444171e7848b6c52908e0830b674a3e15dea615704fdbfaa30e68e900bb8c75e

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a11c1158f6109aaa6ab5174507236c08_JaffaCakes118.html
Size

6KB
MD5

a11c1158f6109aaa6ab5174507236c08
SHA1

f5f4507fcce4af3e44cce0e5380541a77f92b744
SHA256

444171e7848b6c52908e0830b674a3e15dea615704fdbfaa30e68e900bb8c75e
SHA512

fdfa2639e879d5af43234130cee992999dc2ef440b610f8105f64954fc322a6cc431f004f21e834ad33111523cc39e365ee28aec58fb339e51f93fa999093213
SSDEEP

96:uzVs+ux7hqLLY1k9o84d12ef7CSTUHqTcEZ7ru7f:csz7hqAYS/vb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ca4caebb0a98f88cedb6cfb80b7bcc17a689afb7957ba39425d3cac5979398c4000000000e8000000002000020000000430e8e4b0c1a8531a6e4727b5ca27fb4ca70384c29443dacc47f82270dc19db2200000006ba0ebc7e9577fdfa1477ea72bb11023091817493974d001bedd09c025c123064000000079746387be8fa7703479ef0aa0e2e5b8c504cdbe23490405cef392b46b48ff4bafa313fa7d00e763c62e3c583c5d91165a49b9551f450889d46fbf3f24532cfa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000007c88a37a01113035d1aaab9ff9025959bc4ec62c2f937208beadf078b4cdf238000000000e80000000020000200000002288541d27abfe86b0001f5486e0e028c8eb87e6e5f1634ecf5e78b1af7dd95590000000a50d4fed307fa19157b62b31af8efff48e9ea841a191925160cf6799d90d65b8e39cb3fdae37f9ad1e8934f933edb49478b17ba6eb71c9880d677dbf7f91f9f16c9ad2dbd85f417351136008a6e4c7d864a39e6816cbead9b81c0228500f6fab26c7120d24042cf5c1b46b0357b33fbb15369388c04c378a5caa42918d116d796f36d4e97b724916c23ae7bcbcbf7cae40000000e59408c55fb7f99752f01bc133265290b24cc2d088025ccf065aebf64a77aa4e4445b1f3563c063c3f8efebdcf05e887b0b04b489d347d063a16a04294877aef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430028814"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204e106a59f0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{938101F1-5C4C-11EF-8FF0-DAEE53C76889} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2396	1732	iexplore.exe	30
PID 1732 wrote to memory of 2396	1732	iexplore.exe	30
PID 1732 wrote to memory of 2396	1732	iexplore.exe	30
PID 1732 wrote to memory of 2396	1732	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a11c1158f6109aaa6ab5174507236c08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3117e3645a8b3e3c1476ae6b03e8e149

SHA1
9b56efe4e2f8beb30df199c18d4ed76443d79840

SHA256
44e8cd2701b33e1471e4dc366097662d04a31beb6808058b068d2b9531faa1c1

SHA512
81b892a1d8ba1a1d305bc1c7e002c2236e786d51c28d4d2d1ff859500a5fa54f5cbea4b78091fac155886563d11d8abe395c7f8ceb7d7f303006bd32bf39358d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6dc7554c9c725f3736569483d12d152

SHA1
d2a28375349fcf895a293c7a2224a316226084ca

SHA256
c667bb32edaa114b1e61c20f170cbefeff91f705aff20aee9be73d72bbab62ce

SHA512
2e6825c0f57370113ffed2faecd901cd1157d46ab442668b372f546b84dfd473b606ec88673f81bbc2b777508509fb14428672d4d20893e881c72846bed5bfbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7077662f7756fd62152dc611ad0ce6fb

SHA1
7f82b1fc451ad94002424fc99e6fccd7a1373b41

SHA256
32136b1a0b8fe6ace1da4cf42da8a905541f679cd93e39e83070409011a9a733

SHA512
4d47d20173123672cd32a4b8ee36fb0caf15b4259f8335988b2a5d76d1e1a3dbe752ce3dcb8826d62b3a87872743e9fa114d8627d82eebdecd0afd4ea0efb367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55a2084126a7387a3781082129b874b8

SHA1
b365bd6d60fe41730bac83f664ab632f17f4f4f2

SHA256
bf072d87101e39603684b7cf0b109688be1b719e194798c9fd9ac103b8b0224a

SHA512
f748b423ed3fe47c25c61eef9f2be40294b471b92aa002385119fc1b7d469ec8457f7cb86b86e791c964211c9e971aaa70fee94b0370563716dfbef292c41cb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
418b192ad647fe4dd431f37f48328985

SHA1
3044e7ef459cd91ebc0d007a794001419d295764

SHA256
0f007b071e747fbf981c40b8ea3503b9d192de6041e4b7196828e4e96153d704

SHA512
587d5c2849068b3e74b59331413b4c5e0e5f32c18a00ec6fdc93aa87164c456a7ed9af98ef30ab86fa669fdf43fef4ec75deb6c34024868c75a4009a326f7f47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d820e8e4ad38e2c21aede0b6e5341a7

SHA1
213bc1bf7b191eba0f3a5b82e6c6287e319d344f

SHA256
51ed6316e4a48687bf5008eb39b6e61023a5279f109ebb585a2af00d3e387eae

SHA512
c1449b505a2fe7a8eb8527892ffde55529fea79e917c55166a040454bf1a7ca9bf285d30b247e1e4770adeb2951079b2a843a5b7c7d80b9fd8ebc549c7782f11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e8062854530a79d88c048801e0ecd17

SHA1
37a74b46263cf28f1a7eb0409b19567cc674b65e

SHA256
a3951db2523971792b2cbfc96a6871a73779fdc0beabb829e8b923bff4f307c4

SHA512
be4c6df6b029af29b254a194f8762db8898cc4b3db8cdd0a454de4c592592319c7828362f8a31bc7065e38cfd89e5b129658ef6008fc430422ef964a8328cb53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bc50eecab67674bfed720ee1611b83e

SHA1
9d3148dc1c735ebef9803d0e5d374989056d663e

SHA256
d1e8ef599c204426badffe1253fa8bbecf7f67b6a680927194b092cba3540d10

SHA512
b7c8db8e6b2e6cfbf321786c85db716a6befcb6e34d75557727817a9f869b92b18df2f6d8ac8c7bae750ec8f2f280ee4bd82b5a42bcc567188bd5a1b68c23e98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fe09589229b66f72811c77b408cb8f4

SHA1
c00a3556ceac24da6632846f8ff33b9b5d35ce61

SHA256
ecc5b261df21b1aabb398945d1137f186b94986c77fc5b74b084efc8e14d79f6

SHA512
506b1e78c1335cefae71a4b7c6e86a6405aef3caf7114fc5dca43baff08ce919f86c508e848cc3fa5a465a78b831c1a28edb0a232075d08f6b751709a4378327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bee58353c498f1f5241ea16c99611dc

SHA1
638820e2fd2122cf50e5997a2586a42dce0bfa78

SHA256
5287489932ba9d35f04c6292de4fb2dccbb5c031bc9ad33ba195d5661923403f

SHA512
68b8e20633076d9301b569df9ebde3c723c5d5c3e47f4a74e973ae3817429e158168ed50d9815d02d87b179e026857174376cf02b37e5c22b1c9ca116127a83c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
123a67f246f35f9dfc947ac1622692c8

SHA1
03acb37e99218010f7a92d271826370b52aa0361

SHA256
c6ee7f49a0365bc9454d57c1a2e00823ca9e961ed1d32f8f428f2b4bdc6052df

SHA512
e5362870415fb9843a8915de49815d9706a53df0ded772fd96e516afb5aee6caedb3142a25056b4b83939657bf8cdebb155eb1b063a4202cc84fd1866943c9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD911.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDADB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit