04a8eb5fe8a1bd215f9fdc8dc15a07e8969eb8772a682ac33aa9a809c0677c2d

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de5ca63e835f5762a0955339fcef705f_JaffaCakes118.html
Size

69KB
MD5

de5ca63e835f5762a0955339fcef705f
SHA1

2d86bddc4a9ec5b65ea94a85ab0116d5ddd1c88e
SHA256

04a8eb5fe8a1bd215f9fdc8dc15a07e8969eb8772a682ac33aa9a809c0677c2d
SHA512

445724df387e6ff4175dfd9b98faf5e5f4637128c56cda044ee0b8dbf18384f6fe54ddd7432faa0c51eb8b3d149e5dc1701377d23a0f32a8f058a9cac2b572c9
SSDEEP

768:Ji9mmgcM/cT9WDr99DXOIAuCoT2SqQC2aZZ1MdtbBnfBgN8/oAOcRWQFVG8c//IZ:JHZvTEP280tbrgaYcBnz8PW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000a56ca37755b616d10e7db12b87536e6bf948bb7195aa6a9bd630d28e4fc9abfc000000000e8000000002000020000000146d882eab14c60b893714d141c764c516442a1500e0053026757f0b5ef6dc689000000058b6b3e7d85e0c70fb7e15c94bc46f494ae2c23007a91b52ea1e5f82225e5eaa06e8f345e03711086b65ea03a68f8589e2c702c5828681e35963d45ba4e0bc4057e0ff66b4a1c58b1a88dd6c86719b3be7c1ccc85517effb70719e0230d3ef09d2786c8c24b34716aa3a940f7a5d8f530ae7f7b9a71b44eb40764a3c6cbf8b11311a80ba4e27cde7cca1e61d6024bda940000000a48f3d7937727dbd64d9619910d089e334b8ae8aa59ea3c1c6516a386a2c435fae7412c8ad96df884d638ad37db090032fa36e5de6e727f3a1061daee907df5d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d5e5cfe405db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9B15331-71D7-11EF-A364-FA59FB4FA467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432397657"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000ce16b1a8faeaa10463e60cb6a1bc6ad9641f8feda32584355a80892019af6971000000000e8000000002000020000000e651fc7479ff9620ebdcf6f0f6ffa6947b8c4cf36978c009b8e2a5f303060819200000006406c8ad5f6a1476ebbcbf3f3a6ab6d7448275ba86d3f48263d6825d10f7546b400000002c3a7e693a61b99e1359acec18b72ce63c2fa8aadf8d543325c3e04083e405b24b7d3f42f958cf04b64e1885201338fa3d63829e4c03924386a645908bb27228	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2592	1924	iexplore.exe	30
PID 1924 wrote to memory of 2592	1924	iexplore.exe	30
PID 1924 wrote to memory of 2592	1924	iexplore.exe	30
PID 1924 wrote to memory of 2592	1924	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de5ca63e835f5762a0955339fcef705f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d803d34259b737cb820c12f93ccf561

SHA1
3d0b44a488074759d7c3f87714a27750138f95e7

SHA256
d84768f71f843a05e008c15ed7f55cb691e504e3b14163dc0b3471cc522061d4

SHA512
0facd4336d1b93128922416a36d12de8060c667688504f3803f3755826649d2db6f964edf6ada49dba6b2fd3118dbc78640ed6966542141476cb36eb73bda80b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0f487f5e883a4914ab41fb3500198cd

SHA1
190929f4b50f472904e519304332131f324d3527

SHA256
f6eb01ed36be7e2f7c9a55b6e0c972f055006fa566935988367682b7db7088e5

SHA512
dcd1b34d6f858172be193e6d1d557fa0b0ec36a5be1fe5330b35a8929e7344d22873df44bb270d0c9ab8af0e79b37713caaa7187d98a835329bc78f67cda7d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194f34a53f29005a7750859aa65fd0e1

SHA1
afa8490c61d13062ac162267f93e01771251cde2

SHA256
7a024d6550d75cfd8beaf27e2e15d5e0e4000891cce5291c11a49416e0aa91ef

SHA512
50a8ab5765d8ad966d51b90f95fc62208a23c8f655ee24efc87428b5bbcefcd3e21d9552e08b265ba7de467e8ed083ffe2aca6d001ac032af70be577ddbf6192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa132301e1be9faca4b19abb385a8b36

SHA1
2ebfcf4d141771da0d4036726cec01d8c9cf8781

SHA256
0e7ac78fd2f8038ad163df567c664e1bb3f8ab1d64d0b8da7117fb78b24cfaa8

SHA512
41375c046fbae1a567a286fb139b8a7803a158f899495457512137b0569ad354192e0235ab54e51bcf4a979295ef3ccbf4b6562c295de0ea990c7855add88777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a55aaa46cbe9a5f43762d326db831cea

SHA1
51c0df2ea15c2ecb532f40576a37810639ea2906

SHA256
57db08b5899ca34cb9e52885f2683337348bc29d902f48c98b19b53633e0683f

SHA512
e5fb07d470400ef4fba153aa38f6a7283fa5339818a9d71edcc771b295ef43ec6170a69fa1951b78274a698406aa49efec90b8390c3a91178224b6049d544909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fba82c976fb57d7aba9a8a01a8835b3

SHA1
1a9343be82f24ad0c667f4f57264a9554f55ca1e

SHA256
55289b99ced46fdd599649a7b200dd68b0ede0471c3bf08fd3da96e74666d29e

SHA512
73ed6e18fe6deba7e93dea5fca773ef45ff8efc2d1ce3c0e149e729ea90288c151c6198f6d76872662d6e5ee59a48f2fbf1531ef064eef6e10fc85d144ff43d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3f46f701b679df10ecfd12c6653a393

SHA1
04cca4be9c0bbf015acd6227a1d025f77266b782

SHA256
ea357cfdc45defd595b9293ddcdb4f3ac3a79764ac371f0c7b84c35009612b5d

SHA512
1543a8a27588ed239c2cc58ca2e7c2aac958103298d0347fa54e01bc162adb4dbdf185e03f599dd8799a2ba4beb988a21c6853e32837351614b9ba8c35c90a73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b808cec33d2dc437df2f257c6546cefa

SHA1
9a295352af0ea86515df8071ecf72b967780b1df

SHA256
279b504cdf48585018484fcd1aa7849d034891f3edefe32a28f2fe542020231c

SHA512
5a7214b5fea9912a62531e54e190727a78a59df487ec2552645212ff72e97138690b37b282a50671a10b9334cd47a9e2bc2ee9748f7aa4b5ea12ba99887b2265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2cd4b83e111e8a7720b882c843de78d

SHA1
4b4faaf1f897b065e5f4699920d4ccbb9b8a4715

SHA256
20acf9941761276a89916f5b1e9610a18ac3c0fb240668557e667dd51847aacd

SHA512
c90845e73b151ed6cfb11a527111daa80c5e077951239e15c8e6f2d2e9ff3b0fde2721556feeb2495f85924df1a3ccf8f4b7fbbfba415ebf521274786cfdaef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e90cc9e6c8267c685d2397b624bae977

SHA1
ad54635fd9b2c7a43ca7e169b410da3bbb98b4c5

SHA256
8d62b183bd31be3e75bf11068a3d2e9b3c039be05f96e6e9209750aa0a0f6481

SHA512
53ec49af750fe9cd171fa52f33fa91c4f3330452c256aa05c5bd9198189b17b70cda85d70f38dd589388c1f16bb559b79a4d91d7a420d89817eaed0753a0cc2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD166.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD281.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit