49152f6194931977dd25aaaa6464ddf3a4d9ccbfae08fd8104cf7843b0265b99

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bae711e8ab7fde7248e0b3cb735725bb_JaffaCakes118.html
Size

9KB
MD5

bae711e8ab7fde7248e0b3cb735725bb
SHA1

a5e93c1afdcfbe619b7ab13b8dbd3fcd27926b34
SHA256

49152f6194931977dd25aaaa6464ddf3a4d9ccbfae08fd8104cf7843b0265b99
SHA512

47d502cbfe3640b963a94e3a5b26cb81a1ba5fa631ee89fbcab9907a436055c1ddae9884d9f332426f55b1086873ab4ccc2e886575c171e4c4ed92f06303e5b4
SSDEEP

96:uzVs+ux7PILLY1k9o84d12ef7CSTUpGT/kPs9pUlVHcEZ7ru7f:csz7PIAYS/gaUPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000a190fc611f6e6f7842d51ec71e87d6bdb665ba1038f70275117b6a425f018d3f000000000e8000000002000020000000ab91c67c6e5add30b9b990803bb5514762f1e73dd3a69e3fd336c4ddbf0c8bde9000000053609e0838f6fea21f19bc6386ff333c6f52ec782873ebe6de6a7cb97e3333ace3ff5348ae546c1ae0ea4cfa3b1736493e1b7695852236c72695117ca823a683b46120f6d8ca675eb53901df73f3ef750efe6ad974e8f5bbb87ec4f040ed868187751d8c99c04530d57f82b6b1e600cfb23d367468d191913f4497597f6791bc1278c9d55f4407f2158223c06bd55b1240000000fe5c7d70a9872ae3a172bc9fae80c6c81adaf1e5c185e196b014d5cbe0641ea62ad4ce029be666f7bd364e1c07ae148a8a4d10dbb56b4bf43cf0807b4e6b5aff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000003104b2e5258d5dad82f5b3d049437209285acdac1bf06cea76071c39d600a0bb000000000e80000000020000200000004969dc41fcccc937c217b5538ba30ef19c9757174666798255a2dcb903b7925d200000005fbf0612b8123bc83d903bad4f81dbbd72a4fc59f51f82c29899d61864c151ae40000000d8d407c7bd877d1e1135f429f60046654a12e765d986ac62af254be3c4789bbedc8c96a1c16e0bd070ee41af7ebe30ebf50682e9a1cbee19ca12841c9eef603c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430561398"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A0DCF81-6124-11EF-BF23-EE33E2B06AA8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40169a7031f5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe
696	IEXPLORE.EXE
696	IEXPLORE.EXE
696	IEXPLORE.EXE
696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 696	2580	iexplore.exe	30
PID 2580 wrote to memory of 696	2580	iexplore.exe	30
PID 2580 wrote to memory of 696	2580	iexplore.exe	30
PID 2580 wrote to memory of 696	2580	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bae711e8ab7fde7248e0b3cb735725bb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e43f879dbc41c7f2bf96109f70cbc57d

SHA1
397d197e051429badba87a144e1d2fcc5c5c39b0

SHA256
861ef0acab3f0834df68a68e89ee6e7c313135c58a18fc12902ee2e332be8603

SHA512
667235ec138f568897496c2b806d968085341aeb4f134df38b89bdd271728c10098b736eda932307294421549764da84539573ea89d85ac4f431898f1a0386f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abac461e29c02aecbe6282ac0fcb3a5f

SHA1
6c0297a9f67553eaaa90ff4f06ad2328942a13bd

SHA256
8a3d67aedbf0715e7fb8b5222f32785b2cfb766da942f9ee9307d76d99871cd4

SHA512
9ab940b83c6710f9f8fa04f31efe23ca251124228e30142f0c19bb2cc2ab489032c128865034e2ab762b9a3d9cdf6229b8f1b624664f203d51915da4bc34fd97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
233d39ebf52eae5896030edfec97eca0

SHA1
75832aae07aea2f922989612dc2b9b2f94e3c862

SHA256
f70c74a2b726c6c96b43e035cf256ffda468326c1fe30c393fc3d7491c43c038

SHA512
0405bcecab0a0fd7d7fa70fc8418a0e66988ecfb1d86a0e4417ead8d526bfee8a478679ddccb4cf092873ef909d1b358ab8b6384357cff4bfc56b4b7a8e670a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
771eebaef3586f83e308f1bff5b05f19

SHA1
549ceb524606d439e75780ede4a0a46a52c3e6f2

SHA256
16ab96111ef3d708b662b55c4a6c9175efa9b255ba560ac8527ea34bca263a60

SHA512
d76d52b143b3a6695b7fe470c7f6852b9e94633dba2d10c4557dd78eb35ffcb285cff17810c37b4dd365687d10b9ecc1c6021bee1883b4a27f58e08b7e17bafe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
720ffc790fd0b6b54e386272248315bb

SHA1
89d841bf7413835d3913e8587e2131adff9f0499

SHA256
807e0573d8aed1d7f7f44dbbf0bb505dcebd67065f83badc89b8f344ef86cd71

SHA512
55e1add9ceabe4682f9e1cb1f5c370e39b89fc77fa7364b74662d54be3977222e473de4f13119a5adafc508de91aceb0b6ed8af6c1ea23adb7e65abc49391fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e86550515293658dc9dd1c52c968e334

SHA1
e4a3ec18b937d8ef1e235956f6fe91a2797fc00b

SHA256
fdcb3deabcaff8c4c319f77d6d1a95a72fe336da1195828b0324c679118f273f

SHA512
ac2b03343eeea96b54f869556fe2083fbc41101d4928f15ccccf713cb9762309d9a26e5e77baaa88377778a41ce92f67ff07b7ec729080f5634f0a5d8a3fc9b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b3918386b9a2aa2bca8fd565a1b5fff

SHA1
6aac04ee8d92513a81c58c0942675d0befae2023

SHA256
4d48123172f1435ae4f8e10b9fa5505ad7ace310abae3c3b16b92a88fe572dc9

SHA512
32c8aa3d34bf0789a59f28f367b1a9f0d19601d3023dce919e753f2d3ceb452b8a205f08f1537d2c098c1427b242c3cae0368368f3f6dcf0c39a0afbfa2fcc8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9145cab3025b8580d334f4ee1a019066

SHA1
c396340b8bdbc9f94d9b97df1055b86ed9544366

SHA256
7d9f5631811b509e4042b202872ef7c261ea560db08973d2719d7464c47cfe0f

SHA512
e2b9c6d5463b5fce8026a20fb0999adf98cb36db2a571423ade5c81e76f387979ac78451162f08989b571453f4d2c3a0df888827385c6c46a3d660974b74f454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aa0a9c1a0048cdd508674b404fb9719

SHA1
438fb8dd5f9e991a985e2bc048a663d2ab159a75

SHA256
b355e56e712c27c96f68df3ea57f8cd7a15e129f35b56a62f79b11fc2096be6c

SHA512
d4835c88b684100e8e5c2b934619aa34342eb6d384866fe5250ce01c6c236cf0fa570615a49d575eb17ebe6776d9adfee9cde7a4fde3a01a7231d5536fe82a7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE9D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit