49c653b28a41e602e5090f4fc549389665738e7cf76e3a32948dab036f6fd857

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8de3c366795bd0310bee89aa3d437d15_JaffaCakes118.html
Size

57KB
MD5

8de3c366795bd0310bee89aa3d437d15
SHA1

9331e6b82faf6d640cd8bc7f5565c0d27f5837fb
SHA256

49c653b28a41e602e5090f4fc549389665738e7cf76e3a32948dab036f6fd857
SHA512

f1fbdb5456574bf60762dc692fdbd88b87b09f294b1d1dcd9845c542132acc1cb56c946727dacaffe6a6fe34ad0ccea38354d7437cb99c80841f64af4b05f9d1
SSDEEP

1536:ijEQvK8OPHdFAHo2vgyHJv0owbd6zKD6CDK2RVroTswpDK2RVy:ijnOPHdFT2vgyHJutDK2RVroTswpDK2m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429610422"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000fec65f0ac93b3746c1df5378868670a54e0d8bcaf8a7274c386260471a6cc3cd000000000e8000000002000020000000b0ae3b7f9339c3ee99d53734d5c49886604fcf4056df91fa0d516ca9ac0960f6200000006e85beb7249179d170f355231f32178cbc73c4f70183174d21705b929943780e40000000dfd74ef9d6fcb3f7b9d1a3fc8a607fcad71df32d125bd1481cc5c1ff01471464e630b6a16c4e90314110470cff55b74a86099fbc374a1f575b6503bfc4d12f77	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03bad498becda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D3E0781-587E-11EF-8CC8-424588269AE0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000fbb159735f87e3fc96946f7480602a18beb10e8f4b0a5e27bc96d5551c84dbd0000000000e8000000002000020000000a857fcd0dec32eb5eac54ee59660f7cabe08cd373d16a20d4ad465f189272ebf900000005e2c7ed2b38171d3b7601fc6411963ead7861d733f50a6dfac3e0f594330542db4da9f84975433ff96bfd950af297e982a4d59f6a32429718b2c5aee17f0f61eb934a0d64a267acf97e79bfd0977f4900d913f941b2c701bcc49ca61a05a2de49e5a1ff5ac2e04a293cbad630e98a2f9144cef1c3d3c641ae905dd0d46fbbe9e917dac98a7e6a5ae8af496ce367f6801400000005e9805bd9311cff23b1f698dd24d2ed632d59ccf995e4e734545da0c2958da0dcd7210e921b0dbb559a5a8065947b9276713469de2de895ff20c9b867fab1b88	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2900	2236	iexplore.exe	30
PID 2236 wrote to memory of 2900	2236	iexplore.exe	30
PID 2236 wrote to memory of 2900	2236	iexplore.exe	30
PID 2236 wrote to memory of 2900	2236	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8de3c366795bd0310bee89aa3d437d15_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ad38ac997e7d5be19e79879215279441

SHA1
59232e8a47929d8a644b8a601e5b8621cc532286

SHA256
e06a8318aac95baaf01a2c78511acb46abea0ef3f3a6b099d708d2f42ac851e1

SHA512
4ea7a87a6adf9179d76209139b03fef1a034abead045e134696a647e9fd518e8a035fd27d447ddc9a65dbd38ae46e81177e712dbacde4842f73b159a5da47380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3dafb9d9473522a78fa37eca284a9d2

SHA1
e2efb66b73b4bd4f822bd48289ed6114a4a0470e

SHA256
89fac504dfad032b8a7311e917c841ad407998c4523b1913c58288981264d048

SHA512
ab435c42c01a267d30f192f0aeb677b97e0ebe7ac8bd07b7d7c6364ca9d32fb1316d868062fb7b6ac6259903c2d5b12ecfa4592117b6a8504addf8f3751c92d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf23971f2e01eec3407dcd75e598784c

SHA1
33a8d50bccc17780566a9f1c4acfe054d5918f98

SHA256
8619cdacb457afb486987402b35b399f010f313126406048120eecb7ce67d106

SHA512
ddfd2cd9630dfc06e8b96e274c9734cd9745bbf6c3e6fa585a337b1fe085b4f35505d0b430bb64fba005c3be2028212abe423db4aa83d7ad22db6c95e825f8bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c4520faed7f472cda497e8ed4fa4129

SHA1
fb48ea97e57bff3d56fbf7aa14f21028e7bd95fc

SHA256
5b2bd50359f567920e88b024124acf848e4cc69ac37819c7baac59e778c1f5f6

SHA512
cf6a97559ab9b3e99081e2095b8412e2bd22cd5c967bb96ae19b52ab0a80312b84e687a1aca9692dbdb5db2a25c3d5fba4e9b8d8f9d5721b98b4ae99e0efd8c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5027d601c7642b534a9a6e4ec9fd209

SHA1
7f0538f48a92274421d41e886041cc7dc069d7b8

SHA256
9350a0ed0a4654385c74d337a2fe646d281a7fb5bc492b499e0d0b54fc9f2a4a

SHA512
a4f1621e5df2c783a50ed02534abce56bf7d22b28f8fb83f81a89be2d1d0cb2db83cc857ff3cb93b7ce7a727412e3bbc180120438d9b4ee3ecab844bcaacbe1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
615787b4ac2a86693ece7fa3b2b1a3be

SHA1
aaaa00c5e1a1953d4bfc463d4ba4e85184e9acbc

SHA256
f8f3076d065f9a23ba505b17282e9efdfdd49df5ab53a856c12ff9e5a7d4fd7e

SHA512
90c9f81155387367b496c40df8979085eb90b35d5aea1ce715483a2f434fcd84eaa49847bff36b1dd6cbfe3bb6370b04f3c45ea505100dd7a50b617dcc7e2033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
916688d784c9237582ce2e65980820fc

SHA1
db5754b9a081bfebc9b86ae7e39f18d99ce96fd7

SHA256
9fb783135e6f418874f44589eedc565e023b925ec8736e9e3a21f5b5c03758df

SHA512
e416b74d997bbe29083539aef72dae992653c5fd179ef275001555fe85aece07c3b7830a02d0bad5bdcdc41871a62165b2d25ff23483a0654c1cdd5de8ed9839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9cd0f7faf9d24531036a3c82e92c523

SHA1
5e8f26fe76faa5f86fee5726531a48c7db6b04d0

SHA256
ce95fca149326f9c9fa16463c34c0b7104ab3c31dd09b8fc0aaf398e8e00d4f9

SHA512
bc47ff5b9bd909d76a640fd4a0ec54ed8870ef32f42ad0e73d8b6b77de6f0077b2ed47c98517f8c7a7de58c834b80476746f3f5992c5cc97f7c604b55b61ee32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fbe694f1877bb2a81bdf68787cdab78

SHA1
0b03ae7f8d51baf02cea797689fa7f2d73a581d0

SHA256
c83503971ea7b0c6c2134b5f931b31b3b976a9932c780a5020e3a26beff3fe69

SHA512
32521eff131cda8d8d5c39b5b993d9b951f10736161aa34726d5121d562fa4b86b4124ec95075a0671bc58e292040037595a56c92462f1e7423ab9ceeef0dcf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
921186b9b0446b9fb94d47be1be24ce4

SHA1
9a3e5e0aaae470024bdd9b772cea2dcdf7755976

SHA256
e929826cc91eeba211bc473e88cc040748dde18985cd4d3bea62e48b91bc1847

SHA512
e0f482a21f56c0646fc4ec8ec96e6b29753cd3202501a0a7ef54301513380150243ea66c40e13b9779428f5cd704e3298e189d7ab707d07c27b3e8dfc72604ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edcc0525ffd8c5ae33bf139d7455a2f8

SHA1
4541ab2fda2d91df4b92728cdc569e52c1107e11

SHA256
7aa52a112b4ed4c25952f183f9ac7c6b7a500f899cca6405dccd9315192426f3

SHA512
ba6ce33c6512a717f5918709d33983e7968b819ac23751ef4c58c24e9ac4e01ec2bf603384ef47758784c3805aea47ef0ae4fdf3690621a5d141446019cfb0de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f974782cb20cf1b40709f0fc9534a50f

SHA1
086a8a2f60880136cb1b65265cce30ab6bcdff98

SHA256
165e76a91f383711a89567dadcc7d5b0e6d9cc0697214abaa552670c76aa841f

SHA512
47bacba9ea1c4de619ced3e2cb88672a371cacb40932f96c699919061635db1e6f336a359fb46f004864f5eb024f67737a36aff96ece514f3a732a896467e494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7b86db7106c412e08522406ae6fae014

SHA1
170dfaa2e948eb515b77a81983a1b788e566b465

SHA256
76b8dcd9623f324083976a88cd3b2e629b750473f768243936ec8d0703da3cf6

SHA512
aacc8663326379e480778b51a6bc4fe2d3fe8e65b36f6694f51607a667cbed3cf1a6179328e390e9532d0bb04b81c822e1209c3ab4db1f3faee067058c0f30e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\f[1].txt

Filesize
39KB

MD5
1bb37be24b164d73ed3b8b3a2be5e2e1

SHA1
ded3b6110bc805eb586fe864cbd4d65cb796351e

SHA256
b4f9c0f5e9e14c3f09773a882fea43ab897a63b25788108dcd28613361da7114

SHA512
2fd677e334363629d18cdcfe877582a039760157428ca433f452dc2c4c6dd16f07308ecec720b1b993d7298bdf6b2cfb8214c90bb64524a876e97473d1fef6f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab61C1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61D4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit