74fca5049e35f823a617cf89e1495d1b0ace6cfa7189af99ac9c13095c316559

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de9d360fbaa481c5e5156614dd447e56_JaffaCakes118.html
Size

15KB
MD5

de9d360fbaa481c5e5156614dd447e56
SHA1

ff03df4ba33a667499f2fea642feb2ec53bbbdc2
SHA256

74fca5049e35f823a617cf89e1495d1b0ace6cfa7189af99ac9c13095c316559
SHA512

031c80b218e4b96f7b97c203961eca894b559cbeb9dfb15eb910c7da425bfedc454388a07c85f932bc1939a2d951835fa458cf2ba2c7ace8892b5c69aa32c05f
SSDEEP

384:u4sRkvKbqWDCd5gPE5kWSo/0/ez/RYXOK/njRsx03g:mRRGWDCdyE9/02bm/njRw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5B819E1-71F9-11EF-AA6E-5A85C185DB3E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000120e2b8c77eb6f06bc3eb6ccb148cb2008ef8a0a230998bcfd4cca077aab1e1e000000000e800000000200002000000093e4aa1b54fb2840f14598f8c3336d56e45178f34c48714d52644bf0c8eaf4a4900000002eab0ae70373dfa264460203aa4c66d916fe0a374f30bf85b53e8b865fbc990d5f7576244d5cbdc20e6059dcc8624ec458113cda0bbc7c6735d46d7520d93cab2a7036fff18cf19037f3ce393652b47b1f5788d120dcd45c45408d5a5ee8bb71d0591c777b760b6c6e8effd530f2d7d3e7e1e9145743bc364e97d094208a9e314168d30bf200005652d2620b4225bd76400000003f77edc09828b35214ff4bb9060683c9c8b439e971403ee7dd2faaf2ca07f8f6e855673d6df5df756fff3e6465720c23e404e912dda82a08747576cc12fc4729	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bb137c0606db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000041ddc3319bef770ac627609faf6e1355bf3044bd40d900bb579fb281e592a251000000000e80000000020000200000006ffe91266f8d398dd461f79cbc2594f771502c2ae83ce5759a9ea4109dac9093200000003d4a5c43f842d24450ad84c96455a8bf0c3af6407c4b6ad7ee38c63b4d1b4a7240000000f0a00fd57b7ec8ea58e6a64b00fdc0b6f597a68e199638f2aec1e98fd217c83457940858510c42a1a8af97507d47d547fbb24502b74f63002f9a30255105e6c2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432412122"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2576	2160	iexplore.exe	31
PID 2160 wrote to memory of 2576	2160	iexplore.exe	31
PID 2160 wrote to memory of 2576	2160	iexplore.exe	31
PID 2160 wrote to memory of 2576	2160	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de9d360fbaa481c5e5156614dd447e56_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51fe02b9175bdf6503c9c89f29247f78

SHA1
8f2bc511dab5c6830c99711a5358c1608408df0b

SHA256
9731a226cc625fcdd3c920509863edadcee72bf21159c434175ffdb29796cfda

SHA512
a56b1d05ba6b90258d5a2ac31e481eaec8b683fcf117c9c5734ad74fdcd5cfeab09a6b78dc018a456377100fb0b2a22f19df9e2aa2c41264be4195db990175ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59d8263c9a15699aa66a3f2e51840ef1

SHA1
c3e78c38e11c8bd09de82e2e01d886de59330c46

SHA256
19d4a14036449f3486bf7b5016dab5b1ff858c1ab5095b3fd25f59b5d8ed280e

SHA512
6804672d37bb22b05198d6fc3d0fcc47c36f2172efcf22138245a8152df9a0f221bc837d794cb1cbd7a0e09e62839ff0e9bce69250b827ffdb02971ef770730a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2676aa2d2a19c14e19238491fa33804b

SHA1
b1cf448a4dda54b3e4dd4907505ad56f129e2d80

SHA256
ef05284ecac4d529d22b28944d83f9d73cfa7ea5d24b3e9d57633f763dd0310d

SHA512
811ce00b95c9ace641719814f543a6c729c2e2f116dbaf711a8e2b13869f2b5b09d6596a4fb5fd3f766d58b626fbae08111ef8e0d84e047f69453b6d8896d212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a412242119c4dab5a86b29b0cbc34f34

SHA1
f5345308b56ea613ff01b6616350337357c7ff8b

SHA256
7b99c63d64dad80eece23b1dedeee6b6e7ab331b4cdde4d7e910495b43ebca3c

SHA512
cfc187b9cad073ca0fe94811ad4b8eb160e4b52f1b76095b184eda898991d023801b79ac7ffda704ee2ec659297869af1f5db93de850f911f1e314936a15e404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8911e5bf2419dd1ef17f9305ca3d4f5

SHA1
c8cd516947828095c3c5da95b72d2eef37186060

SHA256
14afa02286c1faebb39f1a94d5dcdb2807207b6245be6a320d53dc947bfad2e7

SHA512
c441c4628079810bd70f1523f9a0b552060f9402356a6f0a3d6bbea2366310f63a353bb5e71443f174c73e6aa93edff7ecc6e04b724178a96873e43793c90f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c46f8e67f107c7febb0edee96d32efea

SHA1
e7a508c20f5ff96953e63a438128ba8929542b25

SHA256
b4215bb30aa3fb42cb4b06e55f205b259615a23e9b49b266260c39c561415237

SHA512
4a2b22887cc3ff735e4ab252dd889bbc83ab8b8470ca10be24ac673fd389056de7db034bd30bdbdb2c91a1c8d3226b45cc57ca6f0cba9460c1c5315cdfc08559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe593dd7487044b5d1cbd515417119ad

SHA1
08c2ef41484d7e64134a99ca0d1bef3579179a1d

SHA256
d7caaaa4f6c0569c8d32eeab49e5584095a037455ea7720b694d91773c2a54ee

SHA512
29eb9b1af443f14121af7f8bcdc785c290e662d6eaf5d6a5266ae31681f8b0e9796c6d30eba64b96f50c1b4a9890e064cfdb4409668544c2bdf9aaf4010b4350

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08252755636b31df7822797cf2a085b8

SHA1
f6fe419581dfd53312614538e1a9aeddc8c37df8

SHA256
32bbc0b7311e8312ceb2a2ff46d3e91824770e5fb5d7cb8a96cd6ab7801d3c43

SHA512
40368ac681997eb5ee158335b04c70a6c1a927407fef13bf249513e94eac83d68802aab11e88eebefc5c65fd4aa92d6756e91c7768c76b34605a7b483cdcaaaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3155225d71fc50936bd762fec793e7f4

SHA1
99e386869093154d5c7fb0125c2d6826ed8a03ae

SHA256
f693311ab68fb64be82a2009146bec090cb56e36cb5e7736259bb9553d325333

SHA512
3fe6b75292d568e996ff571999c04dcd2cd19212a8ae0e82f78b2ace036d8fa440fe307c31ad3ea591abe0ac603782847828a2b30a63b68d66bd885f80376ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEBE6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarECA6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit