b9713aee84650a8c9e93a5c4ead6d438d9f55c4e0321e7ad0d06c5bb251f0645

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db6044216b52d69f7bab19339bf6729b_JaffaCakes118.html
Size

4KB
MD5

db6044216b52d69f7bab19339bf6729b
SHA1

c2db7b2d91c0b68043683c9c0660f87bacdafe49
SHA256

b9713aee84650a8c9e93a5c4ead6d438d9f55c4e0321e7ad0d06c5bb251f0645
SHA512

796c0febecaa49a8d7e925b23b4238e14281db78122f8ab895379d18263bf0ab1abde7ad490245d4aeef9dcb923b369d30e9ccef57a6e16d3c205121f0bb162e
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oLKd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432257411"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000007482c72efac6c0d717996d2a01f6c74c8acd2310b6da9d44aa76ad326f70ae5000000000e80000000020000200000004a36391d591d65ce82b0d158ee6d30f53d3063ca6bb0188f8f2cb332ff2b5871200000007c4d86168cd7552e85b61cf2de26ea82a6428b6eaa2499a376575c01cddff79a40000000e56c0f6004714cb59cb5ee032d37e7a598c95e5855561ab4d2f1075a9c6527a1c271a7a55b54cb59add767dca95c5c3d637f0e9db919d54e4d58ba5bab0a0651	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{709860D1-7091-11EF-B60D-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703621459e04db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000004d086eabece058c96e9a16dc15c5d00302d9317347e7f6805284c5e00f297a93000000000e800000000200002000000046f586d3f1ad19456f536fed09b2cb4df7f94462b959ac8584741752c9e3eff990000000bec971c3178b1f2545d00177464695ff063f6dd5ac0f2380ba1384fb3704769b4fcf758132aca0e6c914b71f3891957b857784717927cc8945bca6ecd168adab6595ad5dc1b80c69f365858dff6ee26746391173b6da69323b0d584ed650160a10048c676eac834265f21d29936fb6722cedd6d9c3e3f0599874b655596b43e49885335f285c9aa6955a4c501f69f09f40000000063b935eaa2f5fe9721f756023e7d69fa531ec9842885f9d62d5588d105e60588995e9edaf6b6bb1e5d3f3ac7851c7c15a41515bae4feef5bdff8c3a0191a24f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2404	iexplore.exe
2404	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2368	2404	iexplore.exe	30
PID 2404 wrote to memory of 2368	2404	iexplore.exe	30
PID 2404 wrote to memory of 2368	2404	iexplore.exe	30
PID 2404 wrote to memory of 2368	2404	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db6044216b52d69f7bab19339bf6729b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
547b83f6ebc6c588b7c8faa4d23f2590

SHA1
395ace2260c822afbc7cf820154e39ad451f33ec

SHA256
a5cddf859556f01b62196f08b3bf3abbb766f67bbdc9d046d8a12205abef123c

SHA512
cdedc7f16c8d9b3f0e106859eab9c01c8c7635a0d38240be7f2b5060a66478f4ad6efb83afd6a0d12dd2d78e1f7332ba07e4d7391685ffcd64369f491fc0d1c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3866256e1d47e75f39c1b07048c2f4f7

SHA1
3c955b57faefd079d793a6f2e62a373679e5566b

SHA256
952e2b45b8b82fb225ae778ba95c82c1928e17668475dfa6e40d326986fcd2b1

SHA512
d1a0ec7bd99ebf41c5c6aefd7c40f0ebf33c461e020dca69212b267e739406fd174fef51976091663a294f30444221259915dfc1aff98af0b9384e62574994de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10345bf4dcf82a6f724f420d7df689fa

SHA1
00302245990514e7cefc76375050eea52d5739cf

SHA256
e1da4f5cb1ef73ae4010c3a003720c9555c861fd1db209d7ab936ab259040fb1

SHA512
6c8f2d9216320fb013ea84da33b966587d22135d581dc4a590f9c2645850e8bcb75917fac488ada6e41dffec268d1154895e5cc0823b8af36d57e906674f3b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cd09c97831844dc484b62b50fd45492

SHA1
5d742f74e4c828ae5820d6cf504641428b2ad413

SHA256
bb61d22f31e7c914eb9eb2fd0963259ba3ac743f3620c7ae4e2e4036b74d6bad

SHA512
2d7eafbee58c8e6c6b28784884c9fae98bdd8126b07cead68d959f2498d40b5b9ea60958deacc7408378ad95509ab4d72e3f341bd4e3ba15d7360a0cecd3cda8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c2324766aa9d6bfcdcd6aefc11ce2dc

SHA1
fca24f7928805dad534e2c73db4ea6836a2bd035

SHA256
3e8437bebeae7d6a294de75aba038e9533cba25f49c3d147e36ff1ef43d7aee3

SHA512
d2225eda0371e8d162cfccf12420e12961e13c8ce3117c30320f0c335ec84ba1f98ec3d0d8ed9cf886a70166f57f46b7087febe7347046824db4d796506c2ce9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
feb7634aa71ba47e503fe1f929bf5cb6

SHA1
6f04b28522187081f4dfdcceab718a891393a338

SHA256
b08535d33c5261867ecbc72a5238da1064c1f863fa0c8469b74d7cf83773300d

SHA512
a8abf242fa6e519327f7842b88ef2dc0853d628b35481676803bc21ae43fc5b5ef3ac599ca37b3f8b1e7375eb0306cd6a9963735b991fc008d0a75cbf561ee87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46b4ffd7ebdcdfd38c427c8025dd3c54

SHA1
623ce32142714a30641bc813fa180211b05451eb

SHA256
0ea2dd8244ac6b5b7b5cd97918ae0283d21cfc8629d636115c8f95ce1b9ee5fa

SHA512
0ac9e7b8461e56e6ad3d83637aeba5a976890c08ba214b9a95280fbb3e6740589eae82f077957a6cfcacd61a23b7c276abeb581c27298d70aa7bbd3aac03599d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edf80fdf117a05503b351357b9566803

SHA1
79110a67665ae0c786baff62282541c1e82d5d22

SHA256
acf0d22edc4777f81ccfe1b62e430103384b84833d1addb69bc817cbc1e53ab8

SHA512
4a4c4c8cf3665d1063b9158342c58fcb0b7d9f6dda34bd382680a2e0928a1c76186cf4b296b7151e54683643d95ca9126ee71bfac014e710bac60cfd43441073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84f1c6d79e5a3244a4f6aaaee377bced

SHA1
a070d8b7079b8147afda164e3a99a1bf9ba489a0

SHA256
b01ab0d0ffbc0081ffc51346d82a4488c74ba93e7d27b68d8630a9e5bac84874

SHA512
3faf855105c61d44ed221bf17805a48e48457e3820b9fb698b43715a7145189becabde66e0cb74261ee965bfb26eb4d4fb1b6be17b3ba2b1675a398e304140d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f6491c1a947ae18dceab1dfba9f9d32

SHA1
7f89248b34f3c14de9ff466b54f67ffb66b1e1f1

SHA256
53796b10d145a8c4d2121c5e128a31839d3e58b5b88cd0887f52f0e289d41b62

SHA512
4973b976358655ff8be0816c7469caf31a7c8155277c39634be3507d7b869455fd1d0a2569f2ef806954c03225ab6ef54214c1137821005000ee700fb33e78dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00e95451ca1248d62166b5524e65476b

SHA1
747c9da86ada7f5cd642459bf2f9ba4229ae9121

SHA256
83d48d8a865e0ebb3319ab052a19a8aefa78998aa6547d9fbbf4ac65ebe01fb2

SHA512
b889775e4bb9501c9db1ee92402a1f18e40753278255dfb4d8b1483014858d1dfce952c857809cf868961ff1f409f6fa11793eecfa61ca88c171de82cde8f31b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06473bd8d7e4f04cc0e162464951c78a

SHA1
e65c3469d0f78f40fa0eaa866c260a90ce25efd0

SHA256
ae559b46dc70acedc6af3b7dc4e8c67eb81cfc1877c22a031911d8a88349c201

SHA512
19856a21a23e75f721fe288c3c921ad97b5f8280a0b7e0f45b7e6d9784bb1cfadd782a6fe8651db769febdb80548c6bfe1c95e071c38b02342a755404071129f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddcc83d168136e7480bf178a5b992c93

SHA1
d4843d9e5d32a3beaac83e66a658d079feb581dc

SHA256
4f67e00e31d5ac9e36d0b79a91c401a7c5e152435a5c1ffa63458bf24de0d0b5

SHA512
b457253988e723fd0858883bea5bfbb1f7aeaa62d5872c4c400e909c893811cacfbb31e753f32c94828bb4fb0aaf291fad604dc7514294e542dc0d2e64fda32c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7d46a1d7cfa1e39b97f76dff148cd72

SHA1
6670a86a80bd5f396ba32539d3681dcb8e495393

SHA256
09b30d52722c21bb881320d859e165c024f4ac3c1db18c517c8e6ac0c93152f2

SHA512
4eab8354cea2beffd88b4503b99b318ac64884bfed20ca87eae4144941f253879ceae9bcca90921f77e6a16f7164b1ff9dd567f1c309f0f93e6844b9a9db6282

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE0CF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3D0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit