44b629c8407a30ebb2edb38b679fa091c868ea9fbf50b99d2e65d2c6c41a231e

Analysis

max time kernel
133s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 23:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c727f31d282f3976803e0834eea0bf4_JaffaCakes118.html
Size

53KB
MD5

8c727f31d282f3976803e0834eea0bf4
SHA1

d11095249e0d3931af1281771bf7db11b48d8172
SHA256

44b629c8407a30ebb2edb38b679fa091c868ea9fbf50b99d2e65d2c6c41a231e
SHA512

a7e2d778b04747f6f07e341d66e68566c83cf6b660f7bac3fb22e284ff930e487785bd0e5dbb03df71ff387e900b53c2aabda515d39b017683098dbc92bb95a7
SSDEEP

1536:CkgUiIakTqGivi+PyU2runlYC63Nj+q5VyvR0w2AzTICbb7of/t9M/dNwIUTDmDe:CkgUiIakTqGivi+PyU2runlYC63Nj+qN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000005716acd187c72cfd9b7c8532672b219b85775b8c204975aa697590437453c207000000000e8000000002000020000000605e5780370b4c798d0c65368ade98968558f54dc6a8caab8f02a83b372da078200000005ed25fdaeb3d22afd76706fa46c1cd57266690b9cd50ac3d0c25436b226cc4124000000063a06dff4eadcefe11dc0a12a751338b13e9b54a88400fea7e088c614a83625c5528b9090ba57f1482376f87329f20d32e4411f843307bcbbb519c933abfb493	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000002ea2b3bd21374c00ce5b74530eb241f921b2efcfd288477b20014bb3f0bbe388000000000e800000000200002000000048348a26697088e718b94a3f765b63cbe765def1f6236e3e8f57e3908a55988e90000000b03c8bed7ecae2663535d74a26a883e971ec3e73b11a80d94fc22553cc4582de9b38a262c9560f8ea36aacc4e0890ca9bdb92e34ba8a9b9622170ceeb4ea6ee44a54986b638e95574a66e3a6e8a1bf956dc0ffdbdb8a3ef8ec1bc5ec865d01293c1359a543f763347a28a456809d00a1b24bd5fd3c42a17166ff57c9fa6d78576b1da6118618cea0c7ac9edd9128066840000000333f46ded4ce98215e31cc76b642c1ce509ddaf6125f593ae55c2f1dcb8a9da192207fd5f13911ecb1a78155cbb38a097175d12f934923975463c2fc72bb25ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DAC473F1-583A-11EF-A248-D2C9064578DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bd0ec247ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429581394"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1008	iexplore.exe
1008	iexplore.exe
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE
1504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1504	1008	iexplore.exe	31
PID 1008 wrote to memory of 1504	1008	iexplore.exe	31
PID 1008 wrote to memory of 1504	1008	iexplore.exe	31
PID 1008 wrote to memory of 1504	1008	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c727f31d282f3976803e0834eea0bf4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1008 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2528b56050e7333dcfdc8c0078daef2c

SHA1
7c6ac65f6f9f6e754c2a9c20e5b37d42a585136e

SHA256
cb262c00b8d53564cda2e209821141d2f347cc40083edbcb13bf27b89b72277d

SHA512
0f79d576a96680c1a12c2c1f9f0a958dff9a5623f261224523f02f2ccc7eccc34465e1490cdd13dfd3af8ae7308da40b67f7721718123f5bedc9e13e1aed6bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27c94100de7cdcccf3d5ccd7cfb48c4b

SHA1
6dbff0f6b04734d1c4c08526de9f567fac7e7609

SHA256
786be71b79d10c09fe16ee1199e06076e934f5eede4ff08abcf71fc857a43b98

SHA512
46d32ec9abe647e17c46ed48a3d692de97796ca05aa724a98f9c2bba998275b4639b9011f0f4e66875cb4caea27411573b7149a9e4b90cf0a12843bc684ea202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1def0f1f3cbff3651c97d023667be30

SHA1
59e4fe04a708b8baf8ec6a1ab0f8156bf2edac90

SHA256
7ae8a2971d1d083f1afed2a8ea4eb477684e44d7cb4ca78e4e3071611a3146c8

SHA512
d1416b36ec849ceec83ced7a2bf262c68631e2517492402f6ebf3bee5556c586ca36ff47ab81b5b0b65c3ad0d85fd5af6b2fc953c5cd78c0d2322abe0bd81262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48faa362e061aa4f3db89e0909df1d8a

SHA1
487e5a239672abb69f4590b338cfe15a07789d53

SHA256
877aa8bb3c678fe8cc8ce954b68576db03a9164c9c4ad2d032b9043c14be8e2d

SHA512
7056918f55f6c99841c85e3cb4e8ced0ae1ce3247451d512f79660576328fc6c7434291d8275d1f397c7f920ce04b00274aed00896da71c3cf38ad61d38f4fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
024e86eb1eb21d546143c73c61744239

SHA1
f88dbea3f29c25c0261415deb8f044925b6550b8

SHA256
24c2daff38c93ca141ff8d428be7bf1c51cdb2596b5459ad6fbd6dd9258ae71f

SHA512
c53d96a76f23192bbd6a7c8f5a7d147a78ffec20e1b1a37f278e05206521a8e98402467306bec67a62100a3257144f0ad94b605b9e53040fd88e04ef279885e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81b62844115636ee19d27eee35506952

SHA1
72ca4181c8053634678929f46295ade551bd423a

SHA256
f7132733ed398a3ded5006736db5c6f556edc25ba42a8f4670c8bc69a0e06cb5

SHA512
c7f2fd1fae7f88999a3e591a6f80fdc4455e5c5ac45510fc01e6bfa38856d8b26c462ed6e5fc4ccc3c9b0b11ac631c4e15a73d5065a65d324ee9885388cf1c9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c566c402b45b1421be62bffa9b179f11

SHA1
d8c0b3a1eb413ac1cab59ea4d4d1803d3ad23041

SHA256
53e31b8df18424e2920766eb29dab155ca1701faf43fc54bfab2f84a5fc485db

SHA512
c8dfe1e9a8bd23569d297146511ce8fea963b3825ad6c64d4b438c80ca02b59aeb550a9eeef8e56d71e5bbb5ff287ccb5491cd9ea953e996183cf4ddace8eb4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e547720031669ede45e871891d13cbc5

SHA1
ba36b3f377bc35d1a1284b26fd3e7e2a5517c6fa

SHA256
f996a0653ded433fad5095b2cdfd89baf44633e8831053c343d23070c72e9ebc

SHA512
caea77b8388ba49b071b30449b3fd68a8be9bae700a9532a8f4ff1daae88b23a5aeae7d5ab38bf30a9ca79ee778ebb1b0ca832afaca59d571a50e66d326380e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7848ca066010430461dfa89d0d752634

SHA1
f4cb593fb4213a396933dd9c5b9c4835dc52ec86

SHA256
6ac06962f320274928b1356363b1ecc9abce3ba4fa810444cf0e5697fb4ded0d

SHA512
2c0c498daf64a7f21b4e201c0f5d9b5f7b2844900bf8c5fde62c727cd0b3e7e69f2a38c57e8963500fd608a39d58b1632362eba1d3e181d3703f06153305654d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
319444967ddbfa72a9e50edbcae3fb16

SHA1
a830f051c6cd2dd5dc7cabdb7189b5cda196898b

SHA256
dbcb3d11911f906aacfa0df40906f499c29f80aff6bf321d6308c1bdf3def02c

SHA512
36f414f3c84842ed8341c932842b66895338a8cc4f8ea79f7f1f93314249e253f891c1088efbd012c7b93c38a32767b7fbc5d07f7beec5612eeb8dabe5d713e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bcc48493913d82b59c0bb2537075214

SHA1
a6fb8303d321c9a6bffc3ab8ac93535aff2a957a

SHA256
072827e39441b14a92143c80b576450fd7228bd789a7cd5cc5e0424877e0a69a

SHA512
75275c49e32a353dbb238487d5e731863e8c9af57f85fd9de29665db618b8ff083fcdbbe765802152e8d83740af1e2f5d26c712206bc64788afad8fe2e52eca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2925dd5f0f86d069e448ec9da1e5c099

SHA1
a3399a38c4568906473b8141c2815a0e1cc7233e

SHA256
7285c8ba6c48c176606c7c241f9e9a30f1ed1ca43c87b2f98b398d591fbcab5a

SHA512
8f831575c76082a6a1c4923a5df9e3297dabece1492803695af8657eda8dd8468a6ae5dccbba10db1d232a803741eed3e4dd79ec7d8774e267540300c0f78722

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a91c644c502d5763142a601edfa194a2

SHA1
90f3c6745191ff41933773def6cad6f94bd95eb3

SHA256
59705ae27f7001ae0f136b063aef05a82b6162b561a01b8a81b76070534692c5

SHA512
c7ec93de90b282505f4335f4991bb455eeb80ac3bdf4a2fa576b9daf9a0b3b18b26f048e21a75f018ea24cc11ddd138beca281cfaca036f25342205efbe27083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\normal_post[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab60E8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6187.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit