3b2c00ee2d16882acbfe29ab29ca59d9395f5fbf3170f74b10adfa1a81d27c6b

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da69e65a49eec151930f563172195c90_JaffaCakes118.html
Size

292KB
MD5

da69e65a49eec151930f563172195c90
SHA1

7e57c3c351d40e26e0583bf223c1863ea4db023d
SHA256

3b2c00ee2d16882acbfe29ab29ca59d9395f5fbf3170f74b10adfa1a81d27c6b
SHA512

5dbfbf00f9219d5149c23ed7a2e1d2ec6ed265a95896035db5dd20a7d51ca8cf5a78cf5e4ab35ee279b2473001d86ab8a25b8d994f7360ebcad8f2f1dbaa9aba
SSDEEP

384:J0yBflhs0xtt/OKKEmFhLkWWYFGxXzcsVzMopUwMCfdfFEAMYob6YTlk:J0yBfE05WK5mXYWTAgAzp9MCfBFSYWu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25546851-703F-11EF-9982-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2041292f4c04db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432222088"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000067bc994febaa7b56f25e4d00b5332e2f45cbac77d65976862962ac18a0d344b8000000000e80000000020000200000002900a7f73421b7a631e148e305876bce821597843b501cef85bd6148ba480e2d20000000b372c61c8d7563cf666cf86d3785a2ee4230a81dd052b820bcc918d7f4f5665b40000000028f3db4f1c8a43a272c8e27007406952f95aa660592c2a0066b895346e0c117d406fa05b81bb2c8134f2a2610fed95e25f03a56b625ed344dccd06e93ab5a93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000c04b56f1abd16dd73a18a1006d78c1b1f562ba33e81f1e3dd224e7538674668a000000000e80000000020000200000007e4eb24489ca09f6330d20b5f835afaa05afc5981a12c1d773dddd2e5d5f13b79000000038c08ffd559ac8683dc0eb3433ba49a9c408db90e1aef62219dafa4e7297f42e6ae4bfc8165549ba86675c7e3cae796aa2fba2a4d78a1b496bc689591c238afcd7d470b2e4807121668043a1ecf621ff24d91e067edf36dd40afe77a2aabc8342ca9175e81b9dc650b4328e374b5a968177cea8b523fbd0ebf9924fd6b6f02eb0931108a24047f1bbddc332b50e9da2a40000000692af39c18ada7730a39198c016efa536677f9647822d9f310cd77022dc8fb27d2ff2791890fbbb88bf4d69ffd949720029e72b6a390eae06ba6185b33f03c22	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	iexplore.exe
2520	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2060	2520	iexplore.exe	30
PID 2520 wrote to memory of 2060	2520	iexplore.exe	30
PID 2520 wrote to memory of 2060	2520	iexplore.exe	30
PID 2520 wrote to memory of 2060	2520	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\da69e65a49eec151930f563172195c90_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
607c82661aa6bf8be63e278b4be7fd6c

SHA1
f46f5a0302e37cac39b7946ef3f58d7e94da3837

SHA256
03b43753d456c8676bbb5a1e325d4a81297303ecd59668455247465fd8661957

SHA512
c5e901b781d7e98d5e96dcfcaadcf561419d9ec38b4f2d89ace41bc88e4362d4952a2dff1ce7a88f5fbc0c20e76db198d333d74dee2d0890996044318bd3d792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
459ac5d2201a19f1e92b740211a8bb2a

SHA1
46af883b82777ca879de8f1ed0ad15a26452eabc

SHA256
fd230077759c63d62567060e216bd29aca98bdef570b866f5d42353774812650

SHA512
2e16102b5794bcc30d519d059f0f8ea8527a017ed121ce794c587e658aa1569775ba8a1931ad6f7b713918aaad66df0a15246b2274001d24899d0baba12ef622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91d6f322862509d1f6738fd4c758ccf3

SHA1
1f54e48f689f69cdf7cd54e309f232f8e15a3be9

SHA256
65d5c07eccb0e6a68019f96e79f75992eddd62cadb2e7bf1ebbfe27870a2427e

SHA512
c47c9463bd92b0534fa27498dbb6e652aea1b5ea03e4851e99d6e61be2f36c5fde685957c591fcba048ef948685a9ae07a91c13e1c82f2eeb5f46a7341979c6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c7571bf3944f2a4c1e8e24ddbf30f8d

SHA1
7da79bd244a7c61afbd41d706719f9aa800e0a4a

SHA256
8e370e6f53f0637448e534c390534a18a3861b181f000b23a88d487b76493117

SHA512
7fa331f7f6d0e941015508e2726cffbf546f14c2bbe72de4c978a28b71fa03323fbd8bbf7b23cd597c41d02e9e79dbaae7bf694253ad411535cf2ffb11fe9b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ea71821adb911ba52a2b19b271b52ec

SHA1
b206efc1825733f55293b9760c2058488ab23262

SHA256
4490c38e5bf20bbb4f410b2b603a539693f1e1986ed68dac78ec9734f7c2884b

SHA512
e7d880ffa74dff16b89deb8872175bf57fab4d9438180dfa6e37c09d78fb4f20ac46060c639ecf41410f0f05ad217c93fc27135c1ced7916a709104e0d92fd8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d5b0a8a1dc074b3bbe926599360b005

SHA1
798537e046265c1f5eff7964fd33adf43addff97

SHA256
0a76ceb5ac82439c39c71e823f5a49c2b0f05e1bc4943007db99151c179ea84b

SHA512
4777cd54aeebec4205233c0c1ab2ce3d203faf4ebc694d8da7716b42f5167c89cfa9374d05e4f8f4288542b6cba1075550914af213977218f3e2180957f8ff7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87602b9c13365b1eb61e112b2b6dc20e

SHA1
f90b5e007d24e645e7e45f0f9d78fccbf7bb1956

SHA256
44d453b1d756e76cdfe7ec2868eb61011874a53bcb2f25d5563223c544b1113c

SHA512
281351e3e51ea5f42e17a2d4f52a3bbf1ab4d4c27a241a14a8a8a1d1c89110eae473f660dd8c1d161cbcbd43d687cb9be0b6d25089c39b916c42172971372daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
209d9333330edac2f17bee35da1abcd0

SHA1
ccf9fb23ce23222486330812c9cca2dd539f20f0

SHA256
7d93e5896eca0e14ecf9e1653bd314400c6e2c85be28af6617dee89a2af4f829

SHA512
b4e0efd723d0b1561d0ba2b15b45bbe033de024db8dd4548563e3f8f48dc9994e6fe37dcb0231ece38640a2c58a9a7e8aadac6543435d3757345464946ef20f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D1C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar305A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit