7a3f4be11faac138b3f7e0464e8720846adec41b2bdbf3113e3c10f3373b5fe84a1e3167817f2eed5a0c7cbeab4e97df7c4d1584918c18c1c7786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89059df31c52d22d99412fc298a37655

SHA1
f9b39f06c5defcffc93b8a36bd7132046ee02705

SHA256
b5fbf59c1d70af5a52396256c1dd721abf214429306634f78fee1a2747543dc7

SHA512
b286873c1bb6af38e91a561320e184289d44016de11a9746bf8fcf3fbaf28626c655b5537d37774cc0e102f894d6d3d563b203f4c634b33b39c5519e18f3c613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4e0a056a94971ad0a4be960b61cf134

SHA1
e164d1ee50e55b13755ebbd7eaf9cde4afaed233

SHA256
e2f3d49367a2c8e4d7170af42e259208165ad6526db4bbbbde2a8bba8fb61c2b

SHA512
93cac636bce488cef2067dd3d26ef6c9a0dcd3577cc88f061f70e640eba24bf832eb5121dec98d4f305aefa80c0e9f62f266d360c459324ca9baae10d7e29beb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ebf8a8f44d1b0d25cd73f91c05ec1ce

SHA1
cabbe8b12ed0810c8f8633322274905f79b4db97

SHA256
d5e11aadd551f7459b1733e303dd580eb0f7c2d4c373fb98d50931c0850472c9

SHA512
348af1311907b643271bcd83d870f8f7edbe55d4c64db91d3af412a18cda31c8ca19b2baee25b6d63a789ed71f18550fa031582e49016e82a396e2cc8b348f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb37a6637ca4e646e64a760a94646510

SHA1
484d3cfe3dc5aa257f95c8f4d0443952c6393496

SHA256
61fbbf1d467d6c26df6089a6087a92180196231f03faa9d030dbc76b57e20002

SHA512
03b6d7b11b5930bf8608a0cb13fb85f5b3154e864a2cf9340b5399ca46b1b95af519426f15458fa83c4da819c4e9ec129d9e5b59466f140f5142057691aae4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
564008214190257cbc35e3517f0d415b

SHA1
f9281db1eed209147dd6cbb9c4170fe9fcc11ee4

SHA256
bb94a1a69f66d54c8c987d1b163d77ddf69036bc4259a94b923e1aefd91f290c

SHA512
a23467eafdceea31a6c841b90cfdcecf568720e73172a5fe239c05635d62a0e9d54ba9d57cec46a03877a44d2750783815de9592de4939da14fae07fed8bcc88

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB167.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB169.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit