a7d2dfb7bbfaac06cebdc2f5836d6ab9433f00a478f49baa81fd56e51b4b387f

Analysis

max time kernel
139s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff2a08a129dd6edbfe0603fc76ede6f4_JaffaCakes118.html
Size

60KB
MD5

ff2a08a129dd6edbfe0603fc76ede6f4
SHA1

93ac5760406af5316eca9c0a0e74b293cb55df7e
SHA256

a7d2dfb7bbfaac06cebdc2f5836d6ab9433f00a478f49baa81fd56e51b4b387f
SHA512

7833f458494c0122eeb263d48ec6671db78ff7281f1e28536d33f98a9d7566db0c814d2f5f9cfc0719cbc02608679428abfaa51e5cea771e6efecf10d4663b3c
SSDEEP

768:SS5OhnHJLx1n7Yy+EzQO2Tku1VVW4gOnEbfhpv:S+snJxF7Yy+EET/Vo4gyEbfhpv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ab7a3fa112db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000004db9abff5043a78106b4b62443ff08dd357e79b30f4a9d413d4a5b283c82b169000000000e8000000002000020000000f82cd5d298a3ae4c7600a3a1989b4dce9ead9dd71575640f5aa142d745ffe97e900000000e8b469063b82d95cdd6fced018b3170658c3b27a66065d5379b3e946a576479b65c9ca11e12c4eb853092c71016c3267eb7fecb1b5fb2eb76fda586652a2329fafff9a16b4dd7006bdee841302af4bb94ba3e3ca2af9575f02c9fcfc5ee16a987fd6bdc21bf4231111b6865bed9c599d10b98e89a57286a8c2e1976f0cb964d3605799eefad3aedf65eb43103cd6d4b4000000062ab6f9db3a749aa93eb06d054c40251bcdf1a65d573533ff3c8610841309bc78c615b861265f5f7bbdad92298810c5bbb5fc7fa38c1509c24bbba7fdeec1077	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A56EC71-7E94-11EF-A748-EEF6AC92610E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433797898"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000df896f98b6d793800ed14f16ff35b85079c75275ea6b3ebb19a495271c96a7a1000000000e800000000200002000000015900d7c5bd0bab9c3135ccb033035b2b9861d768c5192134cbf0c47223db3992000000006ae0a716b73826c805e8df424d9f76734e231f546fbdc964d6bd76e98d64927400000007e227ba484841677b3dd75a8ad72e743a2a6b2fdc47146f025f1d4e2ecd281d8e54f2d861cc87e7d56c6bd922fbc52711cd3adcbdcd7fa8b9f1c7553a6fac753	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2060	2080	iexplore.exe	30
PID 2080 wrote to memory of 2060	2080	iexplore.exe	30
PID 2080 wrote to memory of 2060	2080	iexplore.exe	30
PID 2080 wrote to memory of 2060	2080	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff2a08a129dd6edbfe0603fc76ede6f4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b64958049e072950bc22abbdadd17a9c

SHA1
9fa15065661ec4f37130cf5f0dfdb5306742e615

SHA256
a7a218632bc859366efb45afdd5be0460e3d527c983ffd9162bda3e029265f95

SHA512
c3f8a772ac0b590260589e4f78539458b369d3a13fabc3809b562b5e9fb33ea7ff8dea3e17db8c18cefd8a08f4377c6ffadb88d5e2e0867b5396d1966ae98e98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
641f4bf6b9dab498cc73af404c27dc08

SHA1
b9ff03fe8a19db41e267d764f08ed24b12fb57c5

SHA256
6f07d2a9766df3711efca66df112c3e5b3cb3693225be3fc3a4ea2728cd312f7

SHA512
73edf5e23835dca89eb7ccb7be7cd2646664cb620586b638f174672a6c8f26a5963666b85abbdd734a74248666390b9300734f07c2751d0a431090fb526d0983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a1947db6103e244594d5b775754ccd5

SHA1
4dfc31115abd8a0764376d1cdb77d2dff0a7246c

SHA256
287ba9cef3b8eb75b10f469757ca40896bb8eee8347cc13370e76cc87a83ddc3

SHA512
388bcf8796e3eb3c1547ac5fdceeca9108a9f10dc23b5f94d3f1cdb732953634e12eb6c067e77344bd0b2d90ad860628241e46fd5f232da51dc5e23359505b3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fccf9a087297ff6b16061acf813ac59

SHA1
f922892093734623918c74ec065c7129f22464f2

SHA256
bf4c46df155351d315ee9359769e797ce01553bdace54f919243869204be694a

SHA512
085cd30a77583bb156726d13759fb1a1d4cbdab64737098047ef5e67a2811f0bf43acfccd03f7fc5fc4b7887de67115c2a94059c0852945743bd11d7a0b399f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28259b957da6aa42d44ab46aeb79d4a4

SHA1
93f2dccc5b168037802e796b2f20d06a87ce95e0

SHA256
68304307e5f34d2258ad2881d23fc05e306a1d8b756ee234ee216195e0ce9d9b

SHA512
305908c0f45def5fda09fd3273b83f6b466ab47ce6d87e33b3c5641204195c4545373bf0e752d9a596db492d2409081b6b6456a5eb9ec86e8bf8e8a10edc1c25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c47e8b3661ec3303de69415e76269c2

SHA1
ec99c6decde9cf542095604f95051a28df170ed8

SHA256
93077efd3945d60afa0e270ad227f13f3d04df86d3334dfd123c308f20dc6698

SHA512
662cb04347fed7de2c04dafe7459987b1413a796106b686abf865646885b2f0b0bf02172e54573cbda1702638ea08426192f6dddcbaeede7ef694ec22bd245b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63387900eb83f40f34cb3edfb0428005

SHA1
fbbd88f711ec8c0dbd40a89c415e23bfcd4df9ac

SHA256
78124cb8321a102251b60865db524ec80a30b9db7bba4b7b7aba11f9b2ae8e68

SHA512
8a8659f78e91ca9e983c85932c27b421449ae1e1eb7c3df0a8c8bc2ce9a798dacefa77238b866e7abb0601580bdf649b5eff036400e2e777b2fa8ab162308eb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38e262cde6deb993d021b74a5a9334c6

SHA1
f51ef060930c0c18fd5888f0e8aa88b14b8cb38d

SHA256
16e4bc223ddf2fc5f89283c8e46ad5d6b8ad65ac097d6a874565375cb1a0fec6

SHA512
234cd10978ce746ddc992adbd4b1db97741dea9c1ed52070177ac74d2fd8d546b5126902697909f576efc4e8dab80bd29d0962c307307bc327758b56528ed21e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18a0c4ab3bab550f3f1663ef0a78e0e2

SHA1
a85c60b0be0739bdac68b4ffb482d2b64d599103

SHA256
f7c083a46a862c1dad7523b8471ef3f7aca12a3fe27bc7233779175e35fa2ecf

SHA512
7cbbb8369ebc30aa8b40cc65871aab6d1ee4bf84db65755ae8c4e3a1df17793ae425b7e522183303c406db36d3e28b01e290efca8562970c49c388db3146dec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC65B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC71B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit