d25522e9becb4a24c83c36a9d8fd68086545e2d98bf210611ac1271935dc185a

Analysis

max time kernel
139s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcc49c9d4639d1214fa74fda927e4b02_JaffaCakes118.html
Size

277KB
MD5

dcc49c9d4639d1214fa74fda927e4b02
SHA1

129df6e646dd899dc0d7ddcabc5b733f25903212
SHA256

d25522e9becb4a24c83c36a9d8fd68086545e2d98bf210611ac1271935dc185a
SHA512

ba786d5a6d08d23f6f014fcaf49b22f56e9a5d762b235702c8a681cad0b9cb55f6f0d1cd1b4246e9462e072ca9fa12f2de9f62449d33a885b58f768da3011246
SSDEEP

3072:2Gb/TQ1scJ43Gr3nVPfmpLpJAxu7/V3LNz2cwDm+0s/O7XkuO:nT3I3yLsu7/lIm+0+d

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432326171"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40645d5b3e05db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{848BBFB1-7131-11EF-BA5A-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000080eb3832cbb0d0b8b20dd648b4e0798200d3f454e8f85600b51def1f4c3a7d66000000000e8000000002000020000000d1988a77e815d40c15941c622ca6e1d609cc81443113cfa3a4507368fe0869d890000000400a81f48121b755134fa020f23d2fca4eda4977b9b0f8b68c22785816d663f57a4cbff1817a4c69c05ca0403938e69460ca57da4b79865aacbb7cc69173e5b8f71cb7717e64efcc17c7a758e49b7ffb08765899b3cf8bb46509b335db5c2972a88511552016a405aa7387f495bdb22a63d0ceb0ec6fa0b6dbfaf23b8301b0923b9af5fba8917535c7c543ea4633ad63400000005312e4bc45b76f2341a5f84b7aad4093f89b5a352c8695cb5de2e4275ea0eb7ca8e431cafa454a034dafce9834033601f12e7cc5ab937bca61b5fe6cd9196d60	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000c4839ccfc601389f90b0d19e4018ed6638659c0a3ed6bf23723ce207e4228d1c000000000e80000000020000200000009901352ab53567d0a60efec06072576ae527b0c75c3c4e8d2a6577e06b453aee20000000acad21a8893e52f9de9fc85a8c75b825cb4797f6a51001f75d48486509ab17fc40000000adcdbe143ecfb4e6d5775a4a302958700994e1eb1f9c730ea29a16540aa3f80c43223f01a6fc92a29dfee76da7b3515c562737736572625d2164dce8f22552eb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2788	2844	iexplore.exe	28
PID 2844 wrote to memory of 2788	2844	iexplore.exe	28
PID 2844 wrote to memory of 2788	2844	iexplore.exe	28
PID 2844 wrote to memory of 2788	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dcc49c9d4639d1214fa74fda927e4b02_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eef74446b62b5db9351a80ee0444c5d

SHA1
15dc7b80e7dbd7c35ed65177c209c0e5c1bb4022

SHA256
902e675e7483fd4dd8494f9b51ffdff98fe1888376be550bed3a639edf756931

SHA512
f830b576ad24a5576f7cd01958fa909c350c0342d7639cb4487aeb5bb7eda50271246485aec73c4b60a545fb4ebb9e93348b6f82658b3faefabd5948f2d6ba2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccfc48b6988bd747fadbf586ec28f07b

SHA1
ed4aeeed850b4d8e1cd4dc996de4918e69ecd5e4

SHA256
57c1c6cec11d71f363dfa415d82d78467791deea24564aa5bafcfbc61c7fd0d2

SHA512
24437314aaedb7cb4a6611496406eb69c9740ebe2390a34cfc1b7b6fde903fcf1f27db8b148032be9d1a22d8283eed683d1458205fd0f58c374c55137bcd5c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dde6d3afae753260c729cf084a2322f2

SHA1
4c5aab51aa43c4584a6649f4894d70038c14dc8f

SHA256
a4ec7c2c05af4bec288638458beac4bd904d67caab4837e289239cc505d62f21

SHA512
d2f34cd471cab96b68bc7566c2527996a3447457cdbf1cd0fbcd42de3f66e6e7bab784e61808a2545b681b3339a8f9de1766abead28941dea7df6bc96ee4065e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ffc5df5cfcff0d9db5890eb3f95a879

SHA1
81b138f9aaa0434d136765b0f9e6d5f0fba32f6f

SHA256
51e79e6f5bd3e0499bc743abab3eec3a4bff76e852ec0899c1d37452f2914369

SHA512
3dcb64ffda1a676a26d9829d7fb4eaafeb7ad14d91ad79b231d517886267075bd80f1475997868946006df415ae2030221ac9d8e385d7d6526a26c8ad817c8ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbcffe053cb76672ffd6175a3d4f98c1

SHA1
15dbf0c7ac76293ab2c96dfbccd767aa5008f3bc

SHA256
f852706f9f98211173ae302d72136e2583d2ead483a4864318d3d321c2934a2b

SHA512
bef61ffc46f69360a62f913297f00f69a247bde2a6432c5a5a20385e334a65d4f3fca4576bc2408529f3472dac80bb339dfb8a56dc76c7215aa86748f69702b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
713aeb3b168e58fff8278440d5bf521d

SHA1
9f65c3bac94cfc24af1c577141a3676de3864b02

SHA256
ae3cd92f63a3c5e4135cc2a1091986c6856796dbb90e3fa7413dda718c50f6e4

SHA512
4d8686114c950a36fec8204b824909a8d64d2cc34ef28aa8e332d94beb2f86bada15b3182909b77aa0689e3f24978c2e199c4b68bd7bf41c1999f5b82eada820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bb144b797e698e30998146b135eab93

SHA1
92e28ba4987507455eb38288edce4c458ba5bb2d

SHA256
2147f77145db362422e5fa1028df6a3889a8ac1c5181b4deda6c880f1b195c41

SHA512
874a1e61e8be12ad2d6289a4979c139d95f22f35743351d2f0f09f52f6c006ee49da2fabfd265a99d7f32f1397885004a2d90f9e1b326a4c424b25b8b635d343

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95f1e23ee7fcc011558a46d4d90c935a

SHA1
92a74847154f27872539d57a7d7d09648a8eafba

SHA256
54c792019ca73ac9b14afb9d3d58c1d0b4534d53f327b8b74d89f8f5ec73fe1d

SHA512
6cb57e9875fdd9da6a4f6b204267e06d04aae34a9bd3ab91ed157164ab2543f9fa04b60135ab0f6ea827f4c3dbe348d14f02f7226fbb7507f94d4b252e81e3d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dac5534eb93c3735e5035990e966a001

SHA1
4a940dcd0d7f11b758ea5b7e182cc78721200ab8

SHA256
6b538698cf37d14ee529aa9f9e82be70375bc50cc0b8e9ee95e334a99efe9ade

SHA512
771516f7f522705d16dbe18077ad883e6eae54a8ed409fd5de75a9a533467c1020522210ef431211a127acded4aea454645907fce75bea4a218655c813acfb7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c40356c065e536b285189bf1e1b405

SHA1
0e1b142f2f0a7e397885015c7fa56c202e17f53c

SHA256
bc6f5aa695bf82278dfc012c662954b7222a8133f15389abd06db9512ec9ea1c

SHA512
9d542a40a35fba7a9fa30df03463a670d50c8a6f8b65bba3b0d685cb61d2dd2aa39a94a39cbd539762e214721ee6fd40a523c76e76266f0adbb9829a4efa94b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
658ddcb29da14cd684cfd719395c0b37

SHA1
9725e083c45e1e5099d4a63a65d4a565146ea0dd

SHA256
fe857c830e8f261ae3ec8a6012d6e0a7d054d75f3ef7af0592700b10e242d65d

SHA512
94cbbcd858f39d137f8de4084976b4f1e8995b0088ba202e001343fd9d354e1b8205a97e6fd97f66adf6b08629880204b8ac57ca2c58af814808f4061a39dffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
138971e31701d2e6c9513fe9d1bae594

SHA1
955cd58e11ee0cb13bea87a65ee837ff82cb4f33

SHA256
63838f6cf08ec2f66525f023fb8e0a743ca09d1e018661af2c5ee04d94cf42f7

SHA512
5f45957345a8e1d905f33b0959ddc867cdef32c0d4af731aef45013462575d22f271ce0eb50ff2060fb48903d497ebc46290ccf668ae4ca6fda3c104044d3ecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4498446dd547eed53d02b06f08bd13bd

SHA1
ba9a66ad66b73b79397d364fc10fb54979e7651f

SHA256
18a27215850f6d31ffb7810980a99c9c4ad8acb33b2065488a1435a832304710

SHA512
5dc0d701450b57788dd2a2a26b33ef38b116af00ced881124431eaf9d3a288b7d3a722b5e2838475bc996ef44387f7ee2d9019b76f504414441228bdcee8fa74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
832a6c1db6c5c3971c011ce3ec33f070

SHA1
dbf5cab81024d9d06e411b1709ecd60204458957

SHA256
b9d4e627762e3e7fd12575c57acfe5add2dd7f24413aeceb07274350063f6cf0

SHA512
ac1ddf9596877bdd1fd9e9ab46d8359db48a483e94b25e7b7f02be2610f007b038a1aa694f308ceb1098d9faf76099364e1a1bafec17111b5512dca1a7ea227b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6e56df16721aba388c898c7c48615d3

SHA1
507a0389279ac4ac9779f81809640c476dcb4f45

SHA256
bef8e224512ee8b141adfa584e43ecdd4572eafe01f67ee68580be5df1943e9e

SHA512
36aa535adb8b5b1c1efca7960981e29937b153d0d858bce057d7929122a38f2586970c68a21320f0c7c164009ae10b6d8e33fa475e28822d4edadf6d5a221d55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69d24795531dec2afa6f8f30e3566e23

SHA1
fbd5dfbcf33627903256d9c426bcfd197c00bbab

SHA256
b0ec51a798f85d3692715b31e84266272c3919090d37abd5df8263c5be8dba17

SHA512
341046449b1da33e52ba63b1391b9c79b53bb03eee0b15da59b3724732d083a3d80d34e30f4b6c9cf5eeea1a53adfff1bce708b4a1d6e453b41fdb1c58a8ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFA3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAFA4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit