93083152d61f006dc5e27525588448d5b3f1ff8cd1447f0798223b3a1bc2ab16

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dab360da43136cdfce0e6b8ac5049fa7_JaffaCakes118.html
Size

12KB
MD5

dab360da43136cdfce0e6b8ac5049fa7
SHA1

e7b45e15f0a588047b75ae2d86a7a1c4acab2e5f
SHA256

93083152d61f006dc5e27525588448d5b3f1ff8cd1447f0798223b3a1bc2ab16
SHA512

f03305ef5c5093a2a4c464523de2350eff9dc1e7b680e05ad7e8af6ad7c09991c073043d104db68d854e1e31fbafbcd88c41754866c388a5cd8ebb2cd58169d1
SSDEEP

384:pc8wG6NFDGZnkygr3uIm3gOrVMHZ25PBNJleMi3:pQFaVkyQm3/hBNJ0Mi3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000001a400d169b044a1e31a47e6d6edbd8a60921242c59dced1dc8365df1bbbb9a69000000000e80000000020000200000003e8447413baafb8e6aa5f5c7707f44a0c517e5ab4e7744aa1090bd96afd84cdc200000009ea33cd7dcf4c290e9b938be6d1086667f7a5d8ff99a842927481ec9c1ae5a52400000002bad6bdb8f09ef9a18f5bc79b3911bc0c900d8ab19275aebed7d08fd2394d67fab32d4b11f46a3285aaf59ca50717c662366756c8f9f929e22f2687bc48af49f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02c6afa6204db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000fee5850a0e11671f93fa8c6686d8d7e29e66f91229749b839e2f9d649048d1cd000000000e800000000200002000000048d5b44c9d5b572b3d931c97abbc7cf3606bc1a727435691007afb75f4bf8331900000001b3ed7fffeed73d9e23a6bde3afda601238fffbb906ae6670bf09ec1933b09d8fd1733b14c6c37b45d6fd17b780f768d5189e1db30d65e1700d2afb1b7be49717ae3a9f1b193c6e481c181f1bc21673b5727c85cccb50e392ce507d547efdb46fad3b42253200a671479cf63648bf199104f4690ac43488efc4669b0c34bd09678ca9c36904a22762d89c7fa97e6c26c40000000e4c93caf42a84d93d5a1652075fd8ce46934a0ffbfab1169715c397b42716823304bcc30affe3d3d8c85aac8bf3a98b3055d510cdb6914061d093d63d37d44a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432231963"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2599DE51-7056-11EF-91A4-527E38F5B48B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2648	2784	iexplore.exe	30
PID 2784 wrote to memory of 2648	2784	iexplore.exe	30
PID 2784 wrote to memory of 2648	2784	iexplore.exe	30
PID 2784 wrote to memory of 2648	2784	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dab360da43136cdfce0e6b8ac5049fa7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20fdcb3998a5d81cbb7c23c61379069a

SHA1
3a7e74dbd5e760c083be4ec89059a8b31d0a0366

SHA256
0fa04c183a9c63878f30ff86726cb693cf32eaff44010e6641965ec525320d29

SHA512
ecee1098662d6fc2b3c344ad630277a0e85bc4cb6a5b966db1ede02db721277b10fc1ad872709c87e824b987b7f691641f4b40255076271e5da7ce6fb170ebac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e360986a91a5430ad6b320a40268c423

SHA1
a92e78fade579931ef1bfa60a8ae7342d275669e

SHA256
2dd80ac92ead17d538a51af29267ea748024cef985db69da48514f5174b94e42

SHA512
bf4df9e74da847fa5156e8af3eeee7b6835bf6d4082e646ccf693b042ac935cec8f106790e057f069f8e7b6c71713c625d5546b5138425bac63211d7d8c97197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ea1e238693140399d0814e4cbc84397

SHA1
294898b985267a709a38f36b360313ecfabf36b5

SHA256
3141ef1cfa888ea7db2cecc8e18df702f2209d084abb2771551c76e006f11a6c

SHA512
05d8144b4d1b6f820007f2661823e38dd9ef1c5734be18bb013bf1d0b1fd30225e2fa6fe8e0c89c77a02df15636090fe88172b6518c163f260e63faa7b5a5680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a77c8b1fd37d170b6fd20c453e4e212

SHA1
91350c3cd0c1a0f4df2a3bcca6b5104ebf6b294a

SHA256
44817353a27b7d3234c8365fa04bcd8569cda706a712bf9faaf7b3edf73955cd

SHA512
3e89edf98fb116ab7a016a4da4d1fc3b3c15036ee6a440ba49fd9d95874225740afa15afce8191f4c59e5839c069cbdffc7f92a96fea738ddcf07a63bdd1aab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4257d6045af74870aee7aec664c108dd

SHA1
5a8e1adf4c0cc06dfca7f8c9839e6d7e2fe3524c

SHA256
986df3b656512927c548076b115d2911daf359068e767b1778eeafe5f3941a56

SHA512
61b9e40b2521642dead880b6c6941b8247211d36ab76e43913d0580bea4d895991c09a7c7c3bc930ec9f15abcc2239e5bd219bc08cdd6f354c9be47411afc3d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
940e97df4a5e50559facb0422a862191

SHA1
69475d79af5e865acd4822555f5a4cd02de2c6d5

SHA256
66006279ff2d1bcdcd3dce1b78e5303b631ef924cbbe56f19ebc52fbca0b01f8

SHA512
509d4e862f997c844546f48752544db9726134ad0c42046290f44d915d5cf70f32465faee79374cabda542ee69ba9a0b7449f365c47d187cc5711ddabce1a4f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05f1971786b8870be937c92d21f50156

SHA1
204185bca6de9415621f1c080482ac45871e2f7d

SHA256
77bcfe6c4daec65a9e00fc897479221917e3e1239e099072b3afc3370bb8cee2

SHA512
ab80ccf7044dcd908cf8bb2139ce3c99659d630af914db7abf20a6494c8caa642b8e121a99003ef062d8470d239d4aed6cc4e07a506870770b191699bf66dadb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
570e325a515a931c08f863ae4338f612

SHA1
f1423bdc9a86714f80e97269e843e8e2916aadd9

SHA256
ce2c0df42aeadff80f15bcb8cadcb95c01b1e53b4e14ba9e6a2be83655d14ead

SHA512
c3b499968425108bec87b77ababa4c8b41e50fd2d50d73671d35d14bdd4af3df7cb55292b4b661a42615c04201aafffe32ef75da49cbe3df8e9cc7b38146d597

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee22ddd9a448b1ab020fb38082530167

SHA1
dbdcdc393a5c70c6ae162469125582d60c49247f

SHA256
b14f6a8367fe2d22238aceb83b1ff5713587dd7b5a89951b74721aa46341773c

SHA512
05941c8a744052f90037a8ea35fce9ce5c05ff0644b00f9e369389c448d9ef9f1c2bf5f20d4eef3403e24a7d29414615c15ae5e80ff99be6a77e8209ffa023e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52C3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5383.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit