b3ced0986d646719c26bc0535fe450b3d9f57f5c863e864f9fe1001bd501dafc

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f678e74b9c95fd8844c7f940bf26a589_JaffaCakes118.html
Size

31KB
MD5

f678e74b9c95fd8844c7f940bf26a589
SHA1

e3a9f679490aa0e409ae296d59d621e8dfa880c3
SHA256

b3ced0986d646719c26bc0535fe450b3d9f57f5c863e864f9fe1001bd501dafc
SHA512

8c6300cd8361655da510124d320317b7c57815c9ac32c14f93fab9bfcb64631fc7877aa07b45366b68e243f514bc8f918f80d69fcf84bbe447e692d702eef342
SSDEEP

192:uwH3b5ngmnQjxn5Q/gnQiebNnXnQOkEntg+nQTbn5nQmIFxTjjCs9FV/s8ErJPD8:OQ/gUx31/sFuSFFS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433446065"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000002f27eb9b484f1280dead31dd8f9b12dda0299db3401f4eb88431af3b593da050000000000e80000000020000200000000dfd0b43a24d87935c0d5d491dc6a311856274a3897a25aa1af107cf34d5fdb19000000030f86c7d4f2a7272321876fa770c05ed25890b7e8ca6d8ed5d10e19c345ee600f06e2224e81a97e3740b6eade6741d7cd55a779c5401b7bcaf39658a4cdb610bebc68540f2c00955f6ae13374a2c3bdd3dc613b6095e3d68e4969887c540331501521fbab75c7d7c1e89084581dc766fdc1867a72b3e72323c0c3902e77468f1d52d9907e210a5f7ff5813c1761c46af4000000012535b76abc1c2fa0e599200b3edc5d82ba247034bb4d5dd73e25649abd40f0235f7cf3b0a587e33b38f029a083ae3dfea80da8f51d4f97a069a9d827928de20	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB2CE111-7B60-11EF-8320-E61828AB23DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000031b4be6274b2405de062cda60db41215930efdae2153bdae2107c1de4f62d68d000000000e8000000002000020000000a6fddbd48461df9945875953a139387ecf0054a4ce0630626b01927a9419076620000000994e77e521d47be8ea40eb8381eeef3ef772eb098f3444aee006dc5dccad556640000000434dcfb6378366a3cdc192205ed835dd66534948bdf492848535420edc2c38e5d5693942c53535dc702e5ccf9e26c22152aad799c06330e207ce59cabfbd5d0d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802070d16d0fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2404	iexplore.exe
2404	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2100	2404	iexplore.exe	30
PID 2404 wrote to memory of 2100	2404	iexplore.exe	30
PID 2404 wrote to memory of 2100	2404	iexplore.exe	30
PID 2404 wrote to memory of 2100	2404	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f678e74b9c95fd8844c7f940bf26a589_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acaeb84729ba0e903220edc971c84bc9

SHA1
d72faeca456809d39b75c28c2b5030e18e21dc7a

SHA256
90d999a5798ca28ff511ba6db51f939ccef4c9962fbb6641a873e42e50e57657

SHA512
da55c8859d2886501be52ac9dce3ba1723f094ee94a8760cb0471960e9f9c3dcfc06f8f00ee004ced429d87f8eb33ad5b3838280fe18ed807b3cc2e38ca13007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
627226c88ce8a66de7d0d68e34311927

SHA1
0fda99c720d19e3762e6d7b80c1fdf239d54c1af

SHA256
dd43fc5377bcb5a22a7d31404daa02dfcb8a8e979f8152c6594d6dbfe64043a9

SHA512
7ca8510abf7e009b2f951245c6d317abec76310af4858e1a2bd1f499ad6b0cb50c05ccba4799da10e66dbaa8ff52e60a39bd237dede2d0bf2cb92d8de2c084df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e9cf439715d9d8f6a3921fa846884ac

SHA1
3c9fedb4df04d212f768e0f7a15fc805fa3d6c1b

SHA256
ee8bd93c7ae9c899ffb06e7474fff44076c4fc3f8b633febf45b8770d19eaeae

SHA512
27f52e2ee01687118efbb71422207817a6cfb6752c8b38811afe3560805e44f6ac3bc3fdb6be0356b04b68c81b062c1854639dd48a5b1b328e7e5823562e8cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4498e4f435f4f9d6b6d0cc419181f2e1

SHA1
0708f2ff6e66554ec013fe8f277f44a59837c619

SHA256
c8e8708bb709373f8132ff63a0eca9dca60d6c84b5aceecb837baaa28ade7ec7

SHA512
69a2e86fb477dc1f5c6c223a22a0a7e4b125a052e823c4745a91b86a4010df707b437feb738fb256cd868a1799d020ea547cec15405935f22c61ad7c726a14fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d13ceda3a72e64d20b3fe6e934c0428

SHA1
721ee45d6505984f652c6c1c0fc4b612980e3c32

SHA256
53d0b174950381445d173bebfc520cf9bb5dd86f9dab1f15036fa0bd8ff424ed

SHA512
f59145e0d6ee730708800fa335d4fd0976b8503ee6c991fad702922dc346f469f2c596d543f1dd935118b5aa064175aadcfe0855327a86ab18774373416859b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa6aeb7392a78ca2e06c42d0667dd8a3

SHA1
58183cffbe103c4e838171d50cf4458cb0463269

SHA256
78be0767a262c1566628b1baaec7dacf683f5db33677fe4141cb7c6e8496342e

SHA512
6b783fd746bff96e92896d81bbd60c897788d830d6f0349ec0eb4a640de0323d3e12fab1228e5449b56bd28e796ac8f5dc2a9f67fdd321ec2acc12ad42928ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
473ab6b006aee2ada428ef86986f791e

SHA1
cea6dd83888bd5cf7e269bfc2ed3ceb71be39ada

SHA256
6a073643384f7b6cecad2bfa58d20980746241b9866bf7a2f0fe5f6af338c723

SHA512
dc8c70a45ffad7676b1680815fd17d750615c61f1a2f275de73d82459285396005e34e347436c5a3edbf20f35723cf71e08fd869b30c38a295ad228105905876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb29b8b9232a664bd3a048a41f2ad698

SHA1
7cdf2aef96f05579ddd7580f58fa6f20679a49d2

SHA256
6f1c6a1d3f857ee1ba118ae793e2ebc4d8d9d39b8f5d8e7c7de70f2a9ceb893d

SHA512
71b33b5be2441aa86405c212df6b2944bc6ac5039ad088916c93f959fbcbb933ddb5d06fd056d7345a83826554165e38560848c854656605f97ed15b25386674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31a930a95edf921a555f9f47c5446db6

SHA1
c54dbebac8e198e016485892ac876eda6f02b9dc

SHA256
06e10404868ccb06e73d546f698b8e26d5391694bf98e23cca5f299ca24fd325

SHA512
aa15ebc9243cabe1cdd684f7c8f126aa75fae40556318fa672bae988813ae955051970066fa8212a434ab24b6ccec849ff8a460adaa77e2be753c56cc74c802b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70688057c31f6335458e6a33ff2d714b

SHA1
1e3a60d97f47e88b01b17eb006f9b8f8ec2cf071

SHA256
864e8298dcc2f937df209a0fda7c2042d8fd38364d960d9d15023afd60e42482

SHA512
2044637d2b6f93172858baaa804164badc4c307c556a92e2f3289b6de8da2e6304480cebbea5cb3643f0a7ccf99932ad01e8ee55babced85fa969887bebb4360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e63246025cba5929c369e7dd0d6ffea

SHA1
f3218006269dd5dcc69b1e09c1413214eb861cd7

SHA256
10e5224bd3c1db5d02c517f0a24652e044edc6a281694344acfe33fb03e2267b

SHA512
a23ad9efd8c2494ded012566ef149f52fafea1adf665aa498302d201b49eec043903c477d886d7ef7f3adc21007c25bbf3edfdfa283c1970cfcd2759c6f1fbf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c796defd82a6b9e04adb9290cbdf61ff

SHA1
1c23ad2547a98a152f7457dcf1f03a042ab654f4

SHA256
fe4a338aef5611c8d1a31454e06cb729d84944859e5304e7d6fb4777b5d37f14

SHA512
a485ff7f30abadc5681363cf64c1bfebb6033f7ddcbf948449ac57f6d5e3871938dde5f513f328d37c156098325af2ef52956e0bbd702c70a766d42ba836e25e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbde71f9e59c6cae4f52429ed5b68e0d

SHA1
4f6f7be69602d02047f4d593e70f51b3a859e241

SHA256
84b57d9b8f151153920e2665c7aaaab59d7178c4064bc528504d72a17595a520

SHA512
607b387af2f3d840ee3bea433cc64ce76a28f40d057008a42a03bca60ac697f612714c6737df3fe37923558d14a9fae625c31e79d84092c6f9fe3e33ded7da13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88f3b8d71288d74f8c14f0ee570f78be

SHA1
7b16bd9e9aedbedd3b8bc64b96955f8f82a006ad

SHA256
b3c3566b1413c91fda6c72f25faf8f47cba8f1571af58deae58154526924d850

SHA512
56d28b28744a6b9e384e0e8714ef2b6d82bd884bf96cf3bd56db1fe3ba1139e487fe980e9a0aed09724a5acf961769c63ba9619ae428c9061dea9a876a68affa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD388.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD436.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit