ce5be127dd8ead8494e0b7a5b4d2c16b5de4672ff1bec7924cfa41ce150bf080

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f639e5317f27fe8abb8dec1768cef703_JaffaCakes118.html
Size

69KB
MD5

f639e5317f27fe8abb8dec1768cef703
SHA1

473d328b8556ef05bde1503e6276702b34e9c91b
SHA256

ce5be127dd8ead8494e0b7a5b4d2c16b5de4672ff1bec7924cfa41ce150bf080
SHA512

2d8b359f6eea7f6bd37b1249b56e54c4c780779139c9f834eb5a7550b06467b53b7b07b3a5dc67641cb9426288c01dad05a51aa80e768b94bef7437e176751a6
SSDEEP

768:JisgcMWR3sI2PDDnd0g6RsIQ0jnyoTye1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFA:J8Vf0jn7TvNen0tbrga90hcJNnspv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433436875"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d7db6b580fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000f9558782f5d8c6511aa77565c659590fd488247756f20b73e874e232138e9557000000000e800000000200002000000087eb23de4a586462827e37b9bf37e07e6f098e90afcbb568b91a960eeff4f29520000000aa7ca56d33e75b866a85f0b35e8aaf71d38008606737bf28d1c157f5ddc10589400000007bf6fdebc62f1ead9e453cface214f3478ef208154e3ca9f53b47ab2ec358a00c5ccf51b3d394042af3409f3b8e8f9d3573e18d2fbed8e080963d83a8492abe8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{958DA391-7B4B-11EF-B12A-E61828AB23DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000005167714a5e03a3412dd79630432ae012efd68bc3ed431111d148e13b7c4f242f000000000e800000000200002000000093f201f0ac8482c5bacb0f2fd1e242fe612f547b81446b9d139f0ce61b5283be90000000e611ed1154123b0236ac4c95b9142365097542aa949515847a72a8a515d13253d477fb4b3c777464bb72325dcc779313a78c39d1e8f68b74d043a7d384f28169043a9b8aa85e0e812c754d0731ec2a0c437d4f9c4dc0d57cca1721dc747c416827dc07c36cc5e328e0baa1e350b0b51726a2292c359665188f94a3e56fbba1e1d730adbe45e993482d4735e9c1374f0e400000005a325db19651beddd76ad5c5eff0953a4880ddd72b6692d9a91508509fa000b01a2d6e38cb21e15f431799f683799ad6fa18466c2a8f78c7c62b53ae26c3b81c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1452	2408	iexplore.exe	30
PID 2408 wrote to memory of 1452	2408	iexplore.exe	30
PID 2408 wrote to memory of 1452	2408	iexplore.exe	30
PID 2408 wrote to memory of 1452	2408	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f639e5317f27fe8abb8dec1768cef703_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a5dbce6656f18d66103b30e620d4c21

SHA1
cba9016ed9c839efe749af1bc03176eb51a967c5

SHA256
594e9ad430ad5c8c113b2b5f29515bd217cea63f120ec4199729a9f93cee8a89

SHA512
39c672469af7f1b6b9171c9129088459058c70d4f0ea6e037fb75a9ebf14ba284da5b26d3001d85a97a8934b4f73bb3abc2b26127f89cd36689302833bf7c1f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
792b6a2b003bdce6e7098930c94d509f

SHA1
29fe3ea8b4d2de2ba738b05bc5d082a2fa88466b

SHA256
9f159ef9c6514218e0564e5bed800ea9cf0f2857467bd7639f3046b9b6996d14

SHA512
1234e4f5cbd784cde035b1b1f90a70cfc284a2f7876104bc242b3f04592c0464e854c52471e301b49d31ae556d8eee73bd4a244cd74308e4380ab5f639b0ba74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c4d29627b3b80cfbc55591490520937

SHA1
c16aeb6b8e681f6ce22c7d709c26cd396a3133d1

SHA256
b134d8a74c77e9e9d0a7c242f0cd759fabdf15923d5af7676ca6e4771928cf42

SHA512
ed78e5a7c526c525bd669c36dc086747453fa01c36351894b6334f1e0a9fdde79d816f4f73c34832a8fc3b6dc1548eca6001cf0fb5a05ae942fb56ebdd416a0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eabc33614dd8e4956f04eb00de1b4692

SHA1
0da165e9ecace182edff1ecf69fa0a74598fa954

SHA256
d7446d229843ecfb9f7c587fa83cdac6147a38095fbf65ec8c683323be030a76

SHA512
58063255fe41b01e485183f20b6d7a30ad8c63315930d105966524681b43606d7a47ae274bfd41fdc04243fdfa1883a5fd38cba454acc55cf0011eac2038a205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1acfacaa5b79cde706d198ec6b022be

SHA1
6d6e39cdb89fc0c8e2b06622d3c55cc45bb4c7d5

SHA256
e267220e38774517ddb330059d7b1a77cc0a9202d9c71f6961c4c5afcf52c3f5

SHA512
754c57a8caf256874f476c0dc95f02201a052111699f6ef0bfe4b4e98a7011e09cbff79e4ac6ce13e3592f89dd0653d456d098fec4957cb5aff3992b27f1779e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2e6633cc2449b8392f022c739bf3007

SHA1
1434882d016b239a07c3810c657a00f045605e84

SHA256
3c860d3c0979df695854835332cb860617a8f768a225a99524ce01b48dd0b98b

SHA512
8a8d7e104eb224cf01f7d1815b0a71a534e4580ebac6ae2cae26231dc58553502bece9902a81e6f3927146561d35a7b3d63bbbf116700ff78ccc5a4cae272e1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ae0f4d21aa408c8918b81beb50cde6c

SHA1
573e15b5658c2ca5af5c5671b75235020b42a2bf

SHA256
7b264c877217012810f47c76e09fe7327b784ed265273a47190ce01f23893fdb

SHA512
3e7eab9419b21ba94577156d2504725ca6895ed1996fac4e87603c97e5bee6dead0cca667bedbb21447d8ec689e38ea9402b6c5d47d5750f4b9b36c83e5ad0c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
804ebf435c880b91c2d6f8a162c06872

SHA1
5fd4e89f5c2a35fa67ba75f7ba4e81a07fc4d6c3

SHA256
bd7462d9938e3876355a3f4fb163693e508a32847df77514aeecd76de4c17edb

SHA512
7092ef1518fec9445ffa060cb10ee2b89ce87e0038ff9697d099e6786539138019f90e934bcd2e97fb8c56586a6ffb7b4850ec477dad891be3a38cce2c518beb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9eed679106e02596df342ed29778bae

SHA1
0854198d010328ce9cd0ae9aa9e2b5be04cfbf58

SHA256
0d685a64586d60bbd9f5275568e0a870f36189403e4cd07f3fbbb929ba8f1635

SHA512
7a4bc161624c86e13dd68fc9fdee7fbd54f194371717d10f482d2ec87c2bd0d1717b174762d046a33b0adaa07e60b0fec3c7440a1b05c09190282edf96c85b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40da657cd4c640c822032082fc834548

SHA1
b24dc6db8cac277bd26e600d483a7768b46cb58f

SHA256
3d5eeeb41cc01217e92ef2fbb17aaaa4abd11e2d465c3bc7cb8acbefe5df7d44

SHA512
af896d5560a6953c53cfcd1a7667005ba71f4d741aa4864b0c7ead8f57eabe72447e522c7517040ad103135afc849fd8f7f4e4605febe84897e0de5fd40e49ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e13be2170082cf5a1bc37d4147248c1

SHA1
a73e32187fc269f571cec4185c0aa0670d4d4ab2

SHA256
d7ba8c11b7f86b4709affd68511754eb9834ebf7a3edb448446b0bc7f46a9a47

SHA512
d93cee23edfa7561c490333bc5af02e9a258312cca0b41d96f0a06e3bdf1d48203196f306d74d04f1fc93bb8d7c033b23bf97e91d3560d5e76a2a4620e30679f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ddfc67e0fcedd9e938d1c95ece864af

SHA1
31991246e5736cca778397b8ed7e31e84909e8f0

SHA256
5bf3278c7681245b81dedd197b13262ed7ddb9c2b411cf3c2c98467eeca7f9d5

SHA512
f3887dcd5bb697b9078119ceb9ce64d9f0f1492d4bef54778d82e110c16eb3d40f8a2816f83cb80cd5a22dad6c55712878da81eb020d587cd3f983159a6178bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebf6c42887cc8d0181b6905c3c5d9141

SHA1
650f0f6e7ddf6704fcaa12e1240a0fe2c0a327ba

SHA256
d91255fd8ecdab96ba074631f091947804dcc9ac21c907bb5e955dc784c518f2

SHA512
aaae391e58bc76f5a90460078f48c421429c950e05eaceba3adc23809c31a79d487380d6d055f88c016410a1a9a08b521ae27abd834fc90bd519734d96e44ba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c2c895761e436749c6b6c327876d582

SHA1
6d0224853adb8f59f5d1e463a271156a912dd74b

SHA256
b6d6b8e3766daca79be9ac0d9a0a4bf768a9d66624703abe0d0fa3ade1c42dc5

SHA512
4967a01156596dbaf83b3943d18330cb338a2b7808f50e31f6f92db343e9b2f94f67b5aa7046bd12945a603a8d071a41a2a62990edb2950fb9d339b1eeac72c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC758.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC7B8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit