fa35a49aa56fb43223140efe1f1208b443714b35714ee5f7494584ad0f96a961

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

896b69492d67b4f3b2a76bdd6701d5f3_JaffaCakes118.html
Size

20KB
MD5

896b69492d67b4f3b2a76bdd6701d5f3
SHA1

85965db5913e7a53aec63dd57d23cd501adc4897
SHA256

fa35a49aa56fb43223140efe1f1208b443714b35714ee5f7494584ad0f96a961
SHA512

125e12b6fab60b06386fd93927b5eb4eb107c5b4752f7963af76f88440bfc2c57f62a60240ea87bb4fb52d9e70ed06324e5a4ba65c6a50dd8284ad83c1134481
SSDEEP

384:EI7EZUvwbuKpXwjr3pSaSciCd5MuWs+ZFRWbzCLCCuEAmuPlFLTOmnKw:EhgQExWe0C/RKw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000000a0bc88303220609515577a050be6cbff6dde55086b4b5f862f487c8c5ecf21f000000000e800000000200002000000096d7ce05483dcd5c3a13c21cc2945ac09fca71c7cc5205bf63d9c8547ae6912c200000007d93c044b08107942c783ff504adedd7e97527d027e9210200317ac321ff4dc04000000053e622236233e74a8c04f26fb30cd021e04c225409936c8497312ee595c811149f7c9103bff59956829afefc5e1feeddab544ca24030bb3d61fc4253fe0baea6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bb8399bbebda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000219389f0d64399c95432c1f95e73c37966a5c61b50d025941b88d1dca9160dfc000000000e800000000200002000000058a1fba70be3a55d99a0d0a3b7aa89f9df2dc3f379c7d6e0bbf943ee91a3852c90000000493c754668b7a3cf844b5ff589f7fc579ea3b23a83253b5fb958204967142093e858b4faa28b1d9e85de4d5db374e53abfc0b25e442341e22151977cd9fccd2e5e2de3fa479d619408c845e71eed10c493030aa21d0dab69287167c82f0aac0eeb226faff1d3f3204daa67df84a17d1ab777c4fa7ace48731cff4f013eb6a6eeaf7fb48dd6a09c99d170f6fbe81f215f40000000f46088ec0180d1844f69b2b4762061ce4bccf3007f711a2d8e38c0a0bdd1bc4cc4f09b4285de103fcade606879638bcd4ffdd083ab6b45691e66230b93af6e23	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C335D5D1-57AE-11EF-8FF0-DAEE53C76889} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429521225"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2540	1928	iexplore.exe	30
PID 1928 wrote to memory of 2540	1928	iexplore.exe	30
PID 1928 wrote to memory of 2540	1928	iexplore.exe	30
PID 1928 wrote to memory of 2540	1928	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\896b69492d67b4f3b2a76bdd6701d5f3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
843bea6bdeed0d3be7fc708a27e520c6

SHA1
6041ff56b084b615f312fd597576f76aaf191bca

SHA256
1142f018d9c684de7e1025dcadb191ecd646c3c3eb1e1c3bac4e31461d6e4fdb

SHA512
2fc2164d18600da84ca8e3f401357694287ae20ff14a42edf391cbf105fb06c8a332f7e15239aaef0da6f287a43c9f3bb191cfaa20b4f02d3582bf443c0a1024

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
223e46246424ea35090ce5ba1c2d638a

SHA1
46ce253621c2375ec21ebe0b35b95eb556c17a72

SHA256
04653124350d380f8ca7e9af3f7a16e3cd36616ba584e7ba015feb1b959c8e04

SHA512
ff5b47aac4d2c288fdc54d001cc2478fe9140fc1a1045d99a0f6b6761639181c9660897c7b55f5e6ebab09632238b05b03acf473f828f9b149c0a652d9300dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55f03878383caaa4623c775954530dce

SHA1
0a655ae3704b7a720c200c15788bae8cab74f8a1

SHA256
f94726d0583d1d4d5f38af39fcbe7d4f171327e981c7792e0c5f0aafa41aa9c9

SHA512
9f342ceecfe9d98406595899b014ae90b3cef9a9fa662e166ed7aab6d1b1f6f27fdefd7043bf081da339027710ff388a63877355298a5a833fa8dfb201e57334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce8a751ce9cbe343475129891154a9d3

SHA1
e7138a9435ad32aef8cb619c80a3c9c2c5aa23f0

SHA256
ef948abc922b1d167ebe67ff8ca865710f7c3d03537030efb102a8832217cc1f

SHA512
f49fb0f7681a9f5998353258830a7cc9dfd16ccb98850d89d5cc5b526e23a0b09cd0d56ea11034932c597078e056a16ccb1f3e765ffcb2a0760b3005c5c74c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a1d1bbb8250b773c772b902e1d32a4a

SHA1
d2aa8671ce9f6b851599b8bfa7da0fb4f859597f

SHA256
06a1453937b05be404d593ed80581926eb6fd5e333013ad40e80742686db6cc9

SHA512
6a4032fe6dfa4aa2be31405e8e1873a2f65bc22799a94013abc0db2e34280d0b11ca98c37153f1bd41b48d285790b1311fc86b3f9f70dc626bf6874fcadd4094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0426e3c1bca54607eeb026b935089973

SHA1
978971b20adfeae3a30b6e5d3e9825129a80151b

SHA256
e482c2cc49c601501e64c02ae26a05b48466e21d9c1b8a00c7d1d33fa23e5d5e

SHA512
51919bcc26da64316bebac46a5f639cad1889a6ab7192c54a89bb64beed8099f5dd7713d0e45c93531826ea023eb47d8afbd7034f85b7d339831d112e00e7943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23f692c5f1c2db2f41eadf2c1098f8d0

SHA1
af474f5c31db0b9b836bb3c15f604052cb946bba

SHA256
35a85a483f3abc52dd382d3d2992d012ffe8f0d7610aab5acffadb7359b24ae3

SHA512
575d2072c3d441f09c9e8ca9e3025a6bc5b877dfe90b0bfc533b41dd84d124bd62892d4b31be8e45911f172481cd1e4c24c3a015e25a095ca592bde2abaf8f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22499b29eb99b3050fb1c81555671a64

SHA1
22d4c89e9de8dfc4a3a36209f72e31429bfc5108

SHA256
ce870b8f6cc43cd91a9ff0ca7298b19b7459d2269ab6beb36566b99d9cdf6ef2

SHA512
b406c97d26a6e0ce9df6097a7c32e943e9d0d79ed5f464e9447dc2e1d3cf34b598c403aadddd0a8e846844accf4a9e12457e82617d8019061380207afa911010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b562a84d6f10f04420cb52ec7cfb8735

SHA1
91edd65c5eefcb42c7ebe7fef0b7b8a605f43a25

SHA256
2fd12bb9a1ca50629d55fdb8b866d4424acde6fc4f7a6ce6add1e1221aedb0cb

SHA512
bc4d40fe7edbea2221fa3df1bc50c42c01ee85e17afb2e491df031e423c086ff18ac8537d6415349844fdbb8936e7e01c38ddeae56f039f693ae9ba15040198f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b335d775ca146a8e5f6ea292e828f901

SHA1
ffa29a31cdeb961ccfc6c11a7325a44637169f2a

SHA256
530f5f9819eead4a870075bc41d3de311265c7263fb36e3737a56f26c6c99df9

SHA512
0947b29de18cbefd05ff09ee4c06142ae47fe44bd9f0c7c0236b612465d4d30f13b905e4a5402ce011cc964f7531167e29f26873c5f78e62e051e88303829dde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a82b9a61b535eeaaee6305a9d011fbc6

SHA1
c8d38405e61703840acbdd90b6af68805531754d

SHA256
019b7e6ad2c7aca1bd87cb1e89497ad3aa380f9d84d8913c92f0ee88a36a5e68

SHA512
c0ef8b4032f3bffe9a11183c074c86becef517e2c829b1b06ab59a715d059c29481842a2dfdcac7a6cd62cae59825cce74ccbeb377d86469004b75304b53bd07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
092189b3e50773bc0d9ee9d9eb920ec2

SHA1
076b38b219dff50c0f42272acadad251d397f60f

SHA256
68d0ea892921d4b1dfd550ef48e98070a3fed62134c8a700eecd9afeec7d8aaf

SHA512
56719c93e14a03d36750aeb0e3fd7db2f42dbf08292a1f09c9b4b2266c82d6e75cb7b4ea9b806abf9ca5e2a0476d7e31071a436485cd44a50980e3f3a914ab94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12d5e079fea733e7079a616829af0869

SHA1
c6edc8aeae055817714bbe0261e0f8afb40cb44b

SHA256
2dbf02143d10eaa2f0cf3c8513da8b264fae8a9e8c6d48b89205d628053d33ac

SHA512
c6702075c9b84fb48b27d8f384e23c8465ee7cd65d586ec0f55fdd8718d5a031da0711ffb229e0fb27a1c180a93c8fe07b2f611c58c83138a022e304b7a6c748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad2a52205ac49b26b19236c5a1edd606

SHA1
92d62a111a1eb2b0bfcc6c0cb9d496febbe5082d

SHA256
78838b54d73a6f4129c3e5f8b2cfeec34ecb8a1db9a39f207d5b48a511a0b38d

SHA512
9989dc73e946043dd8168e8d1fe12c31ec6e5a4ca1e14bd3c5fc1ba3d5311cf11c5cb563b84552b54ece2f3439c0fb28541bf037ba62505a5259d1fb88747681

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE40B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE873.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit