ccfdb899aca2a0dd31d65278941fb2af829b1ee40da384ee6d911333564ae244

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dab36f60b12c79ecd5a4bdce137d3e6f_JaffaCakes118.html
Size

139KB
MD5

dab36f60b12c79ecd5a4bdce137d3e6f
SHA1

9e27727eb050034e050521c33a844bbdd1ab5915
SHA256

ccfdb899aca2a0dd31d65278941fb2af829b1ee40da384ee6d911333564ae244
SHA512

958cfc7ae721e0da14cef3ab51d4e369af248d6d1c66d53e7fd07afce92e8260cdbe94a1a71f7d2f95edc78965c2f2fd7486f6497011738983c857909aa15330
SSDEEP

1536:S87pfAsRSLlzyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:S87bCyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{250ED491-7056-11EF-A5CD-E699F793024F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000e2c93811c66ee99f4a064acbbaeb997354f4ea68c0b7afcf1e67065eb4eb9ce1000000000e8000000002000020000000ad6a4df03a1973b262383d902f7b0b303590ac7954821b4071d41c1e971ba6fc9000000033eb2f93bc43bded9ee3944a7686950a71d8f168de3bc0a83df7657d9ffbe5e3c133a21baab7bb590b1148875228c0e871fb150c59db04f190729443e3b7789cc9a737042e7346d200470fca45c6276192755d664ea7da15d6a680433b3d4b3411ab77cf76598887b49a8619e78f8a560bb2e8d190557d30b7227566e897accaa7daabc3f84aa64308edd4ed7e3fdaab400000009c142d86673bc395699ad80c189aeae6db887fd7d40afa1d513bc732cd7de42d65b7817a973d5611d850edcf7988c8601d08c64ca4859ebf4839b1aefdb207a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6033c73d6304db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432231960"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000000691f2b3eeb0d7c30e6369864e371d3918cd8be2f4f3d864bde0cfd3a9494f1d000000000e8000000002000020000000213707a2ab89a42839f88e601f943a7b05158fbaa799b4201d7de06017dbff3a20000000ed93125f56f1b8b019cc9ebc11c8ee1a8bb3fd01493983d4ee437b153bbf721f4000000049a48eb0016ef17ff56d1e70d4fef10ecfda52d420549af2a85d7f9a7ed543ea06a3c910b920dcf9b3d72ace3cdbadc4bd4b13a0947054adeddaa78a084fbe3c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2608	2132	iexplore.exe	28
PID 2132 wrote to memory of 2608	2132	iexplore.exe	28
PID 2132 wrote to memory of 2608	2132	iexplore.exe	28
PID 2132 wrote to memory of 2608	2132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dab36f60b12c79ecd5a4bdce137d3e6f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29a12fbc0d3a550406cd67b4efd23635

SHA1
b5e412429a09d56bc00aeb646ac4f984f0bb1bf7

SHA256
cabcbaa11a9207662a49d741ecf197f10a234e1a4f7cd89cfde3dfddbf371178

SHA512
1afff3f95d4627d323b4cc913dd745617d7ec829336dd2f98d97f02041554a960b27d3510b3cfa65484d2f87421cae74066901e90c17fa46669e9abcd1487e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
926e4a614431e8bbc5aa836e98d2509f

SHA1
710da5906cfb3f91ef9ee1beee3120f31b87e279

SHA256
3676afc80df3c147c4b3e286f328b99cb4bed10a50a49e32dbb098cb46ad664e

SHA512
c144a02faf76b0e069ee2a4dc04a0ced96198fab502d7344a70566f1d12fd6bef8e097320c4708400c5d4c9cc7a9fa81b53069ecbe4055fd336e1d7bc030156e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
284ab95a2b26f245e58dd271107d7f1e

SHA1
f2d4e888d885cdc1a92437b7d961a5a8cf2f5a29

SHA256
92e2dbdac6950ce5cb9964e4ed942090f662ab18ea3c90774a9f717fc9b99a04

SHA512
7d25da3c563de62491762fdafafe2e137b7efa4d8c44d6e2c93a6e6a78246dc42d94a9b371025c0e3dcd4bd6d401a3f61edbdd6f973069b4ab6bb381a06b400b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e5a7c0d35eb5b0a39a4cb46ad5d4996

SHA1
5f8d96fbe4eb585d98ee690849698e9bd12bf9f7

SHA256
639309b067bfdb64156ab021424e209f298a7387a2c84d77365c9ea6c5532c58

SHA512
1355e08850dee73d87c2e8c0c316f62c37406a8be8c23b1b5425aeb361e604269f604f0eade29ad4df1f03c131c769f78b6851302ac379dc5532049e0f1a6dbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30755cdeddd55ae722667edbfdb28b6b

SHA1
f07ed9f3915f40910ac78b12d4658ca4b3d95bd5

SHA256
5f8ca04682f9e57ff7df8565d5e84f8c1adbb137b161d3f4d8400f35891a2d4e

SHA512
822786f632cefb29c01bf67be3121c15c69a6f4b784f80dda8944b851c1da82fbeacb20e9d0cdbd56baab863447e2628aecb5266ddeb646651ef5e64a1c10b23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c026f63321ef70a5d2a32c7fa6b6654

SHA1
3913584a310538e428f609b79eeccb8acc2a7bfa

SHA256
39daeb75743487958eaa047f76fb2b6309bdca3baf560e9ca62d14eb740c8d94

SHA512
44e96d9b0adc59c38a23ae372933b1c94c6c2b4cc8feaed996e465e2262e31f4d94414a381dd7ac918b4094b36ef27b59d7ace28b57c256ae125c4560aa27fa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef450dbe33467f8748b597d9fa95c912

SHA1
f4cde1f5f4dc8ee49441c0e153c595a043a33284

SHA256
820839711af40f4778f46cbbd9a6f5f5f267f941091c25510421d999ab97ab84

SHA512
171c68ce24e49ccd4b3dff117d8ac3fa51f9c8e1cb55ec5a08321f96588bb081170b662950fdca36d474bcf37dd6dbaa70e21144cd47dbd63af376f190d04ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A21.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A34.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit