962c7adee13adcab7e459c18fe2e7b862901fd83225173b8ddf690aeafb16a2e

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 09:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de2b2836c54c5f605b690478fa3e148d_JaffaCakes118.html
Size

44KB
MD5

de2b2836c54c5f605b690478fa3e148d
SHA1

f9c4ebd1fde5c1278df5075d3b2ad2e640d62557
SHA256

962c7adee13adcab7e459c18fe2e7b862901fd83225173b8ddf690aeafb16a2e
SHA512

36843f4bd99e49763d00f7ee4bf18ae56ec9925c2f0fb4d29c85070c6c4b3de161167ac2e9c5f16e1448ece9c3297d9ece05bae814fbe9ef0c425dc6f50487db
SSDEEP

384:2ODp6ra/lpm09d7IoD7tjk2rqGU3o5fByLgWdsYrSymJA:Pp6ra9pP9d7I2hrueJyLJdWA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000d60712188c831c435e74990311c25db727d128ad893086c908a89f702c20f472000000000e8000000002000020000000eebcbe81936df49f0b8e06d92962e7c1e1af0aa6453d63798e84a26362473fde20000000d1bd225886b8aab5c2c6f998bd1767c313a970e029391df51f791722b090e15b400000000c00042c415cf7ac01581052cc7899006abb8195601541a06e5d5d0040116f886487a2f67dffeeb190f366634a1848627c55faadebe0782d4854f62fe8706013	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000005800e00931976f947f57304ccc71e43e2bb37d779d3e2990ae56c9b4ad69da2000000000e8000000002000020000000b2edadcaed651d8044a0ae397b6274f9a28041c5e076c1130ddf1e2881e29845900000006ec18da73604c627c13138d85d82716632394e9ee8e5acf3c1826d71ed86aae40fd203b23dcc4ff6531059117876a181f81b77408cac0b6a539e004a52fd0c2611a54a2430cb558beb50edfff19130b02444699f2253462d6003618ae9d11219aaa397e1edea44364564973aa00a114a674df77df463322bcaf2b2199d71c4eea5e382790942191c17c9805a8a4f085a40000000017c6b03d304a2f89b5f86d1935ba9e0ea52c1860fd4bf73d91ba24e0878ca3e11be5f080a4f4f837524a660a4e060ff43ee351f22d8cf7873d78047ca7a11dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CE2B401-71B6-11EF-B9BB-7694D31B45CA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432383141"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d1f91bc305db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1404	2096	iexplore.exe	30
PID 2096 wrote to memory of 1404	2096	iexplore.exe	30
PID 2096 wrote to memory of 1404	2096	iexplore.exe	30
PID 2096 wrote to memory of 1404	2096	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de2b2836c54c5f605b690478fa3e148d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa6337619e09c570af1fec162b45cfd

SHA1
c786c2966398986d3862535fc22e3dd553b7a65c

SHA256
0980b0257e8e166a84192021b73280e26a0483935aa590e491f81d5459d0dd0e

SHA512
c4592adbe58e918dbf9fb460ebbed2441b3408ddec3ecd9ae54f9bec0f118d575397725473bb8d2bb786616ea90c11b12d4bea132291b486e805fb3aee34cd76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c77ec31640913b5d5feb27bea89311f1

SHA1
8cb18a456e6ae24b3525438183922c32da511656

SHA256
c7619de84d6ab1d5f071890a3358290b9027917b0e31021a9f026f5b5874653e

SHA512
9a819daf2808819484364758a0a829d1b2376314804217f16a6bc2bb3d21e090e21427b100bc45f4cee4b1c689a77873a19cadd127a92ac8f015cdc182bb7827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acd2215b5145eb72ebde4ff872dd7ee1

SHA1
eeb2fb325d9485e7896ed27ce7ccc0069a70c083

SHA256
300f11301594d65af566922f3caf869ae8c0b0dba520a677ad6a00cbad61a9f7

SHA512
3c2d756fe4feabf8b24a2be0345339d48faf11c7f32e10e75ab7966e3fb0bdb484d2109fdb45e45dc65b5cad573b6942c1b85e134009689956531462dc8ad34c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
705aab766992d630db942b9ef1e2e520

SHA1
7ff645487a738b94a5f49a2f6523ef33cd5e087d

SHA256
eb8c1b416590a5246730d676e3cee602aeee40f75e946dc30d289fd700601de5

SHA512
2f332b86d5ed14593595240663f20bbff75cab1fbb44ab83fdc5e5a8e7ce60ad500dc3dd5b0f03517c0772f549b50d658c781531a2fa84a074810f9fe8f85dfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1563957a1be2c16e3b6c152e2dfd1bb5

SHA1
8059d90e06985188a8e257b24820512c5fc151cb

SHA256
a7a0d4c7c1c737ba6780cdfe104b8ca3738c7e094a930cd65152e1f1d8f0de25

SHA512
7066f5b0414ee6fce8872ec707cd352cd12e9d4c5597e8b9b03d486825d29e699bccd2a9d8779da349607ff99f103375d6469c82cd7fd28bd7a5ea7ecdf976df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35a92a5ff44b5c8b0630e31e0e09ab96

SHA1
0d60051a33ca48ce985db9ec022ff21a5d0042fb

SHA256
978574fa8767bf38a3ae83dc3de0c9d1c7d087276ced40fd686a8ba1a4371915

SHA512
ea3a1305adc0af566c6c644c311042a73e0ce0839b579083aace05dfb4a8f30ad7ec3a5f83e15547cc60ce34f29d0a149f2455467327cf0f54382cde5048bdaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
451816085296fb55eae12dbce9c670d1

SHA1
f4ff32c94e600283044ae32832563853a840f2b7

SHA256
193edcd55f0b879efb6c220a3cf810d6c92c59ad57e15c64068a2750bd1ab7d9

SHA512
1e028a486f2d824d1f6466ad841015cb958e038e3772bd7ced3498b13e856c4e89afd4a4b1b4df5a1a4db85e82c914d0f0df0103b6f43ee86a42be990842c4e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ec74457213b09df9994bcc43a46034a

SHA1
e5ab4b57bf60708aa20e065c7f2e0f5ea0171425

SHA256
18867ea72f5b596105e5ba0c3bf4bc3c531583408788acd973ec37e05bdfef8f

SHA512
079967fb89db99bfb185727f7edee48a539538cbcbf5e7f82b808c1ba8d866e4523dd33cf70b077f53c7b8c46719de4b17dd9fd31341ff1aa2eacbd4452bda85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f9853881c353ee68c1545889d98d674

SHA1
50a57dfd21221eae4628510d66830b71e6449f73

SHA256
4e7c15d8fb0648ab88ede9144a580f173793577d5f7bdecb03a8d9f3e17701e1

SHA512
d15d2b5d921868c1307c1fb20d48894a4adf86c7ca14e652d8585a5d52a24281d53b016d00e9eb5cc33194b14e31c8adfa0dcaef1d8e685b7ead30cfd26b5c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e0dadf81f495639369e07422dd8a8f3

SHA1
95f126dacf61cdfe87e021d472e917209ecd5232

SHA256
cc277bf88aa895f5ce6569082f0cb57a1daff324de90f3f52f7e9495213b4936

SHA512
3707ed28b2ae04b28eb9f3821d67eb8846f60ab04003afb74ba66c91f8eeff31292498a9900026c470c8f949519c33c04ad682221b00188cf72d0fb723d30ea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cba019b54000cd7500c4687121393922

SHA1
d716e6a35158f530bf9767649f7a4934a44e5d65

SHA256
5666cc6dfacbde5f0c31102db017eef31cbedbbcd73e53a7d301992bb298a78f

SHA512
958ed9f760a207b10ade12e857820a5102e4380a1ed67d7fd298ee717ed6ccde884166d5d7f8e3d6e9d7a15d39cc2ae98de4c541b6f0a185b7072ba6834e9f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0f85cd4567ae0df934656d7032a04d9

SHA1
874ac6230c944572cd7697e54b8500c7d5aee8a0

SHA256
de9a369a993a3796b8efb655e1df3b4862e19f25740117b26f00ae5de684f364

SHA512
433d2cc87ba6382e3dfa5f22e4554b2b42a56fa0a56b5e9dba7299bf1a007cc5494482b6e6004592e26bd218bf2b7276a632cde5dcba09d4469902984c001380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f112eb2f99ea3d25903fe84c77ae34aa

SHA1
53e58bf7471f73e05074934ebc608aa27c271f03

SHA256
700309af5e294763235499b6027f3a74d51459c52b9f50e5dfc9ea0bb1bbc5fc

SHA512
28ab630dbe3bba5791cbffae3813b74f1fae6cace0e467022088f49c227634c775bed297522374cc27905d8b0d96da5665e3633c6b81286096dd26a2f8a44deb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7561fbdce88cd921bb91886abd07fca7

SHA1
ca88085d16825c784edfd93e2dc14bf8fbfcd812

SHA256
5f3d1aed2dcdd3b61e0eedaabf8e2de91df2642f864ab49ddb4a847efb39283e

SHA512
441cbe3495344924c8ceafc80ce5dbb566702d7ae061fde9caaf28544a5c99e959fc82ae5a584cda8b9ddb5756ab507e9da26b5630bc94e87c825c537363191c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35e287d5997446b499d37ef9d208b027

SHA1
03e49ddad268f680ff1f19e1e8f42b154d12d050

SHA256
d70f71b10a9915b51ca5fa071466236ee87f00dc1196e0b8cbe788582a7c18f0

SHA512
7affae4aa5ac181a0a56acc310c2a20012db8b92411ba5d78bd022c0301f61c51c1ac7062dfad326b939ce922204726b20c2c1a343ab6f272511696523d3f673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc02aabf7068b227a15690fed63ccd58

SHA1
7890ea506babc81876ee92d843e4ee6923e7374b

SHA256
e5c6f42059537701c5975f014c90649f963adab582206fdb5b15e75074d07820

SHA512
ee788082f01dc9b86d88aafde1ce0f9e9d0a05233a9437d41a8d1db0c84abab0520f4ce773d8170f4b9316c692df2fe3ca968edf2aaaa1cefd7eb9ff0e628458

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab600C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar608D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit