7d932cbff135e24edb1c3575c6436f733cc19af2ab567099530b83035797b97b

Analysis

max time kernel
122s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc8686f5c7dc1942c395a4c95a99daca_JaffaCakes118.html
Size

250KB
MD5

dc8686f5c7dc1942c395a4c95a99daca
SHA1

5f56d824edb162cfe759ac15649697f663368398
SHA256

7d932cbff135e24edb1c3575c6436f733cc19af2ab567099530b83035797b97b
SHA512

3fb05ab14fe5b3bb8ad50f9119566d2415ba137b708f8ae0979b7623b7bb138183e462aad72482f56d403ffdf7bf30945e3c1038e6137c1cc49ec079cb781bb1
SSDEEP

3072:CObuiyfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:CDsMYod+X3oI+YS1tA8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000e84584b355a1ed4fa11d332aceccf989e96e547fb401a4c8ca1dc8be26399a7c000000000e800000000200002000000089662e3d8ae1f129c79d581d118ce148767ebc7b8668f357c1cfc110d7bba79d9000000053c08679a551f968fae6aeb0d9143c8908fe147d09ce96c60d23e1b566a0d49ee2789f2dcb60c97652f370d48ca661bbef05b0956ce0978392a095ad38bfc86d5b81e95cf02e0a06de0316057e3db98807a11f0bc2507d43c1d7923100e1f181d131d6b7b6de4db49491123cdd412e01f09975fa786e42e9b3bd1d2cad95e79a24c864805ad34b8d9226e395d122443e4000000027bedc80e758ff84ba7f29f98a144732e24b9da412d5f781f0e807baa69504922120b65110c09503659f11444df40e6cfb355a56bd9a039d099b2118b7669784	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3CC58E1-711C-11EF-B954-F2DF7204BD4F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40bc4d782905db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432317201"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000d28056328bec21aa871f4097e7241cae43890a705bf35198d0f07891a4dc28bf000000000e8000000002000020000000f7d55c857d4a7dbc370b251e6addacf57d777d77e1035b7283470597de30cbd52000000058621aaa949429e5b5ce9249fcbb8899ee5ff5d7f5e29f5c5a0d6e707c5b184740000000ae478a3db5e1244339932e9b9d285f2f30351882862b33ef389b8d76c4aab654f6a7a7df97238d4f93511beed5cee62f7e31b463809326f70f4268b0fc1e7a9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2972	2704	iexplore.exe	31
PID 2704 wrote to memory of 2972	2704	iexplore.exe	31
PID 2704 wrote to memory of 2972	2704	iexplore.exe	31
PID 2704 wrote to memory of 2972	2704	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc8686f5c7dc1942c395a4c95a99daca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91e3d4fedc40a37e7036b377cf380835

SHA1
05090056065f7385a9c46551d20e4b01b75fbb15

SHA256
726d37d5da2f485b11a167a1253d0ee04bdba6a27e6e1ab284a438687740e9c8

SHA512
cb464b2e2420de9f28ddf8f0c27fdee0d825b67c653601e45320c187283c1888f361662bb9576b708695a792baf2781c6aa307d6ca3b644e6814335084275cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc9d5d0f9c496d66f34812ae1658f4f8

SHA1
ddebad033c215b30644261641e5b3a2387b53e34

SHA256
8aec5d85db3a2f5a293a2dcdd263904140aef9e4780ec8877f5b975dd36c6adf

SHA512
91f8a5c20b7e35e99b94ec984edd6b831f39488ff399ba1b3c5a1aed7a8cf39caddc65dc60a767e43c9c79840d16204976ae6332ec348c45f15aa704d5ee117c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6250db772d61a69c3308b97d0976a22

SHA1
7ebd72c1f89790fc6014affd66def244a1146aa4

SHA256
a2957927e4419741b897e3ecfc718191ec5ccf856a10888c2cf7e8a69b5535a4

SHA512
60145a816689527d6679c6d8f80fa991534c8a59149cc395b5f47a1c1ad041298d3498d3627b740bf31f76faa89e845d0569dc887b66d9d1925e6c5062210201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d495b86e3a48d0b99b790ba30fd5835

SHA1
8ae35e27c8bd6bf97ee9bf189c0cef70287c91f6

SHA256
0d0ab07e0dcfcfbfa1557b13ffc1791afd62603d8c559588e018a8aa74e15f7a

SHA512
5cb2bdcf493fd659701dfe1041e66819a8b56ffba4bd87aee34fd3cba50980b45a12a44c4aee1a45d17f6eae4d5480cf9ded972227b3107f579b77883479a111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1271f2fbad99fe9ac1bde44e33169af0

SHA1
7175991efd71842f1609b9ecdaf046716380f7e6

SHA256
17038cf12644f3a77f25bf77fbc5d3b3c3f065a8133422708d7b9c8930a72b88

SHA512
9e716a10db43462b5562424b785b08fd694066f6bf2da771110c4d94f3d19594213c283ce07e8f26bf82e082e71222459749b3c2d49e9ca8ec91c4aa6ae652ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e2ab8532bbc85f0f6a140dc798d9267

SHA1
1394a5b451ac27ac76f558d56b43b05ca20790e2

SHA256
f25810e125faa07b438398ff2bc654384c2624e497919ff50e3d28ab6d628cfe

SHA512
869db042422257fa33da298f34cf06df7fe2508d89e2e6e8d655e182fb50dc0fccb54a26931105ff5ce7df56c02edfdc74bd95e7ec3b79eebbd716795c8bd02e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67dcba15eb8047db103931e48dc119b0

SHA1
1cac11560b52604836a7d7a1ad35340535d35487

SHA256
fdb99eafe567b25799352cccc2a42d169a13b167ac2d011507d7fd1712fd0de7

SHA512
37eb60387ab0494b5f05d9c39b1bf24cbd6ac99e8de16c0266899749e1484815a334b12d1847cce0cccf1d203a6cafaced871c9fa99aa34d45cd23025af03f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d0d0b0216f2cf8a7323504d09c95db4

SHA1
2c23ef71db550eafdba1b055b996566500659d8c

SHA256
2d68e885d2a62c459df5ee60e96293ce84e95eba18957ede54763ce1d715a059

SHA512
5d0ea87e6b9440de61ddbc183ed3e2c315a670da7a031dcbd13894302ac517e805f04b68ce77d567dfd5e54fe376a04be69be9cf771bf53a0c6d0db7156611c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc23d4e66e827c090c4e3d47325443ec

SHA1
4ecdf4c06f0da6fc693381927c27f307e7594e29

SHA256
02e71979ef2a6625c943fa6b9da270f6fb0a9f283aa366b39cc02a00f1e510af

SHA512
447d056214e07e1354b07d3960676de702ae9f8e33bf5f30d814943e1827e85ae71d0fc952d28379aea33166d5afa7265e170c1c6546ed03cb2227e6030c0767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53fa6966bb2d9b985ed6fde7bc24ec12

SHA1
92b3544e0411b033122f4bc60f94e33a1bc5150b

SHA256
3d5f83e0542e765712cc4680647dc7af18662e79ae4e23c96bcff24abbf2c0c1

SHA512
1830a07eb5507416d2b34e7214767b5c3ff16b16ccd4cc6453db5e94a18ce2ed7a82a65dec3912e649a1e8e57d78a52b847ab0f8167e3a8ee160d0a9ce9a10cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d7077054336dcc4e582387294b106c5

SHA1
e536aea14e820aa457472f852f3291c6e7efcc2c

SHA256
cdedccdc8b2358547a83c3991319067d7fd8ed853722f23a206b82dabce47e3b

SHA512
90f1e08ca10d516f3a0d8d996bb1cd623b03c1316cd1241853f7dd2cf7d451a6f4654cb54b05affe432fa45a4b64a4b7d32f5720eae5988be1f1ea9a967605ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7802d38db41398a5963de4f51e2ca7f

SHA1
a7c6838f160550f0201a9726f9e65522f555a1a5

SHA256
6652198afbbeb0ca64409f1909eb43ca382c8b8a5d8734de48a5e95c5b04b224

SHA512
ef695bfab8420f18c88623f143b8f23933d95143d13f019b6c35129d34e3693d38439460e9edacd0faebaf9aebc27c173b508f105db4844603dce28357838b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd5404c5ec28f7874727d54ea1b07584

SHA1
42731d35b7b6c993622d4a9b71d3176f78af9214

SHA256
bd73c1f62f4f0a1efb63367c134a2cc571b7c9e495b8186fc4b491a9f188a9d9

SHA512
55137e7fce467813c023196e64c758c6aa52b9eb261a36609ce1cc92ccc8735d93b6e44493e80a459eb9db25cad627ecd14e0fee60558509c827bfb518496efd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFB8F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar831.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit