0f18f47efcf4c42eda90b6e5442745bc0fcc5654692e45e3f3e08f538f7beae0

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcbb161be73b7dc41328783390b4667d_JaffaCakes118.html
Size

23KB
MD5

dcbb161be73b7dc41328783390b4667d
SHA1

48272c3a005ae4e20c9edff8677cd71465ca70f0
SHA256

0f18f47efcf4c42eda90b6e5442745bc0fcc5654692e45e3f3e08f538f7beae0
SHA512

09d5016bf0ef414d34f8a7ebde1d37387626c3111543c61c1a7738a64d52bc2fe7f8c3cdc2e21300f77fce3847d7f63cc24d13609eaefc14987ad07aac8691a4
SSDEEP

192:uW4nhMF6jI65b5n543x7DyGIGGP8wznQjxn5Q/XNnQie7cNnig6nQOkEntlBman/:XQ/cihe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000b18115ad0a382841bf45da56baecac784a1073f05f639b57c594f6df88c3a332000000000e8000000002000020000000ad03b27834a5ee4f44cc7a10977b1ac727fb02d1aef185459ed19a6f76d5060320000000619061cd0812a761956168c6eb9226d2228c87fff80bdb5719a9bb3f832777f5400000009c7e00012436cf399ee197d6237252fa223e09762786af3da1e2c96a8689fa60233e5187e4c7e03b802f37b0402374e2f372dbe2d2b5c9efda0ff1dad5d03253	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000095524afcac35ef0bda1eb4025c39b63ffd750d4ef2fad2d5e84b9b4093ec2998000000000e8000000002000020000000ebf6c32bc5d816d4bf218c135011db7ef6fd2d1c7eccf618dc0dea1eca8dc3fa900000007a93b95f11224a04f55c9c6d5890fd6c55e2245042868c14cc8084d22c2f45130b222384fe418a67c32a703372afcf984233d41672b1fe65e40a29d4be1a65ada91149dfa368e1481c67a2a83503b7f42086174ca3e11614e39db64db73ef6afc523e2a9cae5d3ea9ee3b12081c33694961c022fba513814ad849bbd63435a2368a893b82c199043fc47f073539bce4a400000007e5aaa8983af5b1fb964b6211c2bcb3a27f0e21498421a7eaad9dbd1ef03fb20ea6e88a7d2ee3a7112543345b3036c649a5fa2b590871849ceabb15aad1306b8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cecd273b05db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5011D151-712E-11EF-9C13-E699F793024F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432324788"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1616	2380	iexplore.exe	30
PID 2380 wrote to memory of 1616	2380	iexplore.exe	30
PID 2380 wrote to memory of 1616	2380	iexplore.exe	30
PID 2380 wrote to memory of 1616	2380	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dcbb161be73b7dc41328783390b4667d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e36b76bb662626e6de3ec06da99d681

SHA1
d24938ab031acc5d38c883ac0caec0eed742e908

SHA256
26ad1f5a88281503bcfb71f101ebf807181c15b82136633c1a26e78d2e388656

SHA512
6a6e311eca0bdd04a3e8df31a58f684ae58bceeda7de7246f6b11e0b326959c60ebce3d3e8d97929fd55b4797938f3fb0f71de92da8699f94196fb559bd24802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e587cb01dcb536ae72f059ef694b56a

SHA1
8c2c71e9ce189f94ce5505ebd11b22ec64f31df0

SHA256
dacd1cf0d7d62abc17d66c596ed8f36fee2abb623dab7217a0350c05a9995297

SHA512
5958732553c5c6edee88b6fc942b9106bc0b8d99e3799521c30fd810a30b08a91107d86cdba8f2e95fed2bbb7d2f49d17df40b2c7a158d626d94566e184ca231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc54ff29227d716b82ab05eda4f81703

SHA1
5a0b559d642194bd517eea35c59ae328dafa76ad

SHA256
c7e6294bf57cef606d52fec4c1e256a957c21da724b815d4679368293beffe40

SHA512
275e8bee74c97a301bab53757a1dabac63c2a176d380cc2ff8fee1aba3c456cca6441ff932fae3b7b9c5c9b768916169b3a70a78696ebfd00e0f4f88408d8c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e52fd1e06dbb09be3884fe0af1a509f1

SHA1
b03d8ab6f54f371211e4c6c9192fca6583b5b93c

SHA256
bdbaf9cac650dc2a3d02b74e967c8470c89474b93ce9176b50664d08df5f3a49

SHA512
c51331774f8b7857e2586ffc6d22527d3307afde6dd2f5f2199b183d5cc41f7af81ab2a4f8cfe93563d60cba9c81e5544ad4a865e66c2ab1463fcb3ba41c76a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61c97f6e055cd4825883e5dcd23a494e

SHA1
f389d4fdb4f9afe5ded86e5edb2b0b99da5dec5d

SHA256
9c47123bbbc19715b055ea82aabf55b6106df2175470a4a2257307f2c40aa82c

SHA512
262164285f91e9f866b7fa4d664ce02fea772eca0e3f8aa6ed902fc1e3ff6703080a0591a6f1e96f4584e80e2207baa5894321a059beef9894c76cb880918752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f007fd5fef5e633603e33c456103c008

SHA1
591456c7130cfda714132c767bef95f3e1432190

SHA256
9f6222c2d66ab9e1480fd521ea59604426eb6f01ee6e146607e99cde587027c5

SHA512
e9df257d0eb2125cbfdc8db0ae52127d6db890995f5f63baa0797aca7ffd0aa8d8beb5aa4d10683b5311a255baa73fa4275cf0b25287e2ce7577c595dc545738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bba9497a972a16bf03bf0f7841a7cd14

SHA1
0f67a2bff776fdfa02b410817ad071b35867b88b

SHA256
c6af440b6e2985b952beaf05c72d4a5bf61ba3988582a9434609f290822af016

SHA512
94655529c4fa198091809f64f151a45239392b35fb7bd5d75b53d4da99cce234aac5407bc3da301b3537c98ae3925d5d8b779b0457bfa1afb0eda8db153122ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e542742a811370e0c7eecb26df17fe8c

SHA1
7f012772aa81110a35df66f900601365e884fad9

SHA256
2290eab33686120c0afd521fd6ccec33f4dbbc50e076303296be53ccdf287c16

SHA512
bf61a47cade9b425c38e24c4d4bb0bd31e492ac601e41e4d6959ba2b13dbcd106d6c9e287062b68ee48aeaa78169f87ea1f286e91c9ca616a7ec556f3074a8b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb45627ab01672ed3c7c0ad0cba7fe7f

SHA1
02fdd8735351eae756d977028931019dd25d026a

SHA256
ed1baa31ad1ebeb9fc19d2f44f3a069c1bb7adc6e869d0352cba1b1b46ee74ac

SHA512
f22321997cf84cfc0210592b48aa5ae089b6497faac3625018702fd9fb7d3b3ea6cf9197853bd012fa65a0c0fa32783cd8a7ff746ed482435efc5be8a0eb46ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a05886ffeff0afdb21846c4e48ed27e

SHA1
b94f62c78bc41dec6b4025cfe99dce3588e0018c

SHA256
4743abd5cc6c44689bdcf43cea613208d10caf21e6ac61e9380cac9c6bec0c6b

SHA512
367067562806c18a8fefbd6036158fa74ebd15f1138b92004ae04d9a37c4ad9cea5fccd8750512a5986f835a7e0fcdbfe0ef8c796b0063308c4e86f1a94c9876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96693161e691ba2c3196c6f9824bc702

SHA1
90d9afb076befbbabad019d49c2b8f9bdf851252

SHA256
a8823256a037f14fae9a3d3c32f33b86cb0936bea1da694bf110d4e84eb9e395

SHA512
7af1c2b2455d8f9fa2824c6305acf6c1fc8a2a26fc74a35f888b803f90c1d5f42b28226a87be774ef2d02d444e400f1deed5263eb56760c4da55488b81aaa9fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ec8f0c15e39187c3c3b5386800f60b7

SHA1
5ca646bebad59bdcde4d3b1bab2fa474bc5d8608

SHA256
27f1e4215e98f1157cbbf5e57684f8c79d30e1b59ce34a0eece3606c8e5eb0cf

SHA512
ebbe30a4392fb56044cd70a591b62fc556b6b29e6f5891b11e5375be70367bfa77230391e3789087a383e2f01e35c3bc0a6055a42b3dd56bf4dc313c1a9a68b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
503c7ce0bf26bc78cedbbfeb429f730b

SHA1
47c1443fddcf8bc06b5fcbf0b697614672224d07

SHA256
d66103a5f40c7ffea3247a2a4c5fae5f8ddc8ed35387fb55bccae00d4153850b

SHA512
b958be8856a7a661ea6a7f3d0f6ee81b138825a7e5a4cdfc21c0bd687d9e750a3a81b7e5613439f35717926dc96043bf2a9c252006cbc3b96fecdd0d382162af

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC37F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC401.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit