c31de3e480f0df9ae9dfa8d89fb2038015f33a6ce6413fe50da903c13cb7d8ad

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 10:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8e633057bc1122ad2ac5c8ab7d62c8d3_JaffaCakes118.html
Size

44KB
MD5

8e633057bc1122ad2ac5c8ab7d62c8d3
SHA1

ccb9fa44b7fd96368d403ba8ebfaa4199e46cc12
SHA256

c31de3e480f0df9ae9dfa8d89fb2038015f33a6ce6413fe50da903c13cb7d8ad
SHA512

08c96ccd3a71b71507507dc94c2c95074fa61a75e1cc8924b66a2364892a55f90eff0926f5395cc408ac6d57f212a4ded699cc8a8116bccbc7a40729dd9a3a01
SSDEEP

768:q9E/UERgH7Jiloy5SeaSSiysxZdj8YwTYZmXkSJhzychBgAcalIl8X9KD1wf8oeU:q9RH7clo9iysxZdj8YwTYIXkSJngAcaZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802d017ca2ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7678F01-5895-11EF-BAC8-6205450442D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000097184f1dfc91de46efb780e3686ef916e317f0c58ac59ad9b8b8bad886f3835a000000000e800000000200002000000097c8604144f1829d207551930fc870a388042324b2cf701606fe44c79ffbde219000000012adb1873071b3327d98d252a13aca9c7ed97dda7aa3c6813a9e4c8e5995bad5e1b693dc4b6a1ffc6ff1294d0b73e4cf66c6d2ecd3847ade0180be6f1b2120a263e1eef924f62ff5c1e21366d25ac98abd07d2c59780a7490358dc46ba1422d5a3c9c23b890293bd5b83d0f023f8a2ba0352b35970127b0b21ce129e5231bd33df266b141ee9059ee620ad274e4314ad40000000eb01248c2ea05453e8df00b8f365580f8452beccaf1453906058155bf477cb396cf8a5ff43e8a651def70214b3397c62884cb81941cd4df1d77bb9f174fd5a8c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429620393"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000016743476e5a99cec640d229455574aa851be583e76d1dcaa2080f1544dcf779c000000000e80000000020000200000003f2ba0ee435e2b4ae4ef8006d75e01069e953e3ca2a2d35a7bb5faae30039fed20000000d4f023fccdc475834c06ed96b37b3779ac1e017661b3408f580c63846d2ade72400000002268f295cb1effd8569ec81c6a906a21633d6334a118f5d40d1e9a7c2e1ca94324f0d51546c11b50d5d53ae6b94852a355dcfd10d0b7ed60487f6827ccafa76e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2336	2504	iexplore.exe	31
PID 2504 wrote to memory of 2336	2504	iexplore.exe	31
PID 2504 wrote to memory of 2336	2504	iexplore.exe	31
PID 2504 wrote to memory of 2336	2504	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e633057bc1122ad2ac5c8ab7d62c8d3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fee38a252b3881330f359d3a17f5f8e6

SHA1
923e5c10d84e382fc50bf254f6b7fef23bd50adc

SHA256
fe170826207acfa1694b4e22eac83196b322912de8d7ace29ddd663c9e2bb6b8

SHA512
1536592a04ebde6d3ee0e4655c9b5e253139d0825746677196850ef2c8a9b87612bd29333e914d422b985c59735d6ef59e76de896463acdff94ad79041c6be45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a00be5c937b505d564c380be9d4e535

SHA1
0589e45fb7511591463af58e7d123e4106d9ccf3

SHA256
e8596a43bd5ccf13408b3dcc7a7e99bc2914c3be31480e07649fbcf914d62962

SHA512
261cd39df60aa483713a957656e5fdef8e611a7cf2aac89f31c5f8ccb391e53acf598e2ad8c28915d8f5bc773c5fe1dd443ae06b67e30a2114730234c6225792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e413a28266c073e65447972407097376

SHA1
8c9ab7cbf863b278dc9b5b4e530eb922e49ce0fb

SHA256
65bd1cd3fb44a8435ea5f02289c9ae0131748a7ee8f7b3f4aca381ecbb7a44f4

SHA512
9eb5198ce4b8e3b33454ceb84c0233cb4d0b3a0a070cb6b405c74bb2453da26fc2201e0de42bb463769bfa9b1e05a762dd0cbc28eefd989385c43f66fe7cda51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17c90f68e518421abc4e2bce0efaa1ac

SHA1
be85ddf1ac8e1751be529d5b7cda39d342d7f53c

SHA256
2b342172d3b8b8c7a8fcfc6520ccd657ee49c3e4763b4861cd1a5c3a153464bb

SHA512
171689eb3438e382114d406a3d5ca14f0895eaf7ba4a4a2be5d0395bd45d793a914795b9ed20c5669b0648fbaa7fa25ec600a3d0a0e246d0018310db4a64ad88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43b36b52b61bff2c716bf80ffa1bd6dc

SHA1
fb0d369bb6e3d96f32c9fe8b2925104867270d9f

SHA256
c482c86635bb33fc1a30f17d2a904c37b7dc0859562a3deaf754b8262bd988cf

SHA512
70cfb3a54a69afa8878e004ef4d360503cfbeff5639f75db5c6a3348fc0201fb7e3937af87217b0fca23edce0bf783d055594c797b1070e4973abce230cf6210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6627bdd12312d3b2b56c53677878b333

SHA1
3c556ecc2556004b35306e4fd3a8dc08b0488c5f

SHA256
7cd4a37db13a159e01a4654fff864b4513159c0f870f7aebbc1752470d880c84

SHA512
0bf2c4027ccf0e8801d2f6d0b8ceb5dd619e63783ddf56b5f557e5f02f69e310de5bd5d9eb2a1cd87b670afdc1db5ae8ef11b34b09f8ceae0ff9df6fdd7a9ba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
159261591a64e67c02046d91609db54b

SHA1
9be4f86f3870073065f9aa51aab1dfd108db27ac

SHA256
a43d290bd77bdff86bbd63379bde7cef447228429f53e6f0c15a673f102295cf

SHA512
816fb673eaa1e2729d382fbb06f80fde8e30d0059cee39a6b9e7f2f03259b5471d27a740dd4f98ea7996efd403a7a7ff6c2de788b61371c9aba579ca96a78eb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30d1d5fc275835bfb87c909223934102

SHA1
7eb986c54f4bb0081536444151372cb049bc0c89

SHA256
1bc2d60872ab516034f51419351068312dfcbfc5b03242596cd64b999a37c164

SHA512
fc22ba9a0653469b7ba28e4ad741cc0458d80369dbf17b58b90329609f4dd1ac154c91e171aff732282ae21eb2c6365e280a362f8c53b5d7090079935f854906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd17e20a7d5d4c7fd78d2a053b1acf6f

SHA1
d2e3687ddd9ec6df8de52b241d35b251755878c5

SHA256
45c661c9f48adc9de1a06ee6cab1782b9c8aafea57302c40a2bae2cf4442c4c3

SHA512
c81ed954c892b5b3940d734b96a17aff05450d1f495bd39860d24d44914377c14131602919987deb5bfa900c644b3b86379a531c97dd5f961bd52d4deac0d02c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78aa5fa2a85a33efb646300a0556ec64

SHA1
c7ac252480a24ede3f21da57e7b109878d8ada63

SHA256
09d7c0f90d9496bfd7b5241bd4c90f4a65fde27002197ad894a8d9fc4f288832

SHA512
d3277a14ec090c0d1bc83cc4fd2455836e4d1f22887f677b1daaa00f3f6d6f1d32c3589d02ad6353b5434f849e55814d179025289100cf8fbb15ce7f76a8b217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
955c49e2ddf601cdc27535407c96b810

SHA1
d277555a971c69efdb21facc6180a2a9d47b02eb

SHA256
0644eb621ed255536a6d04b2d40c6e01014d785ab684ae3048cbc9920f8d95d0

SHA512
0d7c557cf13608a670c768accf2b1e35426ea060b20b992b27d531cefefccba83dbb73fdd3e61177fe99d36b90a865255e5dc1da0aad81d4a1c3714217b41d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF01C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0EB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit