188d28178034b3528c62fab1d8fb7292f693e21626336c64ef45fd43934d61a5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da987290feaadbfd1421a80cc079d70b_JaffaCakes118.html
Size

22KB
MD5

da987290feaadbfd1421a80cc079d70b
SHA1

8e206afe9691e8c167bd10e0fc894f2f55341049
SHA256

188d28178034b3528c62fab1d8fb7292f693e21626336c64ef45fd43934d61a5
SHA512

cd579a83d5a16c68866ff51ca94e3a6fd67fe0c6ea965a8f672622cdb202b4d1f427e06528c3ff2c2d3be849e9c6f9c509cf59aa2eb452366cf7a3c5b8e33e9d
SSDEEP

384:WpUSAe1pAERvUU2voZ/yBBjcqlo307lZE:WpUt0igtybj9l3Y

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000003b01865bfa672b050f46c368cd32b727eb9e942e07b5c3138e909a18623ff33a000000000e80000000020000200000000ade2dacd03ffe63736ccdd40678c0e61b8cdfe8feb53483181214a278c3236820000000dbc8c457fb77e55372f99d6230f76c57916ec0b7f5af13ee232ab8fd2bb00def40000000924a0a4d0cee8f5e42f8702d827acf69d0b796b4a9671bd677c9a4b1c899e7717479d7c2c795389679de9dc21498d181f1f1e9d5bc49aea717333b949001a2da	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000009b5e784ccf9f37f36b04225c14c96f7032a2f92cc36e05720c0ccb0c46ee1296000000000e80000000020000200000001a098588bf0123d92ab55d93480de4559e66b81bc626c3e932722e24e6f8d57990000000fc557c026de110954474e2ce1c8d11ebe924b3b42092a13c9fd58223e1bbe3a8e31c18f39e8b7d68a8d016fa8db2a011379816566586602087bd0f6afe11110283926c061079df6215092203e2d3e3f7d2aee9d8a660dc217c6f825bba1df178d4c5eddd9cbdf10b3d88ad37506c0b17b6824c777f04a5b587853346da62cacfb1835b00d08dc1d31f7ff857a523e49b40000000c30d83914ad70bda5c60fdc8c79df2e4b75d1a2d17892f4bbfe12a3a58aed4f85ce763b940eb0d5b2010fdb3f149d95c90ba6705768550c3ba17023bf4482cc6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48CF5511-704E-11EF-9FB8-523A95B0E536} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432228590"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108c5a1d5b04db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2412	2320	iexplore.exe	31
PID 2320 wrote to memory of 2412	2320	iexplore.exe	31
PID 2320 wrote to memory of 2412	2320	iexplore.exe	31
PID 2320 wrote to memory of 2412	2320	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\da987290feaadbfd1421a80cc079d70b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d4e5b640f1247159d4137c42a251c35

SHA1
bf2486a747dae0961b16a89f8108ca0390c5a38f

SHA256
bca80f0f5920fd740e28dd82b14bb4ba2e79317650541f1cdec16ce8c8fd5cd7

SHA512
06c59b3bee4668ef0c83e7d6363392e5f10b8465e6ce66834de62d56806dc10ce28dee5b2f1bcb3bad9ffc012e21b24ccfeade5aa614da186024c4a61dda5f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eb0a7238b471937ba6c494415084993

SHA1
6048cfb6c8650f4113a0d4032365425bfc012159

SHA256
494216cbfa0dfc68f0e6a16d445f3e8aceee686e6be20d49c28d74c49969e153

SHA512
7fe408a0c1dcf1236037de0dafcd6dd053ac76f92ffc7fb163987e7fb76d3e8afc4de6a4972a8ff7c5dfbca97d89a5e40e76d0ba57dddfc443b26e9f7a76719b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89bbfc390586b3453af703983dd510f8

SHA1
a82a96e3c93d465171ae54c1b82ea9118d42af92

SHA256
c806e01601aca177510d3f40fa97fdd2e6c193b037eeeaf2478dc50dd70680f5

SHA512
8845373d119765da96561f55930b57c83ea8253f5b48ca4203ec267aa3ce1364356b072a9859a4940d32470d9cb6032dcb8dc9df58867b465ba01cf51405bee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27b6ff0c3d86471fa0f324a3400728e4

SHA1
b458afc68b292badcc2d5c189bd074c5868b4992

SHA256
2de543924b1fba8a059f6d8e357556b713a2b061f8265953f97e830e965ca9aa

SHA512
45505aa272b3e7494aa59fc28a2c659cc70fa56d816701001a22ed342b2807a5f90d4744df452c855e4cefd73d558b116900914800d040ba6abef33b92e3bc77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06c6dcbdccae8ad9adfb116b0e5542e1

SHA1
2b34e64abb3482cf8008bf5e55bd2f6f1fc88ca2

SHA256
ce00e1e2d18c80680ae9d195c622df0d0af195fee80343b37a60044c865280ea

SHA512
a55279bfd2309ebecc3eac875d1e1e62d04322f0c84d0b28e51c841031814f9099c00af4ab7a155b78eed532766081728a065e2061defcb6637db4ba515e2f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed4d1673610b8385b4eb3f0aa6cd7157

SHA1
72d87b636634beb7d1a269be695e6e3a7dc2a6f2

SHA256
08c2b730cd312774c0efb7ee7195ca87ac2805b0d99709761098318508ace172

SHA512
2f4b3db31b321fd32b244f6602172dec45db36a3d429596faa907434162e9f7fe545378bcddbe4fb449c22b761e6c908e046b4cf3f31d6ef40c8c800fdbae732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e3e734a086e1b7748e01b95044b107e

SHA1
4fd48313e15119f53b437f63da9a4ec4f0bce740

SHA256
d4a8728d6b84e7bcedaca1983d6e7043f9aac802267caaddf2c2fcf61c12b680

SHA512
0e3a8c9e7674a9aa035d20bb719354a2340238b98bdf6673e0fac1817fcf595ce5600f865028fe6b1079548c5499b79acf7b44bdd307914a7c8a98c45bd3fa83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bc1dae06d1acdbbea27704ec137dc1e

SHA1
50f1f36b1a1ff25555aa52da39d934a73edd4b76

SHA256
e9031202704a0ed7533ab0823f2dd81408f0a9b8606bf14dbe59ff053cd4c1d7

SHA512
5de3350efeddcfd39dc9259db17da6b43336753c30d7bb8b9b6deba4eb0f18f45ba70e6484e5c08eaf8af019f62cc42d2531007482cea6a951ae822a3e93bafc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65a6e2746d5efb04be5b08ec91f89422

SHA1
57238f53ab51940648dd10cf1a50c197bda4f688

SHA256
dfb8374b8efeab264624c920616ad47d5757d1639175e0e4ddfc536512169c32

SHA512
77db790c1f3a392731b435711b4abe1dcf9c979b05026a99b0381c32d22ba9191214e3072a9fe1ace814955c11f0d361ef7ff9cdede89efadc4596f66fe0667b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab437.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit