1094902bd47a133f28f36e12e9544a6dbd83cd0a2e014bdfe68f332a6d067fa2

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db2884fd403902deadb2d2d8920f6a48_JaffaCakes118.html
Size

68KB
MD5

db2884fd403902deadb2d2d8920f6a48
SHA1

3d934cefab8ff3b43209965649f685e894698b2d
SHA256

1094902bd47a133f28f36e12e9544a6dbd83cd0a2e014bdfe68f332a6d067fa2
SHA512

2e2f40ef59af344c35ee4d7c0232aef5378697279218a2a669ae56f67f578e9c083b850c1b46be6a882e655e460f5d0b0b24151d939cdc9d6673f1d798ef0fa1
SSDEEP

1536:2Gb/m+/dWYi231BZGhqN3wtVSzUnrXNvP0T8wH5zpAmtlAgE:2Gb/p1BZGMUnrXN3AtBAgE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000212059c2e6b8b0c63adf38f1be86a3fc2dbb4e330fdb34badf7b17309fd0f7f1000000000e80000000020000200000008b4a88836ac46376b0864d865596b388bb66bbcb86401ec2276426edbd1cb15d900000008041e0e4bf1416510b8e30b003b47d65b407175f7e8b9762d6a53d061d297509adb74773219ed1ee2bdd68ca07754ed7d8ad03dd32f072ecb1dfa4cb5e7736a8245d7d750a1565c3d72f07c4e100acde028f4e9c8c21212f13e51d274c3b17f940c19552b0a7e5c897cc601916da08073f9a6dfbaa0c4f2f73ec9685e09c80b22117e97f4e37048af28a97886183df19400000003e41cb44f784cddfae00c5ceb18d82984a72c324cbc053d0bb4fb2f7ea621f7de8d42b6dcfe2b07db8125f9c1b66ae499a14a7af7ee5e00e87ae9fced5786428	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000003d871c1df31870b8625964a420afcdae84657a071bcef3a47583636e99471ca4000000000e8000000002000020000000d66a141a6699e160e46b9e6cab1e338ca6552e672edf4c5007c6485f075d19c120000000d407ef6e9b909b98453ff3c04ce5f8df172afbf617f5c61145a2c924ce63d762400000000d76e6f9c18f4ecc7c5c2d981c6ce79ac744180c0f2bb0a15ef92587f6d70fef659c2273cf1e6a9df0cd6ff4d196e88165f6ea73ee70bf6f05d1c6c61bdce53a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09db6248904db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432248336"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F7AFAD1-707C-11EF-999E-E67A421F41DB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2768	2280	iexplore.exe	31
PID 2280 wrote to memory of 2768	2280	iexplore.exe	31
PID 2280 wrote to memory of 2768	2280	iexplore.exe	31
PID 2280 wrote to memory of 2768	2280	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db2884fd403902deadb2d2d8920f6a48_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ba7a037bd48c42c18e5bd5c8f316208

SHA1
715dc98cd0191dcdcebf3f5ad6d0e9ee2aa94515

SHA256
4e5d27d755cd7af4661787197ca991ff86e4e4630feda9a3f268fb9995b1b062

SHA512
b9d767387ea966aecdc28fd550bc7d82800e5e9ca412ebd7520ddfcf4967c8209d238ccf2195b4818c37cca49add330504132678fbd025c4c3a9b994c025b2db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aadb3eb2f8aa6229fb6e28f178fb69b

SHA1
5d4ba674ca67026977a2fc9a37be24aaac12c26d

SHA256
655b6751ba6fb8491c2bd65a2439f613e642c2726dbd9e9588693db4b814b4ba

SHA512
1574839b6a603d2e116cc3f6fd6b9d0eb0d2ba44a91c666646fb5b520a558f1d574b6ad7565745d2f4605fb998a0c852fa4081f1216463dd6fc177cbd6a5bd79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1662757e8ead07e0e7ad59e8fb1bda17

SHA1
1c45ed9a918e40bebb2fa648e4d6521649c5621e

SHA256
0522e6121af28b3a8982a33669f8439ec654683eb54a1fc4e96049b039588974

SHA512
aa4cd14f233454134e7b514ebcc3a9ca411ed691013883b7d07577a3e2813e778d1ac83e94cd13f4bf897c6aafeaace99ed3e1767129b85682198c165e99cf82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c67a1bec681fb3252d1d5c6309cab5b

SHA1
7b26508aadd4262ac4006c10b22e4f7d920d432d

SHA256
c0719991b96593f76cd77895646c95178559812c4e27426c23e8bf30bfa0e81f

SHA512
1c528db426315d6d5eefcf2e77e52f5d8ea20b9f6dcbd6d30fcac2eb2124235c9f66d910fcf20ee482166ceb842c2eef13d46f25b56f394f9b4d5e410c6748e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80ca657deef627048052a51e30df066a

SHA1
73590956651d2f9bb47e434e41cd615502e09a6f

SHA256
3ca9d1b03e647f8b34c76f1b9a7a8821437cd3679523054f96422e07b66478f0

SHA512
071b07ba6acf2965b554148119e54db08ac49ba5777d95aac877d91aa4725826d6d1f7264b0ac1bcbdf660329490a0ae6b5a26eeb247b7f4d80bfb79dc1f9dae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b0690b943f6ba319910de9e07b39283

SHA1
0d63eb85b3f4b99f219a7c2d5125ffc4dbb0f53c

SHA256
5fa644af293b10c6e536492a30dcd5cb5a36aa7726bae720be6010d09ef6e895

SHA512
54928c6c5c0e1e9f40f0cffab906979a875aa95af823ba013df32555fb896e976011e7034a2fb53f6bf1c3d384464d4f3859ad178d63c53e91b41859dac9a01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d8991aaba31e8918548a1032187d701

SHA1
60c5d61500b49faeaeec513bf4d47bf55c0e0bdf

SHA256
81459a02d8f9da083c9817e534759667ec79666e2b2f2c853c6e98e99c7791fe

SHA512
deee95e62fca430e28607f3d4960020d3ab94f2465436364b96bd2de15e5da02ba9579efaebece86d2226f24135d3e87a5d4eeb15dafdd1f1b4fb19574a93ed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7306a7a44b97dcf4a009d9ec20442cc4

SHA1
c445f2f2ac1c9e64c10d214cc9319c96c4d24ea6

SHA256
a206a76dc030bd22a3e51a122aa4ad9f1a0ade16c57e24c5cd701f492d6f21be

SHA512
0a81586726fe9485dc05cf52756bfa31d73ff1f7e964d59107e054b0863e6c8ec73a69db10561a633e74bdb27fad07e186052442b28cb2d0a2bbd1442e3509fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60067b1dc0e5b35a0033ae3435b20b5a

SHA1
351e23da6220868cc5e5ef41c0271c585534f634

SHA256
d8eb97d08fa3d5618d424316f5ee4c28ac606b5e3b2e399195a9983c43da2a46

SHA512
35472823871565f1f2c84c94b9a8bbafd9bfdb15fadf4b7c67ca0a39cf9ba8afa81a9959bc926efc62995ce5351c8cedcf0b4a963d1e6bca00213d1f91282c4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fe1050eca8ce8e7d77c34bcf9c6828b

SHA1
3943b0243678dad26e745055424d6f45b59890e9

SHA256
03f090d080334eb67d48962ce5a4c759f88216d1920bbbf45284675220ba40b9

SHA512
23d2b0a7568e149c8aa3388f8408ab7fb6c94674ef3f81a7118cd1968c2995fe1902e075205d1c779dce10e9d730981cd23c1131687e5b5987cf78a7bd7242ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82c2a81ec71d8f324f554f6c7180b2b5

SHA1
4bfc69029774c4fddf9c08da7d07ce0e0875487d

SHA256
cca9d2ae59671892ceb4adccf9cfbf1e685b9d5edd2aecf87d05167acaa8bb88

SHA512
be7631edc8ba757057bddd00ab472a21b542fad740d0bc9f560b5f76d1cde056f4c99b1e147c1570d2e5fcc097401a724588aac5da2030bc3b0c0985e2806ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2644f616a8ea1f9c1e4eda17cb4ac45f

SHA1
906223345da435f5dcc3a872302bcdb2e6b0075e

SHA256
54684ef10936b44c0c4c1012cb33c0519258c202cd41bd379d5532716ae892e9

SHA512
bd9f903710a0b5f206cfc48bd5109cd71bcb621cba0d6b9e1e045bfdf9d7dbb51b80ab54ddc792bc1b2ee8079d0a125f0f0ca641083da5e400a781570bc5466e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58783f87a6fd9b6cc000e7117e37606d

SHA1
f9af80b122dc8af9f5ad086a35f9ce9f8453544f

SHA256
a3be2cb6c4d9879afb00626fbca97781dc398b17005aace6f0b9cf52957ffffd

SHA512
1df017cc0b8da2aeffe14e221a43658b2f3dd1ebda55fb949f5e7086610b5094502ad28dd852d2dfe479b74c09d08d4151bb7fe93059cdf14526adf6b5ded9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29a36411e1438132b4887026b0240307

SHA1
9d617e443d9a7ccc2a05fb5c66555604ab1791a8

SHA256
0e802adf428365efa039828b4f4dfd57ab32258fe9d9f2e41b7d65c6d635521f

SHA512
281bac112557f3a90911a1aeb82d30cffdc8e597222055ada8a29e306725fcd7cd1e464d4a3a484ad809dd0c1635c5b0cc1e9ad85e7f02c0c648429dc97e75ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEBB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFEBD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit