deae68a7fca84752cd971007b4684c0e62d83fd266e4d556ee31486e1337d997

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6b61399a165ba0c1ee96f14403cc8c4_JaffaCakes118.html
Size

3KB
MD5

f6b61399a165ba0c1ee96f14403cc8c4
SHA1

aeb9dd2714ffb916ccd2d76f71f775cb3559714b
SHA256

deae68a7fca84752cd971007b4684c0e62d83fd266e4d556ee31486e1337d997
SHA512

7d2a7fb56ad6fefe206f6b0f49948d095d612a9739e887c900bce4146cda1709267ff832c4d1b663212f08209d1be2630ecb5b7080b2505167a103095e0449d8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000099fc6d98b80dbaeae36113d6eb5a4be09fea312b53d31c2b55f1a79f96dfe1b3000000000e8000000002000020000000ec6235982d2a8c5e7bf1c1a347359575b5cb5069b021590236f82bd17aab2063200000007b225d8ebb6c2684808388d4b285a961e03de20128f39035ed6891d57f47670f400000001d265d038b3a515daae02a44107bce2cb7b8b879afcaae97c75251d6ba12be7909f6a8098671dfa675e048c2a904baf13fd6c249b52090cc830f1312fc71f9b0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433454537"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC915861-7B74-11EF-8C6C-D686196AC2C0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d097d482810fdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000006f4f4f0fc3236bcbf7eb3ca919085f3a3f7833f6988a431336c766a09dda6e3d000000000e800000000200002000000014d708651be1c3d6aed2eb938889ad9cd99f95b2a596f6bfa2bf099ae3f9a023900000001b6acc36ebc75a3dac2c5df20590607c22e75cdd3aa2c48c7dc3596eee6170e5376d21acd104fc8b5949d7c446d93db70386018058ff3983bea8daa8e260fb245c89c6a925ec3dad98959622a3e09ca3c37ce6b868c999774ece6ba02676393ea34e282ddbb10f61dcce5f990832d502fb59cc18d24082442637ded1dc204ab346e17c5fe79b6d9cac2b0e12487392aa4000000003e981cf2717f63afab56e30a3a5572c352af8e75f3fde8dcdd3314a6bb0a018dd141a3d5e7446b17f3712f21604ff57a982f4254baf43000702ad189a3c7705	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2960	iexplore.exe
2960	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2136	2960	iexplore.exe	30
PID 2960 wrote to memory of 2136	2960	iexplore.exe	30
PID 2960 wrote to memory of 2136	2960	iexplore.exe	30
PID 2960 wrote to memory of 2136	2960	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f6b61399a165ba0c1ee96f14403cc8c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
618f4d030e4e1392a853d5a32ecb2a45

SHA1
b00aa094ca83c3835bb1e084a207976932639479

SHA256
97147546b216e8471da79432c9f0a06f86c79a5ff3714e073a05496c7b5a8ec2

SHA512
c8112a099e4acea92155d6d78367dd0eda1229845556562e05a4a7f339c630262f4b2e799dd8658eee9c63da601300df86c5b5639d23a825babb0329d0ce6d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
303e46f100ecc2818f8ee5c4956fd171

SHA1
ac2b02e2218b1fa91cbb264506388ffac0807705

SHA256
948eefc2fc95340196ea334cd5c3e0e2903ab6535f6c228c1d2ec2a57564cbd6

SHA512
bf392863a7adf848cfb118784287ae3ff10906e413c13dca02de5bf31730fc6abde82b993d4bded1df3797bf75bdb701594e3723eb0709bf1b8501d6c39bc3ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16db81352f57e5dabdef2f773d21e3d3

SHA1
996f6e662565b913c4bedeaf930a02dd9b70aa9b

SHA256
1ea9980ce2a761ffc19e6e768b48d570b293f88eca47a048464754b19fb1d255

SHA512
5f6bfbe782069083de8f16eee420797e0cfb0a8db3a1f8a65612946f396f08f3cb160b27b21188829e60e0b696aa18cd2fb9384325e4248824a164e6f213829f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff1f7c8fdb95da1a90da166f3b436744

SHA1
58bf8651604e7876a0692503e2ae39ac24c38803

SHA256
8d6d250c8d98be36c495cef061151c0d1903bf63763baa1773a2017ba7603398

SHA512
9c22bca9695f859e398c27e94bd44064a6dfdb7e971b8f6efe04e81662c40297a0a1f1f32a0f1e76bac420a6dc099c83266c5bb9c414ae5ac524d42259bd9524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6447d8681d24c0c2856ab75d940dd4f8

SHA1
0995ff5ecd69e06f6560708f0bdbad86f08c7c08

SHA256
3df9db0fa4f7fb0812ebd67a629c9bd4e184a7e01d40d50c66c86a2a639c0108

SHA512
44335c1fb279f31d18e58038a1066138341eadb68f90ecdcaed46d1a2105aabcbb225bdbf2e1c9bc642fe9b712bf3653054c72aaea78eed51657ca40c280726d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dea53cdb0ff0bb2d46bf40e7fcb7325

SHA1
88234f6e7f2862350932a36f24f1070f3d01897a

SHA256
21e4940ddccc6ff324c8b8f84575c7a9295728b5a1bb07603405f1766ea3e91a

SHA512
9bbe4832a9fc1129499ab85e47a6972e4e3f851d3aca8eb3f0041118934b36e08ed185f354d906f3043ed6ae4542e1e455ef4086856f0d422638bdff4a0c476f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5ef3d1e7dc9e8332e03c6af2eb73d2d

SHA1
5feec3e9fbb52fdd31f20e72b0253ba8503edfc3

SHA256
862cd0bc0a899f8980c18af4a5a024480aab23be4e1966ac0cf5d7a8acbcdd13

SHA512
3e90e0c23c89a0b7d52669a6b7e2a6eedbc567dd7fd2013ea5ac30ac3e6e0ce0fc9de383c048e23eb09bc01c2044c47b28f9bbde866d1e22137e827ca9d40f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c33c7fed31ea288f49079338fe26dacd

SHA1
5d7b27624f17176c2947054675c7eaa127f0f2a0

SHA256
3740ac5b2d2ce7d230373d0f489f9cdfd6b1d0232b20ca1bfab469d17f93e2d6

SHA512
94b1a4fb155a8b6d1e0376bdfda8ade89ad2126fe8e34bd3a881baecd7d6e5040d9b17e5de17bf9552fa7c26bbf723fea0cd172d66561df69771ca632aef8ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31722feba2d89ca56fb2b24a6f65283d

SHA1
bc0df0b260125e2ab07ee7cbb30befdaf2c3599e

SHA256
22c24700d08600af5bb80141f08da8ac061ed76b683bbaedacaa10f50fb547d0

SHA512
425e0e93b29bfa1d6888258b79972ad53f9169b0e258cdf5d74ab26d4302c1258bc2f8862c3e678fbcbaf1a41e17b85f852c52ba965c3cc156dfc5eb06bd5e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC7C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD0C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit