a233ed74e13a915c1aa9b202032ba0c2b62d396fb4f295fd53b6985c4456efd5

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb37d57d47498fbaf2886c85287c6181_JaffaCakes118.html
Size

460KB
MD5

fb37d57d47498fbaf2886c85287c6181
SHA1

3e8f2fd42e7be449be8531e4dc15d38be138b45b
SHA256

a233ed74e13a915c1aa9b202032ba0c2b62d396fb4f295fd53b6985c4456efd5
SHA512

d5a2084d5e5d3b21420ca286db30d682bfd256bc65519a6c359c617f0c25683a0aecae9229f015e0965cf141e7e112c4b89f769d592185eeb807425a5db48674
SSDEEP

6144:SjsMYod+X3oI+YSCQRsMYod+X3oI+YtsMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3g5d+X3f5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804b63504211db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000ab102f6703bd9067bef17c7b1bcbb26c5c2bc810702e7a26f272fb323c2669d4000000000e8000000002000020000000e7ea9d93cefc47dc4a7835bf2355029f88e431a54dc157c0e627842439a986bc20000000e5a06a10e0abf1336d8b63f86d7310fa7284870b06b32aa5e7afb44aade57bf44000000071ab143633e1750e6755b41df120dbc433554b69fb800035fc7489ea769f594b28e1b4bfee37b836277002bea87c408f89b31c4d518eb99b2851ef877f496022	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000fed36e4a132cd38cfb49ade7ccc1584133cfb2eefbf05868e158e555ccb77b48000000000e8000000002000020000000fc91aad07b5c8d8715ec482b24bdcbb71a8c19756b52fafadbbd8f6fc18e2e3c9000000014c669ab7e20f4863b7572eaf1f82c4f0f5a72dec5945093024c67d85b3267ff3d81b1be5652cbdb1b808e2be977a924b24f037c577ece4ccf2c530e7c84fbef27ee0ea8d9dbd12cbf416ae1b4fec195b5c99c5cdb31ef2f61f83a89d8e19b2bf170cc488cdaeb105c95488ae6e6c1d211ed77ffe5abdd2004299c330974797384f7fdba23ddaa123003784a057a32fc400000009dc759a876a3ee2cbd94e6bcafada8efbf2cc932a3312e2c23299d5a03ac56199d77ff70c16fc24a9a1b7ee8ea90fde0a42130f8cf9a669f0d80af9417917168	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75B6B6B1-7D35-11EF-A073-FA59FB4FA467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433647271"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
356	IEXPLORE.EXE
356	IEXPLORE.EXE
356	IEXPLORE.EXE
356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 356	3052	iexplore.exe	30
PID 3052 wrote to memory of 356	3052	iexplore.exe	30
PID 3052 wrote to memory of 356	3052	iexplore.exe	30
PID 3052 wrote to memory of 356	3052	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb37d57d47498fbaf2886c85287c6181_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2782dcfb0a4bcd5abb6767cfdcd54bda

SHA1
f737ec43629512abc35a683cb4956c45de920492

SHA256
d903e222cae673bc19537945f1890dc87324a48ed35fd6007c870a9802f6d8cf

SHA512
21514ff221596c41498d9e452b77d568bbdee77aace6e8bf5bb82c6e329ffb52d939bb4811e93413bdd723c1086afde89064dcc3211a6d54837bb83ce7cc61df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4122805117e9e959553b48f0a7a051d4

SHA1
0bc7c52bef3ad8531dfaccff615badba5072b1a0

SHA256
2fb9909a81fbc677b43a38ea717e823a50196960fe78c55f21476e0ed93e4d40

SHA512
ea041b5c2a3a7ec101dfe2fb1ba32a88334e106818cc327b1ef2c12e822f869c86aaa78f1322fdb512ee4eab0568a37fe450cf07fe7ff242f3ac57e439c81ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3efd675146d91c6b2391ac08fb0ce19e

SHA1
0e9dc89712810d0d32bcf6c547ba4c8cc5162e89

SHA256
d4f5e08f4fcea30d813a1ce02425025921d1609efd0a2395fadb1c22afece39b

SHA512
06cf85a83ca6d2670e30e4bcbb0529ca41cfc3005529c5f7cee8d52edd9b826f8aa56babf00e94530abd131ed44daf7d0569f201379df7a7fa85fc897aacbd15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed852309f58c8599bf0228ab35a31bfa

SHA1
9d3521f6cee541297c0e0a760ab04025fe60a97d

SHA256
c57f8fefa44720522a37b18750fd4660e5ce884dccfe3e153e1b26829b76519e

SHA512
fe9e5c070691ffd6fe7363e409203296705dae4b9a8b0681fbfb7d986af8f03fd17a97c75c352cf61414709586cfa74c08601bb5c4bdc40abaf8465ffe8e602a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ea93775ccc7c9a12305dddcd7df7cbe

SHA1
2cad360ce3b1ccdf065f8c1042eeb9601f1e1520

SHA256
2035eb3c00c0e26932b9c7ccffb8dc43d6835e14e76965f93d4a60bccc076fd0

SHA512
c9ceb22e0143dccb4360d08a5fb0896a65a490aad25d18fba1c437b7ef7fd0ef068c95a9889cc1401c7bc085d903136853b6479c25386581769bda204ecd45f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37eb3abf978cb7754d087e56e574aa16

SHA1
0a0912bc38e3643f49981afa898218d378576b4a

SHA256
a218b0a9d68a966a174431182bdc5bd2e5d7c8ad10486e64e9a1f0c64c5afeaf

SHA512
aa72e142ce8f8289e76b13edf2c60f0401ca0fda5bc74bf5822d3ff4350b59240682ebc1b0303e8571c468df567944470bc487920fb9fb9f98e7e220d39180e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88760608bc9dff7e95e5dbf375156fa5

SHA1
4217bd02d46351ad4b2b2804e710ac8af11e8e94

SHA256
f9ccc41edbd3b5317a83e47bf4a3250452c92e50a1f09245a00f7f283143f06e

SHA512
6d5962d7510d713e0eb702493dd9e95a27886d63a7303bb29fb144a5a4f0ddfea30f6cf6fba926899c1666190ae2304d4f07853df8614818ee56df7eac58347a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a57be97bf773010de06a9400c00564a

SHA1
9c5b4a8b43161bcc1fd29d63469d704de2ccca11

SHA256
aec6a42f0ec09bc3ebc6443048f7a46933137ee499e69acca09f699295f0af90

SHA512
9da9b1511a6a1e9f80d0bfaf5490e76942f22c9470564935a18a8153ad448b042c9aa7d9391541824f0c957020eb16ade61723740255ebb3c83c3e082de2a5ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7493c169b39d0eada3995b72ead29aad

SHA1
9a9e784b109efb9ac097d52cbeccfe2646146632

SHA256
8d2ca7cd2bd9e037b173bc51d2b3c77a1fff50f366ce30c379013622e4c65b83

SHA512
58fa7d7403156dd9201933d154542804cae9df10445f1ad87b1bea848e72bae0e645f13c04abb72768ca5f7f9edc1650527b2f8c096ed9765878987ad6a4fec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30c716fc0b3c9f09db0d7712b8211dc6

SHA1
745913d4fc624228e798d35037a8eb8369c41889

SHA256
b35ba80db008f206fce2aa4dc32c70d1d577bdd5baa5fe623cd240c6d0b2f9c7

SHA512
34e2e49d1a8228e8dfe460bce049c06fc78d36bf7204ee0cf1da7a5d0bc1638bf5807edc78276674c437f4d02f3205497c4065a70e30a410f343c4883bcec185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa4baf43004825314322783f5428e72b

SHA1
8d779dafb41fe8ba97c8843878662a472833cdf5

SHA256
0cfc32c2d6bd4bc20455fe2f596151ff8ea8c0e97749fafe9580ae120dba9cf2

SHA512
52dcbd11e36b964a32d7c93c78156ad9be3c9af976ffb159d8463e52d7180d60d38274ced5a94d6c0e356d9670a003c7f9463948ef20bb693de02a6b561e9b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFBA1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFC5F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit