f96d0a80e12c6e8a9c35f198470dc02ec3bfd0ba525d41e7a7548975edca62e9

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deb698c57d7d99e0c4eb76214a88ef66_JaffaCakes118.html
Size

3KB
MD5

deb698c57d7d99e0c4eb76214a88ef66
SHA1

9b63cd7bb8ab90e76fe932bf809c6e6a1b8900f9
SHA256

f96d0a80e12c6e8a9c35f198470dc02ec3bfd0ba525d41e7a7548975edca62e9
SHA512

0d44e9ccb7c15e80d1449b7ed45a625c3afcbdc81f6cd46208b7b24efe7dfd9cf82418663cb154486d35ac5ad62c097435c70661ef0bf91c23172cebad3858f8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432416014"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000001ec04bf8e66556a08645687792cba4c019e55c5f57325ffbbefb9acace3d0f17000000000e800000000200002000000022052671fa928ffaee0f4fc103a248445fb04be2828be63d45aa6e3b2108a2d390000000bf39b90d6870636ea0f77497646e24881a072bf23800d9b9dfaffcee5980ad6b788a36f0a28c65b77311fb6c8ca68daa5b6b6e81e345f6abd18c24ec4a23d8d32bad1d9ccb459be909a12c594f863f7102827f7a537046f2204094b79c37f0b853c74e48c9bfc59e217ac8081ee9c1b56555e4c070b3307cff87fcbceb4f8176b30ff90eaba6417c5e7882416eb7106e40000000ced7c0b35ccfb7f7654149782208d8aa077351a7dadf1059c041671c399b179718f86a6aaac9270bbbd76903ea459181e4eb9193e22b93a19276ccda7d37d666	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000076810fe7b4148f2e8e52bf77d95bf3895b81ec346dba01373178f5aaa684006f000000000e8000000002000020000000f49c57a43bd48468b42f5213661a0a683244b6f10b8cc0b4389779bf01aa6d80200000007bc24013a9537f934be75c512598b193b08ae2d338233493d1526897990457cb4000000049673dcd3a9113b9b0e442121ad50090c1cbf8042b7b6f5ea2f48d29e32c5170e199dce77163fcf0bda3e7a207c6e8ec210885f5dc538866e13a0981928af0fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7E80D11-7202-11EF-94CC-EE9D5ADBD8E3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a073dc7c0f06db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1872	1628	iexplore.exe	30
PID 1628 wrote to memory of 1872	1628	iexplore.exe	30
PID 1628 wrote to memory of 1872	1628	iexplore.exe	30
PID 1628 wrote to memory of 1872	1628	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\deb698c57d7d99e0c4eb76214a88ef66_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ab93964d8dbfa29a23e1ef583eebc61

SHA1
361264e67e49e62f4fabf61197e2e19b95128edd

SHA256
ddeaea7169c55274a3c9623dfb1d3712d3b4ca99d87be15e52ac69b7ec7867dc

SHA512
209b554aef1e455290871d29c916a4ad28862c166ee774efc2ccc8f381d2001bd218c0f559da6c4e4cb43a3d2297eadc517c7232fc8a6345fe6fca2a0d2ee865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eba866c0e6645e8f8727cbb30c16b9f

SHA1
4d2aa2f0da408b373aee15be455174577313c4df

SHA256
97a1eb0c1bd462af768f0c5c3079d21a76535c66ea143b2cdef0c3eaaef3a888

SHA512
4521bc8b9578ee56321dd1adcec0113091d5313463bb6805d58696d67189f59a612822def5b06b9d5f76c81174ae8fbe748f25e5724838432bcfd6e032d1f536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1591f1cfb162071b7f8390300e614124

SHA1
34049c08ad3ac0ca37b43c413982bcdaab0a6ad7

SHA256
e4cef1fcb5e793d25882cfb2bddba9a3b92198dfc291219986bc4da80438f7ea

SHA512
1c9b4b3b0a44a064bd14f3e9a0f972413696dfe7b2af173c1220efaddbf5fffad85f125f04e75aba3cee6e25307fbce0c2e55cd05e6fe27f6b99d475e3196da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d78cbc69ed92cdcb2311682d68e860a

SHA1
cb7cbbe7265dd89dd106933f730cbfa301951ab1

SHA256
c4b1643bca3d15e45efeb24342c28a768f7ad20856455853a6d6d8979ea2a310

SHA512
83e576596bef40dd87f66977203d97964bf5449b98a4331e3d4c967bcf87d0cd6033ecc44742eec22245f36a7279ba7394553b94fe13a80cc5fda816334ec0bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93e197d694a57d9d45cb085cdc9c4875

SHA1
d96310247ef0eb51739f1d9065f28bca80e924a0

SHA256
89a6ae8e3eae1c6ee6f50288cfbcb4f79a3cbed8008f974df0cc4943075b48c4

SHA512
6c2652df632b470f1cdbc2f86f4e92e8c87cf7e3811c63164c45ff51e2f8c373b1c23999ff3580cf0ba4873e38383ce4ef98b0520e65fea8e3d5d2cb2e7cbe8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea674b497bb0df1fe2d10f7ad5335caf

SHA1
45c1e2bd8985f3d829c15c0c367e5c9c234a3c8e

SHA256
a3b7129a8c03064996f1e7fca8a86afe6a0b46c5143ac06ae5db62b6e1b0df74

SHA512
447c9d3a1e8c163862c37b769114e59fc5d7c4b9176e39eb174c12893a781dfef1a7556ef6a932933e2a4e65915a2ab4fd6a1e9267f98f207f182cc7120aeb6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00e1f994ad1ce6b58924b059931994d1

SHA1
fdbb757533bfff7320d6f1cc863ddd702379058b

SHA256
6e3436c13f090047715b12909362e9952a309985eded2f5db12bd886a5d8b40d

SHA512
c9829d6d6803bfec086a3011333a96b4f788f4386e4a90a130128414120dd0403b96e0e2a76e062a72f337665939f878ed653e51e904541a3888860c28ec0176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38efcb2301c283aa2a2c8d4dea6a4f6b

SHA1
7270642386c618d4e231d202693bff8099947d4a

SHA256
96ef0ff7684ba079ad7a7ce93ee9f0c2c552f3eacd7d5bc83b374ef77a4e316d

SHA512
0d97e43b6d12748061a73f1eaa8b9b22523ba86107a93609288a07d57cabaa877163b5a38654e1e42ed7c774128f309e272395b85ced931cd5ad7d7f009a2965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
411329f649275e082c707c43ad11b74b

SHA1
c1fcaa1e850b961cf331197d93be18cf372b163f

SHA256
57bc8c33a00fcae65b681788f3b2af223c969ab94a0a65d625a37078be1e4785

SHA512
db22924e33d65c6bf0a31ce8354a434cd6fc4446dcb4c04b7305326bec7318710fa2c9689117189cd614c80f81603a940fe7a8f9ac92ed4899842b48ac0359d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a184a166b463cc6ee27246851bc99e34

SHA1
7ba19f00fa34bf1ce25a32fdae84033032b37944

SHA256
03f7c7e914cbf179af09f0b5d5d42a3da5e305f3fb7518f78e5e8d7d952b34b1

SHA512
7b25812c54e9f251dc3cdc06bb03d114323419690fa8c35c8b65b9d6a9740394f164f14763fbd5f0945701c4aad5ded9002bed915c0404cca449ee4d55f231ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b361fc57d97a35a36ff522dd18a1dec3

SHA1
9aaf7a4c9a4eca9be8411449cc95395a50716ed2

SHA256
c37164f80a6974ffa8ef166db3d6098e96758ac309f8a7cfb0fdb969692af666

SHA512
a34337666cc88e53723c3de47d6f6ef6240f1f160cd86f95568fcb08856fe1e5918c0c7fee5d53dcb3933572d1eb80e3803e8441ce14c7abca099632980b058d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8f9cf3b1adaf8680b77e235622ec013

SHA1
4626ebdc79541c596c734b03b7041a13088df2ef

SHA256
5cbbd73663d1da7b7920fd3660961f7a00b4ba6616f3f0539b97ae1a75fcd062

SHA512
1048ed31574c8764f500f846d6cb61512b1034ae342e260ad4a4a69f3fb0c26975d699f7b92eacd75173dcccaebd5dfe7109e8f7aaab7d3dfb2a4fd385b8b438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c49f8011cfff614ab1cbe2eac57fa1a

SHA1
1e11a85a23e5160bd17106a9b27c16fe40261b68

SHA256
a53dfed312aae4d3ab452866c5b4ecc417db4fba9cf54e5e66874023aaa980b4

SHA512
08045b97556beff15ca3e371f6c5b22eb15cc974950ea193e018808fc86a2905245d526a86b43145e9f412a3023a6754a0731ad00e6ea4f3885b0e7eefa70f07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29c607e5f6464b0d2a6f302755d897ee

SHA1
266e0360ef8f812d64a30500a881fe94cdec4c20

SHA256
78778948dfd10e858c913a50e3405215d76884e674656537a9f96557669590b8

SHA512
6d2ff07d3fbf46ea03befa5f12e60da90ba8f554fbf8ebddf5bf34cbba9cb1a88265119229c5d62e6a4ab4bd429767bf3609b8c87afd3eb58bf8ee42b26b3bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88ff3d6f0517b617a2006a6e8b04a3d3

SHA1
a087a59a488078b445faaf6fbd346ef407025349

SHA256
c5462a3ab0919dbdf9d35278603e94a639624f63d5c9181c87473263343e9e8e

SHA512
ed558f3d557ac1da5f5790d26330f698fe68abf030bcc19a3b33fd58e5a0057ac1279528e94cd8f8ee8ba6b6a0b2bcfc3fedb11689b117e413ca1db953f60bd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE58F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar988.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit