6749e6c9c1db79eb873fbc1020d7d68e571f3f9b454071540193951c60562ff4

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f029052ec958cd0031d2aaa953412fba_JaffaCakes118.html
Size

70KB
MD5

f029052ec958cd0031d2aaa953412fba
SHA1

ba25d0a3578155e2a0f1dbd942828ba841af8ab5
SHA256

6749e6c9c1db79eb873fbc1020d7d68e571f3f9b454071540193951c60562ff4
SHA512

7e7c903211fb3ab386aa05c7793ab4d3af37cc2f73b5ce4ea1284908b501ba399c508ccc4dd35fab986dc21b5f9700788c7ac31ceaaf3c7e327c92eb5e78d2c9
SSDEEP

768:JiE2gcMiR3sI2PDDnX0g6sR6jbknoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JFpGTzNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433096974"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{315A03B1-7834-11EF-81CE-7667FF076EE4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000df50e0d856a16aeaf64e6b331f5ca162b21cef2611cb10c4a343bfd95ef6ed44000000000e80000000020000200000006965d2415ed80ce47aeaecfe678ddab54ac0d0e9486c5a87d0097356c062324820000000d2322e0bdcbfc6cd8ef3e37227e35e965a6f64886d8545e6c633114de3ce83ff40000000d0384aaa0c78da55d119fb4714ed46586dfb62825ce0f3430318c7a24bf8e0c93aa6af790138382fc3a8a4ccdbbd82627fb0c4df9c3193f313636b2467b2e0b7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20439708410cdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000c6cc6b09964d02ca1e49dc1e9a9a11f2dac6235135e4f65bd839c666a39b8e9a000000000e8000000002000020000000d43e1604605c1bc126435a7f9fb6084d87494d0efd10aeb3339dd38ac0fc0c89900000004b5ba68c33dfa0b2292cc8e1eccd8eecb3e9c2aa4221d8f1281c4e7ab7f90a3ddfb1af0d794b970d814ce4b7c90580ea7c788225607deadc34c5db36177db5f188a34d7b3f0233c82747cb376f5ad5357ef8a2f2f71743d7ca0f5d1da3961e60da594a17e727b105f61f60650ac0efb920e25cb03bc2bb81f8b5b3b3ad1d3bc04f8242e588d1b08884ae5881fd0a5ba040000000c5fdba64cfcd23260ca9b408df06de232ede22731fc2505ddc67f1404dbe23dbd380afdaa205472aa6dae7df33ecffc86898f4f418dc00b92d88231cca9fa2e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2448	3040	iexplore.exe	30
PID 3040 wrote to memory of 2448	3040	iexplore.exe	30
PID 3040 wrote to memory of 2448	3040	iexplore.exe	30
PID 3040 wrote to memory of 2448	3040	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f029052ec958cd0031d2aaa953412fba_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd45dd4f53146f54155008d8971d2cd4

SHA1
1afea7362606c9b1c708466f91389f354bc0dc20

SHA256
723999078f775114eb4969a5715d0a0bdfc63a65f94615d3b404a4c63f279f22

SHA512
077768baf3105a477436b2fda6f3e572a5f252ff01aa171ee1c59098ef1a10a655bf9264a76d0d9e38fa1676a3e69cde58c9f4a7984fdc55e03b4883eb1797d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2031ebea56cbc81e6c9a6ef2ebdb5a06

SHA1
d0c812109168abbf8a6089c6de0378600f935c0f

SHA256
373402cf42d497c20696f45e929392713e4c850e44b5dc8b5c2e4d004a667ca0

SHA512
63e7823bb5d3c67235eac06d793954b83086bb5b6d3c804a73cf559ab2e30f4672bed62cae2752e5d564e4aa01f85795a20cda031d31abd01bee504072eb6938

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a058b54641d8d2258527b6a80449fff

SHA1
b93833916e2be2820902135fc720260039c080a0

SHA256
6360dfd0f30ecd42547e4959667d67c1a4d52989b766cb0497a2f732c2105aca

SHA512
a8879d8d1d2cd761df879355bd5db11843277690c875661e7f8ae998728b7c458efeefed9a9df6edb31ca8cab16826b829b20fda29fdb207c3ca8106977aec8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
424586ee5ae62f580edfdda359d85881

SHA1
28424bfbc62787ae60af6188c2821b8a363da0bd

SHA256
5ea2ecff3f83061ff7b7d100d48b598470db56e45571a37530b80a80192e194c

SHA512
df07261405445f8d1ec4ad7654c7e5f2f8766ffd3cc9b548598e040f9ba76aec981c7a57dd18ddabdf157c4c15ed1c8e66d314d06d4861876fadc2f22e8cf35d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a358b94a8fefd844f5e7b2545d429a6

SHA1
b2d607eb9116f3f41109771eb0e15a1350f783e9

SHA256
4bccfa57733a4d59b9e34024b9ecb35b52045345c4e53f4bf9a30b69921cd138

SHA512
b3f0b9b591332f2a1f5ad162476428ea551a276288168bc3de1a4cb7aa10e08f75581915534595a601ccbe749620ec61de2820422f6fea930f39d06a4239ff62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba3758bcb8f0265cef084a02954d463e

SHA1
ec6f1f4a39c26ca3b4e7cc14772d6adc07941d62

SHA256
e94ceaef3f06b47f459e0fe3495b024e6b13cb1daceae81d9e547f8b9ffedea5

SHA512
270efc4515c5672d375bc90a8eb46db93731b6de6486f4fc536a2f3d7b6f49214b9aec4e55e465453daacc781a9e6a5ea2440fc549a506a2e2a354b7833fa642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d2a7c6ba17289fa79aabd5134be3247

SHA1
bc417038c2d1f9796e117ce95c34ee7bd72774e8

SHA256
92c6811cd17b04e46654d77257293a65f17a4a59dca591883ea24bd4c5ec704f

SHA512
b5fe86780b37fcb1ba37f98cf68f9bc87a49852c77969835e21322dc11e7f1525338ae37d337c2a09ddf2de738f0e76098f9b6abd58c5f7aa8c198491025301f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60822da1f980c64ba45abf2e14f1686b

SHA1
7861e347193056d33ef964fc77c55b59c9de1148

SHA256
ee9f9e916fa8abd0ac39f3ab6b16700804ded7504718c627a18d70e967e8aed8

SHA512
fe791abb961b4d9e2cfff9890286ee442c707791f46e8a6b52c5ba30500c48f5f2ca48e2a9fd384bc55299ab279084d98f26a6a456637bac37a90446011290eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6ef239202a7cf459f695b9248edaea9

SHA1
0d1ae16802c9628a9c725fd152003c571e1967dc

SHA256
c9956174030f1816ba7ea4986216fdf24d38bb870180da585404041988c756ed

SHA512
2766a7b561d0ee31221b44a59c34be08cdb8839e12868a96aecf3b2199711cf7ca75e999d23273e76e45bef3db42234094427aeff94f87e1f95b7c161097d94a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e8158bc0138e4252de5df545fce9595

SHA1
ff8e0e1853c759520f19983eab78f23ff8163fa5

SHA256
1469df24abb1a7768e9f6a612b1f168fe98441e20d4e62b36366ebcd3f5b3c71

SHA512
df97d5906da8fceaaddd291102db13f1ea142ad4773c10a8a9705b1789637d866a3bcf917e2ce7b47445a8913a2cdda3352ca36896edd0f2f2dfc075aed37279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c104a0cc0f0f96f06c2720bfb695988b

SHA1
991f3a311510f2006e0a7fd074ef112b150e9c36

SHA256
1d4ec3c29f81346e7a1e5127494e41d3b0873523912c68e8734d54baf87b60e1

SHA512
06082d809fa0fa098f01ea19a664d1cac6b87ac64dcc0eeccb4c98ad9ed575dfb2378bcdb310f955f1cf4953ff76f4333a7fc70dab37877566bff7ff4cfed5a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF2DA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF666.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit