48b16b8b8c2fbfcad1850268e0af05f7415ed2b972964ff7cd24f322b16beebb

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffc45dafe77a1c46d1e1b906b43ec4d8_JaffaCakes118.html
Size

4KB
MD5

ffc45dafe77a1c46d1e1b906b43ec4d8
SHA1

9f434a7230a181a41f4a5c0f6f560dd86c977c37
SHA256

48b16b8b8c2fbfcad1850268e0af05f7415ed2b972964ff7cd24f322b16beebb
SHA512

1683c75c6ee850e7459c519f275084f9eec18e98302a29134bdeb4e49d8b5fbef81395176ffba77780b0cf6489d3e3aef2954818b29758c46ccb742b2e75cac5
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oO5qfaMd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B46E651-7ED3-11EF-8318-F2DF7204BD4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433825091"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e3cf4fe012db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000065c2354186754e205c08da3db2ce9a2ee308103ce31a82a5d22e8a90cf188279000000000e8000000002000020000000bdb04702a1323c0c9310024084c1bf7de5813b33ad7b4060523ffc38bc7d94cf200000008caf1efefc09bf7d0210a8a5410362007ea6497d94ed6ee4aec594036d95d78740000000bd4585be342f7b761908afecd7dd10f85e1927468f39bb9c3b3dd95286b4162704b536454f44d1331a0d117c0b0e42607de577271c54df2947bb5d70fee8d225	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000e974362e8211ae9c43591bff0c48b2db23b3498c3b795a5f6771f24003854126000000000e80000000020000200000003ffb16278fbf4520a9d0216b626254c2bbd024ea9896cd8a5ee0cb8b44cc52ff9000000046282e167d7d6586af64670e4f47e8c892b9f97c2e790a671bc94df014602b285f8e9c5f6cafa33567cdb5f9230a74c9114097e3bf536e72320e23ea5abfff5c8e74791a50e02c8ea2d75556b47ac3d83890da4060d7cf20794b4b20677c93a2030196235622d9d035588b137822835991c4da24ac1037d78638a2613328d4706872390abbe79df31a455e6d52009bf8400000009aae1f7a07e12969930f8faf08bad41cb0a041dc77205a7755760fdf9d9f339d32a532877301d6a33f0652dedd8945845bcb0b44030706a39e2bca054003af5f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2876	2128	iexplore.exe	30
PID 2128 wrote to memory of 2876	2128	iexplore.exe	30
PID 2128 wrote to memory of 2876	2128	iexplore.exe	30
PID 2128 wrote to memory of 2876	2128	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ffc45dafe77a1c46d1e1b906b43ec4d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
598da150e99105ac0ae084e365dbd397

SHA1
dc73678a8a9e7d206dd7ad1254213dbace1c6ac0

SHA256
6bc7130c4606a1671042b531d6eefb30b93abddb679c0587b16c663cedef5da8

SHA512
a199f1b14326e8197f951e79a4e8ba9f12c5b700638e9b67f76333e43de1a51a3ed4232dfe0063e28fb969e8d736dfa86eff641c1552abd19661448a50d992c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ff4271d2c9b9a5ae470235205df5a27

SHA1
f1d2219473d5492d3865ec1a4ab74cf7d75c0f42

SHA256
543221412f4df7c52e842f64580490aff88eb9f39e4ff88eeaa486516703b23c

SHA512
7b23b4e981da8f6622c38112e34972823b649263fc4b8b670c9bad36498e9c94545ea15e4cdd7483313c9ba4469460f183fa81107d15ccc5a45162d7a16eea64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6dcbc1b3bedacb9f03e3b35cb8fb9a1

SHA1
6aa537be2c809c2e313ddf4f496a9c300fb2b847

SHA256
33e339621befb6a0de1e675dc473a0bb7e97f935b5fc04edb95a02006de65d8c

SHA512
6ead5e2644afc5d755738664188b888355574a7426af8d0b607cdf84463bb5d9aa5cb27d84a6a741ae2fbc921083aca3c63c1dbc0ab8a4b742cd5039d6e33e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8da4758a531f07370515aa199b11ccb2

SHA1
6af6c7ffde07838da421f081910a5bbeb0b3ae54

SHA256
d1e9ed53d5464bc45a40951aa1779cd3b13b079a323cc3082830003dc9516669

SHA512
9a0700543014842f1507eb7d3b7c3aecd9304f2312a11ddf63449a70f742664ccc9bfcc1ddddb472c71dba9c16b457cf7183a85df35de7c34f620928b1c2d8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26ed63ea7c10f0cea30dd777ce924dc5

SHA1
56bda0bf9768561d4ce15315da2f6c32c4c91649

SHA256
ed970e699de4036158b94cee2e902f0d4972f5c7b54273f9601d6c92ea6f3f6b

SHA512
c1d87528230904ed7cabfdbf89888f2d50b84b5316a3e02ce75420bf4c31c4184510eab4f11d36d923f61a521f2b4df911605a820d25c740d9eff3d3a3877c7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9ba08ec9767357165f959354b068d43

SHA1
58e593be79c44e4b6fceea2049b0d273b745f2ee

SHA256
e47d06a93ca265c0ac6fbf5312ece6e8ebfd282cd31f4bfcc5ec88c9880a4023

SHA512
bdaf90c36fe3c4bf3cf4b6e0ac35c8e0be8185b2b276541497cbe5989be2350657074ae31b12b925889aeaf4697a8f8f298515250a6fe78a3f4346788d728b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0da045f7478e8e48d6e48d3bf14723e9

SHA1
4f61210668ecd77d031d01c7d2311b8550658054

SHA256
1b7f4216528f4c9aad36441421524e29bf8c8282dab3a782b66ce451097ac6f9

SHA512
998e13ad53f6fbad522f7cdd959d35d0d332843fde6d104bbedd30a846f34eb49f671d10ef0abf39db1025b460800b087ce42704964ded5e9b2b312e1ceedb15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa7a085d5c79e632adae0b9826b9936b

SHA1
904f96204676b41d76087d302b90621fbfa5566b

SHA256
6a89359f88c7be8b1452f9b3f27b08208b4719e253362f111ec8faedac25dac3

SHA512
438df9b2cb1b2e9ecd0007cddee9b8f15d5f437c922176475f8a0931119442954d55722ae9d5c5d6287a5847174a5804996af21f96459b5d4896bbd55a0bb387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1685c5bfbed836d819365a599fcb610

SHA1
a5598cffb96868dc500d3065c46bcc023f0b4444

SHA256
869859ac9576c2a45a78782fb31fd338e081f6bb3a88981ff2d419771ea422fd

SHA512
6434c65186437d49f4d7aa7c69fcde510563349c5661c895cfe28cb4c2dd97ae0d58697a02548909a0f935507e834c0fb46d8cb452d2f14fde4f7f3272b40daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b748600a69b499bd2a65304621b0e348

SHA1
67252839ed550a18219ddd8147e4ac9477b498f8

SHA256
e3106ed46636e0ed01bc047a47e0e9bab389f5f64fecb0873613adc23084aa1d

SHA512
fdaf7284e9284482472ff9c09dfaea2426bb10cf2ec8249910630cd05d358b2aae7150af1f4e6d17308838cd8a76b480104138cb1623457de5a03bc099f01e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ff503fe842a7f71072ffb9813f13e1c

SHA1
1ccb90aa7272eba66a32d341b73096639fdab227

SHA256
7950090b1849ff4a6bb44d77e94fb597cffc800c2daae11b3bb7a722ec9e5c2a

SHA512
26ba19b871614338ca9702b6d435f50a948bcf8f1617616992c9f5a5b73ea21059d51b30fa8062503924d9550b81e1a9f30017b7231186ca8535d540fee42c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3871f5195255bc7596850b842d72b307

SHA1
242a51b2ea187c8f208cb4ea0d9728e10429e637

SHA256
8bb8cd3ada1adeac467d814dd248b7104eae375b0f5e49109c2f94294475b977

SHA512
d19f20aaa5c5be8f4feaf446d6583432c3ed2198ff3a67dc7cd636bcdee2ed0e118c0915602cf08d2022bfda525fd1fd6df14083b9a8af28e5cad97b08816653

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E5E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E70.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit