ae8468f86cb726ec11c954ad4042019c95aa732019f52cbdf9e5a301c59f2e14

Analysis

max time kernel
139s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f05bbaf37e6891806d81b30216d3272e_JaffaCakes118.html
Size

3KB
MD5

f05bbaf37e6891806d81b30216d3272e
SHA1

128d512b5dbe3ea1be623d9506e71097f32dfaf5
SHA256

ae8468f86cb726ec11c954ad4042019c95aa732019f52cbdf9e5a301c59f2e14
SHA512

272f49fe84abf2fb852c5c9e83eaff744e5a78176b0b4dec2647161f068bc7560298dbd4281086498d2fea98b36760500ba84c0a09df2401de783b4ed8979794

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000ea48c881200b1c11247532468132c4ae376fa252fe9bd71d14627535f9d63ab2000000000e800000000200002000000065da1e8834f36f4f2c4ab0802c5fbf278b858726b46dd3f46822f117656c416d2000000041c2b29e1e00c5a97b186033e19e1d8ade114bc40a4d9af078ab8a7d5af7492840000000b77e63fcb579775d7c0ba3d387c1da9da44145fbf22ccf024c1584d636e6ae260b3da466f7643f71541d6b51fa101f505a9acb943230206d22fbc184a879347f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A99BC01-7844-11EF-B699-EE9D5ADBD8E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e1c043510cdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000006b79fe35f739fe5d4cc36a0253e087143b6e4c1984c8f12e396f3803b8c9f80000000000e800000000200002000000018357bc7f86f55386793a48d4b1a4c2e8668d93a3813019ddd4ce3cce93943d790000000368979e8bf512f578573740d6fecd9f7e9767a9d9c794d427d6ceed0f2a909645da23dc98e788e4a34a2c2344c6fefd8543ea8ca8f93fe5ad09ac5f0a9a8ed93979d8794ab5ff065dd9679abd83da221bdbbeef0d82d66400bee93ab0e3285c8e1821e4c7226713ba6e9af91578fe0d7ca6049f4945e97c27367196540ff4e45b4323c9638c23b63163bbc8fe58e47a040000000024596bb9c6dee51140be0b43dd7f234f1b6c10a4a18d9cd63218a2242fae68eef764bdb0a6aab37f1e693c2d151f773579d7905fc5936eda8f697cc5e17b7a9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433103944"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1632	iexplore.exe
1632	iexplore.exe
624	IEXPLORE.EXE
624	IEXPLORE.EXE
624	IEXPLORE.EXE
624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 624	1632	iexplore.exe	30
PID 1632 wrote to memory of 624	1632	iexplore.exe	30
PID 1632 wrote to memory of 624	1632	iexplore.exe	30
PID 1632 wrote to memory of 624	1632	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f05bbaf37e6891806d81b30216d3272e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccd983d70eaca95bae3455d145d43a34

SHA1
3307ccc5a77bca6e842497652b188bc1cb86675d

SHA256
07f9d7da0fe36f390ccfe39dca66798bc93d91f08d49fee00bf4c105fdcaf5cc

SHA512
f29633beee098e18059f6526035a186e72adfd64dfbb880f51f0d6e70530ed43b333fff7428fd40682f8b3f1311fd4668db6fa5872070856b33adcb0655806d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb542cf1f2b693821c62402e1fed63f4

SHA1
f2984c8e491adb2e3db657a702f83d2e46c45bf3

SHA256
a258165f19b64ec49373f429988e0899f2fd87f7c8365b69a80338c9584a2069

SHA512
cf43bd606a95a06dbd9e8f0c6735600c726400684bd9557d34cd8b8e34fefef3aa79c008e3ada47fd53e9345a12be3949449ac84df97086c495e8c8c27ca9a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62c061eadd37ec887e58c6d1df11d6f9

SHA1
1a6a312819862da6f5471867dc27917301e1df67

SHA256
d3bd75f80ca9a137d7b521c1a01bc8521668ccbf7c624dfeda25fe804089b06c

SHA512
ad224bf5b07cd46b72c8937071ba5282bb19a6c096310330a1b5373c590d7ab31816fcaff9dfeb6d6baf96fa549230ae3f8975f2d58980de8a72b905abe3f484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9869ac9857482f321387a42ddad5e14a

SHA1
6a71ebcd94a293a96b55a333bbb1b3d7589b4bdb

SHA256
cfad1cb8b3e50a00d8140d8ed930ee07b8eb8b35164daceb6e149c3eeead1046

SHA512
55b03844ea1a8c4901d74a73e89181e9af9b022bc069731d764c6a7d178fb082dce1182c696c2727cd629b90c5a8e68b8ec792175ad413f9287ddd13ef459875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b4d927fa9632e85da260e7e1a294281

SHA1
43e4c4442b7a5ef2e6675cd72260995b336699f7

SHA256
2eb04e4affbdda6d0f2102b82a28ce965cb67e7f8e8fa5d874666f5812fb8588

SHA512
eb65bba6d1e11f816e2333149b9a8cf0419386b2efff3af5a5f6fc44deadbbda9dd2f1f907f01b4330bb77278395af5d7a8a7a82b924b1fd4ae0d7e6cd6516ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ee9cebf85497a152efea92079c411e2

SHA1
20e7c83960fa51e02971971cb2eb6954fbc08ad0

SHA256
b9c0e707c64bd4ad68cc4334adae66a8fc5272c409b12551bf403c7bbeca2a58

SHA512
df435f4c3feb84e92169c26b156e9735778c6170249310238e5266e86193eea4c1c32ea222867cce35b2da0335c7b30fa07f0168a3b8227743357e5164919b3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bad60b134b9658a202734e304bad14f

SHA1
fba4f1af361312e5f414f1ce4fa92e4cd8d91f16

SHA256
68107c4b14a1f98ee8b3ff2cce5b75c7c478797528ac65b501c6449c0790e6e1

SHA512
25d8228f18efcb4991e67025085abf625e64a8a4cff7330ad6bb0f6f0ddeb8648e86684fc0ad08a475dc8506c88fc8d161f8a812b0f6275d6d1eba42eb1b45bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a595d86c5990284203cc08333234b34

SHA1
88f6c4cc00ff040f74c85810d4c57936b7cb9a5e

SHA256
8af1ebbae8e04ad4b0e87017aa9001308819d1da312ec176c0e9928e4b694a79

SHA512
4e057e2731a770e7b6b18c06a6a343ecc769b8f7fdeaeb838c70af6a36fc829ab58d5976260931e39176409bb8e141b7a7a2ecff528cf35134adfd325a482066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf17ea1e9f28a24418ff5a022765dcae

SHA1
d757559ace7c5dab73618b89e831c7fcf0ec340f

SHA256
69d6d9dd59235bbc890ea714d9949fb27c690ded9cc7a15ca97720d29c1a88d8

SHA512
7c5f82af5ebd8cfeed88098137f6132f2a43a35ab1de80d03f45872bac15ff8f652be0e8fe1b2ae5498755aeb96cb6d1422156dc2781b1c5a0b2309538e6f749

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF431.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF8C6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit