72de4e532432bf86b90fb9bdbe6d219f3a4ce3d0d7c43f55e2d1b0bed84fd093

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00cf8133191a7acf8f3d0a9ce3f18ec6_JaffaCakes118.html
Size

19KB
MD5

00cf8133191a7acf8f3d0a9ce3f18ec6
SHA1

65fb3128b31392fe6ac624db6823fc15316d0b13
SHA256

72de4e532432bf86b90fb9bdbe6d219f3a4ce3d0d7c43f55e2d1b0bed84fd093
SHA512

5408833b649700506bdb7e23ac80cfa1cc5b30c9eefcc7076fa945a906ff88a8ef0b34ee0d8dfd8de6c1d4a3dc6e3cf294847ef6b8a73d5df1c78d7d9b12d390
SSDEEP

192:VQ5cVZ7oxovwLMQ554ba08EFhI04YLXg9dWZSj0VuPfeHciXOdJgUZLallUK:e5cVZe9zeMBdWZSj0VuPfnfK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000230479b21ea88eba8c1ae91b9542ccb5bffb52e7a4a85c66ea228a29cf3821c0000000000e80000000020000200000009caeef29c6345aeb874bfa8f11c7daefc7d86f216e7662807978546ee5d85d6e200000000bcaff1f3161281df2daabfb81c1fd8a98a8b1e5a5222fb7cc1ed064ad3a9537400000008945f0dde7b7d5091df311d9259a6c761be1932b913b11e82af7f2551ade7730e044a8c545409cac7a17ebafc8148bdfa1601889d6f7218a09716a77bbedc46c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f3e5d42113db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433853188"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5CD28E1-7F14-11EF-B59A-E61828AB23DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000000de8907c4485aee4246ededd913000f12d2605d129ad04291149d0778f1bb1ea000000000e800000000200002000000060ae7b7e19df22fffa444c23a8bcc2438200198bf348ee62d81fd4bb4b3832439000000001fa4dce6838278bcaf3393281a863b755f35f35ed369fed75cde930b7240dd2a64642b9438b4fe748cd26e26e768359a7f7a0c1d4bd65c063a83954d3ec763b2a41d35373ef7cd6e0e16b1b508b3110cbf26436bce744a89e93ef25b57c528b5edeca1059cd51706431dd126f4ec9427b758bf593c0d71c077a648e667ba116bb5fc68d779bc55b5592b62b15957bf1400000006b4ac377863e01c7cfe3fdf3ba768a2bba1fc20bf64b054704fd96c0b78b1ec34bf80124948aaf926cb2d026e49c65cc8a1aed094cd1e7ab34a9b832da89f728	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2124	iexplore.exe
2124	iexplore.exe
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1512	2124	iexplore.exe	31
PID 2124 wrote to memory of 1512	2124	iexplore.exe	31
PID 2124 wrote to memory of 1512	2124	iexplore.exe	31
PID 2124 wrote to memory of 1512	2124	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00cf8133191a7acf8f3d0a9ce3f18ec6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c701501a7b80b85c7522021cf6ebf3ec

SHA1
b02899d6e080ef70cd1754773e5f8bc91e11edc8

SHA256
192fd5e44c376e54e2dd9723fd73c33b8c4078f520d5b8fb333f2dcbed400266

SHA512
e9cf3f58729f995f71b2b3ac97508a60f66715ecd4900d8b2a19e0b6b8c348bbe6dc394f3a7144e89756e20c1c735efff55e73c3d0d6f1b0623d8614e36843df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd565754508e03214d6c8b83a74bc1dd

SHA1
61bca99f81e58c88fa2b1aa93872f4bde14a3ab1

SHA256
00b9538d7216a3ea3d01ebe890023ad5bbb1d7c4b017c2f343d58a4d70921ea6

SHA512
fdb44933943710db355ee737ecb6610118aea68e31702d3c8ea352749b9f566d1e8174fed21cfe2136fed10211b7724c935efd47b8772bad8ad91d62f32fa516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dc202645f1dc8580a727d1441e87153

SHA1
fc6219884880d9720016e76e1010b311ca46f02c

SHA256
0f537c70bb479eab48cb200fd33f8a72f9e4767018900e10d22d8226212c409b

SHA512
1380e63029a55af87097a654e1b058cdcd006a2bfcb8548b0f449a56ede229f63d54f9e660f9f2e783abc8c0653928d68c2b29900485a6452e78e6c0a8d3f75e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b46a521a9727c827b2e57664bedb5a04

SHA1
a66984bc379e83a61623cb69cb625e8081049e78

SHA256
719cba0c39571c7912764a46196819319c6edf389b5a3987cd3ca7f51a47c48f

SHA512
6405f970ca5bb0c76a9b88641ec20e1bd35c970d676e61aaec3ccc96287b066e3421962bd49a7c0de0be952c35b09e45dd43b67b6daab3b0cd3c69e0b14ea00e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84f58420a982c093591f1979b304cf4f

SHA1
d44c3f6df141370db7b4d1d120fc8df1520626a6

SHA256
bb8d2fd4bc915be63f836a0db7d85fd9886bf9e66ec5901ac309d79c55722f3b

SHA512
9fe82fdc7eeed62d23f3b73ba236f58127660ffdd7620196ad8e8d328a6a4d6f8456b90b835404ddec1956c689600f61572e907a4f558e7f1513914523a76215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
302f0e6bd14bb519dcf97cde2f9f7453

SHA1
a07d31cf94496468987be188aab457623fe6facf

SHA256
51a0298950231d2c096b22c5beefe27015e45cad7c07e8c2a4cc2b94a15993d5

SHA512
53b96907d94329492f5f12270dffd64e353592bbe1b20647372f0bf7c3cca9c049a099790b5f0d5f45f75cfcb5356c5f8f2b5288b390e361f1d3ee6a56354dd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e24b0d212a7bd95fe906a055a9cabb5

SHA1
2f3f834f27dffb47a830b04117968157c281f781

SHA256
6c9095567deb901ef06f9fd402e8a45d349387cee112f8a6a82de0d415e255f4

SHA512
27b6bb8ade6a65d46e05666d489600cefdcf40627692d31b51dffb84f95a5e31920a49fd248d048725e71ba076621cb08f25440a59dfe27ac2315bc0e6bf989d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb70a251b3d6704a21caba976c6a8bfc

SHA1
5dbfec3b9035db7eecf28aab98ef3ae9eeded744

SHA256
afafa6cea588384f715c501052af4f7cfbed144a16ec3fb3e12939f52774bccf

SHA512
c165d91c98d29d2b2d0f8ec07c86c449185f93b745f44778d10166579c4b66eb2bf3a876a0f8876659e94fedf31c3fd895165dd2fbcb310b997294c6e270d48c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
604a49d279b9c967a3b93d46fe520198

SHA1
8820640cb67e9ab0187d7b9317c99b1a5f0bb6f3

SHA256
3a066131328bd0e2e8af61d68802b1a507c101c1a209d8c17eb612b846536bba

SHA512
37f8a6f9b54f2b6ba37ad1eaf6856cbc0f4df5b08302d69e9c44a6097c453ce83bd5a3e40e1b31e5440f507a31869e6f2e8c3a9d068e07131be5a0d1788742c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c0a90b3c3b98602c876f10627234623

SHA1
df65a6ee796951e8c54fd62cf3279501d1b4e7d0

SHA256
2dd5c29281cde47561dcab99e86c3989500c900c583e4691f891f2e07bb2c664

SHA512
24a1f2f875488c12f45d603014a7508d70d81b07ccd5d43443b46e8c43b42586b8baddbbcb5d354d9c80f47be4472c746e715689c7d4c06aab51f0b52ce84d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab97B0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar984F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit