3fcfb6e9a6fabda3ae00f21712f2bcda4c149656470432b88f702bbda08e7533

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c35548d9b1bde4bbd03f1cc980cfe44_JaffaCakes118.html
Size

74KB
MD5

8c35548d9b1bde4bbd03f1cc980cfe44
SHA1

7f422980882483b31c8f2018fb7c17e18da28569
SHA256

3fcfb6e9a6fabda3ae00f21712f2bcda4c149656470432b88f702bbda08e7533
SHA512

bf03cc02e90dc5dcb9fac6b02bf049ab37830a1a446504d988e054e788761f094de3355ea19d2e0c46e6c25979f7c7fd63c3e6e6116b98bfabb945ab42f4200e
SSDEEP

1536:uYM9DWqHBPmClW/BPTMxr2iPXUFo+OFvYUCP7sbc8mvk6NUr+cfUkoSzq:3M9DW+B12NZM6NUr+cfUkoSzq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429576813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000250fb919760de1ffa3d711b90566eb5bed241693aa11bf814a6d77f438b81f52000000000e80000000020000200000005249780cee3523ddd02ce40ffdc63cab9c8534619c57c79a7f63e6c1d537a72490000000555cf06f354b0a21c750e812b294f4467cdf121b104bc8f91baad5a4779cdc57d9dbb44b57594ad5491c986d02854c5fd17fdf99f591ed8e076bdc1010a3c62b3cc0e81437b34edb19d3e66e46a617413080f2797ca3d4a9a3962bb0b2a6c73ed65273d2b173f16b2bada982aa93a3884af78a9380f65cda13f8f13b03bbd108276ca34a1bc34f128382e9b3ea11a4c24000000051bb138f1c541fd3008787519407ec3dc41fad0714086f9741bb029f56ce888d8c45dd54c2c6cb60aa83514d65723ef8f11b4e30df14357abed8c845859dac40	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CAC3321-5830-11EF-90B1-C20DC8CB8E9E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000045e784b3e450447c1c50e22207882b291582e884ba77266c14c9ca285623bb53000000000e8000000002000020000000442b86e575a396b48a591a87a80e372faa117864d6f9ebb3b047624dc9ba870920000000c87717aa34a93ecce2e7215d6746165305c55be2a14f31e7165c60ff7a539be740000000cdfaa3532e9dc53e6d9149cdddb350a06b810ec4c7bbfa658a36ff29a5941d1b2daccfaac55a436f4e0671aa171244bf4d129f9134a0c38144a72d12449c6da4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807bf8143decda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2628	iexplore.exe
2628	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2444	2628	iexplore.exe	31
PID 2628 wrote to memory of 2444	2628	iexplore.exe	31
PID 2628 wrote to memory of 2444	2628	iexplore.exe	31
PID 2628 wrote to memory of 2444	2628	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c35548d9b1bde4bbd03f1cc980cfe44_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
cadde189e9f8b2ee1f71aac6428450fd

SHA1
c805589269372d9a53bed33f7877a33412b517f1

SHA256
095ced4100b2b86d339e1188dac19357a6d32af129834961cd074eb2f5ca6d9e

SHA512
db91295e0b23ba639424840c15cd23903be6bbe571777a9187d8d1bd28146e6d64f60d3d603b1e2c5ffa7c9ebe8a8e24786e98dc806e425cd2a41b207bf6c42e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd8a73a36ecde0606a194fe7e96b1d55

SHA1
af4c55ec82bf99d7588ae6a8325d8e111a8b7506

SHA256
0a4f6a02aff68f7ca2a9b4f3dcda6ce71186a94ed094333033fb2fe68e1150b7

SHA512
855fb1d68a2652602f1448b2446d85cff58f3ae79229485de9b4469e2fd8d4f4bd44c5c07e51e0c07d599cd2a53881f578b9908a26d5aad8767fb48e9dc3e0cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12266012cb3e168881d2f0917417cce4

SHA1
ce7965463d82aaef35e3f7bc0144dd483457afc1

SHA256
bf414da93236911c436892ef5da81c9d487b785eae938a2b1207e3263896692c

SHA512
77fff42c8eb3efa269900f1773f47e9d37882b60ccf12fee7a50ded8057251cfbbd168715043eb3a1e33d91d8e7f4ecf13ed39ef56d793c73e2c8b463540d4d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13308ffead563ed889e4721b7b6b141d

SHA1
90fcc1899551160b2925481ef96418b9118ca921

SHA256
f0205fa2555e992c3f101e57f3051f9d17cf84e3ebc2366e395252b3df7d2852

SHA512
c7c619add61569a98f43e6c1695ddb3d04f5ffd635b1d75246370f55f6d5437d86561e121502d4760266268c7ea9d2b9113df12e74af9bbe8d14c066949a9604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f7a9a80c8f2ecf50fad48885d989c15

SHA1
7c19d19d009fbfeccdf4327e7a8fdc7dec411d38

SHA256
786a1a9855fc0a98a89ef06c2c76825067dce1b473c41205f8871949d29021e8

SHA512
9b71c5d39f0fdd430a87d59a76ac493b5b1647dc62bc09065acd1c32af4247907533de1260d0b00a68284f4570cb6f65eb98ca5124015627a4f44a8330e3dac9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
506a209fb194e08ee708e24c6ace32ad

SHA1
d215c8d858b6373ca60f020336cf61223f05e50f

SHA256
b87ea5a9810684ab140cb4e3168c0f44567dd6aceaca85ee7c31937c2afdb1cf

SHA512
770e63f9722fccd219cf9c18c39b64e2c7c728c93d730e8015457d0d0b4d2e8199256236c2b5fa63c6b4fdab0cdca115e423262446dd23d40a06c1c3f9b3b4d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d8dbafdd450493a3dc1f1bb13380440

SHA1
343fbbb14d22cd0fd41855cedc066f7dc6d01378

SHA256
a91d1e117b8d4a01f2de3796865af8ffb1713b9167febf346dd58c048cf06ec9

SHA512
da0bbbea640e063a5242eb8b20b94858f9e4200e00b1610b29e58e70b4fe478b000ca27a4ebbb47498d618fb06a5b9993311f8c3c63573a6a221be2293fbbfaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
842cc9db349b1f9f4d1e399a424644a3

SHA1
918a24f44ffe75a013810687e5ad0b0b90663c2c

SHA256
6096ea3eeee03c1566bcc9861408b3e253b3ad3eeccfb74d5cb41cbc9b38a58d

SHA512
d948935759cf4166343b363da69621305d5b5ffcf0a5ba8efd798fec193d443bfb04612088f2fc10372feaa8962c556efbb3ceb0c892f68d1b27b89cf9ec399d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b643206e6c6b68413f2532829ffae8f2

SHA1
334c43e99cd7f1b65a9c79e751c64924b459da8e

SHA256
66078541693782c87519267d76f45391dc236670293939bfc28b668c439048a2

SHA512
aca7506dd2be329bf87bc31fc6e0ae747e1ae087dab9ef1cf3a13072debd6e064a9ef50d1680335b784ad97c2b8016ecc841b999500c17d58dc951ceaaedf5a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab77DF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar80A9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit