ee33739b4a0ae9ba42d9dda81a3fc640797aea68c0d189129b5b57b008cfe7b6

Analysis

max time kernel
117s
max time network
143s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

da51fc8ef82f19b2c57b213d36021d5c_JaffaCakes118.html
Size

14KB
MD5

da51fc8ef82f19b2c57b213d36021d5c
SHA1

da88453ace9f870412c20eaedde94624dc87b049
SHA256

ee33739b4a0ae9ba42d9dda81a3fc640797aea68c0d189129b5b57b008cfe7b6
SHA512

05900a88549ad22bf0d6e130092f608698479628e2927b01008ff48448d4102a728e0bc3b96c9ac787dbff1fc5d73de00b43838129642132e1851e584e8d10a9
SSDEEP

384:Cyibo0o/mtXRmFAi7zy1wI1M/2iA5718zh/1jvF:CyiboV6OAi7zIB1M9AhEh/1rF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50af83ad4304db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b9fc727dddf040b15b976f917970729b8f381b1aca65490cbccb306a28a06264000000000e8000000002000020000000b782b650d4b635d29d85cf1b767f8226175e4a08a87574eb9a3cb8f0db47ec3b200000006556c13f91784cb787b0b6d0870a2b5b725314a9a833b2d09d69d4539e2a9ddf40000000c05f169a4f620be7fd431faf4b4686ec35a43558a4e89ca00cb606c126f3a1a0e855aab021dfd9c2fb1985062b2886ea96ce58884442228fb07a963f39bbbc5e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432218500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6A0BD11-7036-11EF-9452-E2BC28E7E786} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000002a04c5d3421b45e5db076c49c598cceeed992fb8f5135dbd319192ded2e09bd8000000000e8000000002000020000000e441421da8f5a48998e8d62ee51cf1d3c8a6af1e2b3ed82ff1ae0bf0c62864ad900000006743b68fa3d5f5f9e8a059731bb0bf7818ae0748e98d2a421f848e15280a30a7e4464ca7d0ca63fe9e9fd069a83c6f50dfb01d3601e29939dc742f475db44b1bdbc2d31838ce52e3642c4203ee4967938a09926d2b3be73c3f176def9c90924527067a54123a845855017e3f6de0c23e23411b557b4f8932dd6bfcfd64bbee14f5fb8727bd3a29e52ef403b83d84bc8d40000000ac143ae15cc37858ef38155b8177de5070d1c32bb225fd9d26992702f7f996917272fbf6f9e8ad031b15e55b7abc1c87ce97ca4ad11cb2a10b23ddd3965fbca6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2308	2368	iexplore.exe	30
PID 2368 wrote to memory of 2308	2368	iexplore.exe	30
PID 2368 wrote to memory of 2308	2368	iexplore.exe	30
PID 2368 wrote to memory of 2308	2368	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\da51fc8ef82f19b2c57b213d36021d5c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
068ed02b76d427abb90306e9cf2d38f9

SHA1
34ee77a87d4d65b445a9f75675716d2edeae58ca

SHA256
b02fbdd983db5b857a1844aed9f7697546ebe14caccd5fd7789f3f448245d113

SHA512
35673e0e76dd20cc913badee09982e235214e7fe1b6c76f62117294416f05b245cf165d02117f01dc0e0c76061d38ac8a4b7b350c1aaf15c1ba3fbecda44ffa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92e8b3fd4bc77553439aa4409bef3046

SHA1
e03b40710551dfc90377a7b336e58b009004dd4a

SHA256
27d38982d49bbdcda717d5c56b493771b69b751cebdff4eb3d75c42d53737df1

SHA512
d60732e7fef1dfbfb5aa88f4cbcc0e2a8db0f2795495a7ded415a0c8b7dd4bcfc9594ddbbc1cdaff53cdf9cbc40006a56633d260ce4d7d5209f3cfa1ef2a089e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a8fda79dffed7f01a05315dc2dde962

SHA1
b6ff3a55ec4bc927781ca7f14028a668478aa6df

SHA256
93c24f76bf6e534bef63b4e02fd887c4853401771d362c8cbb354781cebdce61

SHA512
ac98858e0fcb3087601aba65bd165557117d1d79da246c961111d2be254d23dbbd63c71da85b56e43e7717460953e0915deb31bfa83ba5f8cdab76f65fad31b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78606d817db00f064fdbd517969bf76c

SHA1
947ce9d1c4417900b7aab7f547a3cbdd04764448

SHA256
86d5b71aab10317c513ba79e541e9fad4f0b6e813c8b6034736a675bdc094fd0

SHA512
34456b7e892f0c3786fb30de17c0e6ea3bbbf4e973f28c8d1d50fce06f11e81a4132cfec81f175850aca65021c88fa67610829d9d3a82073afc9650858894862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af0ad24a21073773f08aa7e779d4bde7

SHA1
d2cde401616dbf35f9a31c91eeceeef380c95608

SHA256
b672ef43e30e25e72915369099802bfcefa84033a6e4a5ac84ad1a18b3059c86

SHA512
8d73b244baca2fbc4ef3e9126663afe1da2d01ca4c0ea501ab26ab8176af631e773b62e3e3cdcec1c9b0c3708ba77097598fe9fcaee69f275ff3b79485d7fe8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61644c91075077c22b0517a2fe3ea3a9

SHA1
373040bc1a225129bdc965afaa39aef177b955e4

SHA256
c180c1d139341363689b64ff48cb98b0bd818fa8d0cafd40dbf23ab3732fc718

SHA512
36fd850d101e9195a8a871d765021549973db2ad289fcd768ff673f420435c8adeb088d8532afbf38375c26e1f63ba89e5b3f9c33eaba690a6f7e6152259ea29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27a85e5bbc8172857f7bedb783cdd7f7

SHA1
06ecc7fc90422291d57b829024597d5c29e45e7d

SHA256
d8b384f07df7fb11f8050821e8049952d3eb765b711b03a1ba4ee65ef2df96ab

SHA512
c9097f22e08aff50005bd0dcd89cb2c361b6c02655ca723bf01bcb18a80a8764910b33b2c905f300f03ff9dc917ae4389f69f517fb126d065a18109b3881286e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3aa55df868bf6677aae14a665282df59

SHA1
0c257ad2aac9715781988c5385069ad7acf801fa

SHA256
8dc62a5ed782cf6049608229293002ff5fa4ef7d67e0189e5d380c1c8e3c9e30

SHA512
53789cc6c8acc2e74adcbff24fae43697724cd28b6053dfdc509d480a5f2d27a7cde9de7f256c2bf91847b94acfac0b4a077971ed0997492c6ae4f132c89e77e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc370addd68602d632bfcfbcf296095d

SHA1
2a655e6dcd34a4c99d1861c8fa9ee10230669b6c

SHA256
669ab8041864a287caec5852844d1f47cac5b2fc0925584092ecec636cddecd7

SHA512
641979733c93e14e068ec5b87c465ec18140edcf02feb1e872b0ae9bb4ccdb3df05f3dd9cfcd4d85becc6fa31b9c934f83f69adc647b728c512c9ff611661b85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2935c1e554e1f91fdff47baae10a780c

SHA1
ec799005cd6e36645e02a7e7501d78884a993629

SHA256
dfcab59192cec483099e2d0a40c9a289aa28f82de8cb2d05d3324a5b154412ae

SHA512
e5e1a51a6a0be37caeaffa6caae24ddb06cefa8a89d48fc641f8f0df765fd42909442f137a21e04f440c93646b684da50ff2767542a47041b4baae5b024d1aeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
481d4566772d162674568b6b900acb9a

SHA1
31356d1e1df060658c3dc553e5b584592f2e0289

SHA256
3803d6cb15486bd8988ea079d341801281f9fa9d5eb28c435d4f71b4221fbd31

SHA512
e7e82eb55eeeb986251b1846c5b04f19f7a0eaac1b915b4fbe1482e7d993bea486eea6bdf4494aa00cb3f87496fb361a7f25ec12866f25ff10dac3e0bbc898c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
987162882ba2ba1140da971980fa4d18

SHA1
26a60d84ddd4f670ef467f6b2c2782f7ce7006fe

SHA256
657ad2f70d1edbbe148de41793903acba8f1cf3cae11f3ed8cfb34a9979a64c9

SHA512
7092b6e9e85bff9b89c8afbecec8cce7a81b79f337b9452f6128aee39d088ea8a50896e9ec495662a2e3eca4a323e4706911d286a0fcdf559e3a8c555c93581e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE14D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE1EC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit