8b0c45c041223dd218b35e8a9d37e50c0ab873e51d36eb409102a06fcc3116c8

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbfa1402fa587c8137645c83185ae48f_JaffaCakes118.html
Size

4KB
MD5

dbfa1402fa587c8137645c83185ae48f
SHA1

62bb15c7c0517b5af5b5c8d15407013f6d181a91
SHA256

8b0c45c041223dd218b35e8a9d37e50c0ab873e51d36eb409102a06fcc3116c8
SHA512

2773dbc5aa1230f29a501dbec473cd76d4bf2aa97a37415ca151e742bcc443700a39e43353c470a66adcc4b1d1f29707ebb9d94951a9e4ec73f2bcda15ec7d82
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oCd6JHdp:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000002bb10dd276f65585e1eb06b33860cf3223503e075dbb3cd1560a356167e4ff27000000000e8000000002000020000000979fe86a9c8088c45626a279df117f70cff9256ee66f5a13e03f21ce24649f97900000008f5932a5e0273e6cec52a3301827b4bd7171882eb4be98745d6eaee27923e468635b1e8d49ed0c64d4b6bb4662f4d91c4bf38f5633cb4aa85336ba74c985844d459124827f45ad8e9908439a5ad39797fd9583c0fc1bb86afe7aae8f11ce6242a7174476f5c63b8fea881b77b8bf2ac103fbb182c0fe4a43121a58c1fa6d277f802c51eb90fd1f4a3a4c93294fbb3f1b4000000004959240625b29fe5c471260e526905fcbdcc34cd31a171fed4de9730563afda5277e26c9307122831990becbfd890dafe2e0425e05dcf20172aba8654b4f916	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30eeb680dc04db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB9D6981-70CF-11EF-B6DF-4A174794FC88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432284140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000079dadf2999e63069d71b53dc5de7c8c75c92a52b1dc021115415240039392049000000000e8000000002000020000000e1dde6acc7236e88389f34fe105545f49a39a9d7517770241310fd8c6d7f6eee200000007e567bd01c2abbf914f6e10742b4a69acf2b0f07f620e71f25ead1058f26e5b6400000006a715cfa37f220fc7b841cfec303823a6f91e231efa4c6830a8867037c7fd274b444b8dcdf40ce3765aba41712c3a6562b248c86c7f242e9093494cd6e06efef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2720	2908	iexplore.exe	30
PID 2908 wrote to memory of 2720	2908	iexplore.exe	30
PID 2908 wrote to memory of 2720	2908	iexplore.exe	30
PID 2908 wrote to memory of 2720	2908	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dbfa1402fa587c8137645c83185ae48f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be69097cad67d74491e06d1f76977e2c

SHA1
c7a46384b14d4677ac9351f5ca711036f4f6767a

SHA256
716eb0013ac727eb69efc55cfa1f2050f57bccc6c258c568983bbf4d56c7a105

SHA512
3ce6552872f732fa3ab67882d5e855d4c0790bdb6d93c69a5407c0c31ba680819389f3c93baeea6cbf643dfca39e095b2231f5493a6fdc40639b07691f6c5a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70a43a42fc11a9e8413cad189f834226

SHA1
d02a8a7df4e914df2f97878c6674b1bf86c52efc

SHA256
845f00a3420d7a4c77e472d9609458069457129f1003ec5ac83aef7dbe60b3ce

SHA512
1fb108363cd1efb43c5daf991703530c942723f2aa93e60b4e81fc76ca27798ce94dea12dc96c978853550b57664f2af9313b361a88995d331f673de71383e5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffba6025640d844cbe3ce24a513790f9

SHA1
c54826adad7df092b2741ea71560eddc05cfdd50

SHA256
1a56a0d7799e8f6c14f47b1ebfa1fe50e30d44498eea6f30aebdd9dc2ef5e152

SHA512
6033987d13b00c456d041d059ca6f1030d2c83859c2811350ac73da774c6bd800a612706db5624f6c2b44310cb619b547d2a7d00cf99598cc39cc4bbe8006224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f3a0bd0c8974ab8415fe9dc90aeaf2e

SHA1
ad03c54964ca5f650291edb8730375de2b677598

SHA256
93c7c65f16fc91edf376f16e7c2e9086a1756097132075bf6490fe47a97c9809

SHA512
50ca48e1f5f31f2731242e9b6394895f77033459fe191b4cd9fba7542d1d71dbef2fdf7ba327a26fb9a4f48742d96a7f454e45b37f450ff13f390f5fa739eef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfb6efb9eea0145d87cc1e1f2c9189c9

SHA1
fb98d80f6b44d2b3b57544148e284065547e6596

SHA256
835f6ef927872395ca9b02bc78cd761ceaccb9f173900769a2265c2fb62d9321

SHA512
b1d55abd654cb1272b021ffe6c2391c20d88fd1330c78cde684608b45fa1f2b9cd1c0e18e1aecabb3e3b4747a0dd52ad921137368e8f9cb77d143449030942f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddb2a1e37f0b1e6395b5f50945c3a2bf

SHA1
94063f00b350a52a01818090a2b681fe488fdae1

SHA256
c0a6fa193f2aeb18204965445e9d0d40456631adfb513c987406e9a3ec5c4db1

SHA512
a59d5a9fcb948200eaeb4c41b78b7efa84ff85cdf5336d762a4ff733f4120475b950b1f807aeb630ff56fec270af5a11a87e1f545341e334c89accb320f80ab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29d42a89d62ab3f213f29ba5436b76b7

SHA1
7419cea25c174267d27b545544e9dec0ddcd6e06

SHA256
34dca2d88e6b1c9b649f205e693e51ac574e9a97d93559d2f4c6042bbc0ed7ac

SHA512
12f0f91d9b5b03413031693f8dbed18a5a49d4c880790e616438d6286bba986e6d7e3989d694a3d0780e65263e777e3483b6eb139a95ff6dd348355f4ca77a3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76ff7f83d54fa0f1219832834d6acf26

SHA1
9b089075130775a877826fbbec5ee00a695651d1

SHA256
68cf9ba58cc146d814603f74053dee28c56bcf85bd5def6674f49863df8b74ce

SHA512
d5f1d2b843a4b3848e6158e38bb8f753219d8087ef399a5ba52118192a58db3cc4a1d581bd00b7edbf50927359fdc19b13c23ebf614e27821741327a70d0850f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd9ca18c3c011f83b9d2624dde406c72

SHA1
a9fa4deff1c1bc8d5b1f302442a8dce6e0ecb4c7

SHA256
5f81870a758b7c0418662d103fdc141b9f26a039020f2f0e7575b8630b9ece25

SHA512
7e77ff5dde0c3414bf67fe20fb969fcafa7752e9f29323479feea633d2b741cfdd5d76374f13f06350b749b915eb68584a46922614acc48ae674e6df3408a296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc37cda25459a1a9d35bdc912f5cee5b

SHA1
fe1954cdddbf8984f0bfb067a2dcde8417ebe44e

SHA256
4d4ce2a5ac4b0e93e88b9d4052e5c7bfd09db5f5d446c3ae9f38e025a478d168

SHA512
3d3e045b579e91fb4cbdef4d286fb239584737e12bd80f1faa6449d7e5b19b3d693938dca8e38856d8390ab1588c03c1f467c375a55ee13413573e14e3c740fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceab9e609c4fb11957d875bf7d9377c0

SHA1
1723e2e516a5e53060a8c558abd3276f5c004142

SHA256
6bb661b6f7fa9ebddacdc7f62b6c59e8dd43bcd718b6c0e54494c6f86008f0f8

SHA512
dba42636a4b896c5c0225ad42b031aa0df3b8bbecd5218d7194fb007a68d0deb9978e274885b2167eb96dcf500f8f4e3deeb282b5f8e65144de34a9cdd5ea2a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49c9e3778770668090d489d0a626364c

SHA1
073e34b7f109bdcb4b19565f7bf21ee268f76c43

SHA256
a9fa30f3c6c4652584876167dca5d0205161f6f7b368997ebe5329479eb307ac

SHA512
8aa8131aa35cda8beb34a55647968e278e5edf74bb17176103d35c63b67e34cbaee24c73ecd4f11dc79151211e19d21e86bada0912b4ebc6806542a4955b3a7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F14.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FD2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit