e23855a9d0d536fa39ec5e29d5908caa2616604aeb4321628eda51f72955dc01

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

00db20ca2539e6afa63ff6ee297d5234_JaffaCakes118.html
Size

162KB
MD5

00db20ca2539e6afa63ff6ee297d5234
SHA1

6d87295a7ad2f04479c52e1426af10c156e6e7f6
SHA256

e23855a9d0d536fa39ec5e29d5908caa2616604aeb4321628eda51f72955dc01
SHA512

91c4dca6235fd336ed93ff91c33e638730e20d7c4740d248bebe337491a1da573763046196d06a15c48913d09d5e1d818c79d079b3e0479bca7b20fb94d74787
SSDEEP

3072:SdV2q9AmelAb0PXjUaoT0O3YKLUvlHdUceUKC+1bzPvhHdyfkMY+BES09JXAnyry:SueAmelAb0PXjUaoT0O3YKLUvlHdUceQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f66a712313db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000009cdbc35b33e6d0e88aa7ae60fac9d8a8d5304f0ca3a46cc5e0c3d9b3b00f1092000000000e800000000200002000000069a883196596a76764a22994aa9a743c2c485b1fce17a81221d4c696c19b394620000000d64eea2395bb64a4aa4ae266db16ec61fe4b4d4c7021ceabb4f8d9e2cee79d5d40000000ab9a2d4d612cbf21c5a263fed2d7b0db8231522e96cf0f92ac722e4626fbaf892abda2a3dc94838b0aefe5bdc8a96aff978ba66e739e5328c175b187b58fa405	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BDCED91-7F16-11EF-9D33-D6FE44FD4752} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000502e1e081bbd0134654e5f4258376665b7d2bf7fcaf63239963c04aa2c1f6208000000000e80000000020000200000005a85b2b62bc8e470070c42611ab96f7868c1d6b32797dbedaf998bcf2dce46ec900000009d60bc147628f5936950b09febae5644255e0876b4ec93a465feac479466e232919fbf93305e46b2a10420e2d5a1a01b21bc187caa4969a0fbf8078991a659b02433bb59e5fcc3b3bccca51840c786025ea452eb73f67bdf713952890b09824683a416dea0fb7869ee8894149276d2d0f7f0bcdaa211941a6e0b9129757fcb404e2164695c68d8aceb10671e7bc2fe5640000000322861ff0741c8bc575c4137218adc94ef9d80ec928ecbc83b44e7f3b60cbcc262c080b33beb0f172ab521517e98e2dcb35057904b1411906540499629336787	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433853923"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2756	2364	iexplore.exe	30
PID 2364 wrote to memory of 2756	2364	iexplore.exe	30
PID 2364 wrote to memory of 2756	2364	iexplore.exe	30
PID 2364 wrote to memory of 2756	2364	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\00db20ca2539e6afa63ff6ee297d5234_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7b43a13559333974ac9b331303635e4

SHA1
fe3334b1ee686d49333dbd2278847646a7653a91

SHA256
b6a49377e58ec793823727b6951e946b2b0bf0b3f21ce205ac628276755080ad

SHA512
48de31324e4a8b2012d71612878b4a8d0d4a99f4c47b6ad025d830af0c6d9daeaeee7749087be9697c4e68908776ad448c5381baf269992e5a3e20a12210e625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
354eac4629924a1c42cd5fb5026ad369

SHA1
3085aab0e2ca5e9e56858b10dd722f0cf26a116f

SHA256
99c946e8464cbc6a50c1f3fb83bf75fb10de3dde60772702c46c0a1ae5971b9b

SHA512
64fadf93b317b36935231b4bf15bf66114288021c50c6d102a952175874553737a030a9010d5e651f513384259e1a446fe6ee97dc1fa7ad63d00d17b7686229f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ace49597ec9b8a414554b5cd843ec84

SHA1
d922deb5955d1de528bc49b18aee46fa503cbeed

SHA256
4aa6ee3e9c9b3b4bfa619262cd826de5e722cb5de3aa1047425e7fde4a58972f

SHA512
abebb215dd45a54e024df21b71ce3dd36309a074b37b30946939a0898d388589c9056569cc719e1605dd7139b675bb6b3e2028701c5d0e09c56d02efc74c50ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e32007e89a964b14647ee83ea0f0c5af

SHA1
19f5b3e13c72949be9d7966b6890a4a74032bc46

SHA256
29d512251e6d66ec4cbe6a3b5ad35070d8d6a94415e5763f86ca1a6f8d62c67c

SHA512
46ecdf89c55aa8d27458542cf2df7e28f00372f6971ec19e0f12dd3847ba4ebbf1ed5900f955da6f15635179cf2acb57e54bf5be5e6ea3dc20723c37bc7af410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71d233c970197e4ab3ec1af7c4d0acec

SHA1
43a837c98e187410753b3cb3b576d441eafbb4c8

SHA256
2aa67aeaddd173f2c68a4453cef50358f49ff1100ad2794f947fc1aa4e0a4e23

SHA512
e9b90d7b12d2580291611f6978ab53b7e2a998e4ffa8941a1a1f76696e88398f7289f4955c83cd01098d3ca11dbbc9813f7fddcebb4fb131edd98ad1d247e0f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
542f2862d78f550cf61177f523586aa2

SHA1
78aa389373e57e1e113e4d5d927465a5bc86546c

SHA256
a37684309398d9b8cc1858d382e1dd1df9ce99db4697698644224309996085fd

SHA512
aeb7146c4a1db39e780660dc729fb0712a34064a8eb96623bdfdea88ece63e2222920980c53941738eb50274256543a7ce85c4705596e66938223c626662548e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7774c1241bd1ae3de3c1aaa9542a1ea5

SHA1
b44b1dc0de61ca55e0be1e3a532de9575a9e8103

SHA256
ef4fbdc190ce6b087a24a687f25b61b6a17a2580ddb18270ba84936d1baa8f97

SHA512
594c49bb25b7728f95dfac6045b1312b206629320927a2a28db57a70cf90a6848950cc6d7e52736e7ccb04193e4a766052041efcbbbda11aca3b06a5d60484a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcb9c70ae392f00bd66f584bc71fbdd4

SHA1
e02a487ef76bc857da26491d5b8e4a5335312a58

SHA256
298a4f8d4bdab694200eda7da7860d05a3218f5aeac51e412469824c7e5759aa

SHA512
fa0ca272d9036fb0bc3797eeb6f6e6ae61d2b2556cd48181965d60a0e374d2001f6090914244d51e3550dd3e584ec60702da4a8d64adaf9d321111156eec239c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ee7258f5a4c3a528df4f315114de284

SHA1
eacc835f4da99f84a9c319c5f4f574982d92e3f5

SHA256
1241663a3a8e5244b204e8065510758568f0a14b91c0eac14731bc64286c30a3

SHA512
6d50d5e6077caea95c36de3d3d60afbdbb94688a7861592cefa31d4e0eec8c1eeca2b609fcb0f41c2686d7e3ca1dfbec83a931a0d3b02afe6f7767995a1932b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82e6b9d50deaf6d8478141d6d6dbfa43

SHA1
3320058e3829b69b2c67be05ffd3979935f6e41e

SHA256
9621bb6dec4b60d5bc9f10fa6fddcff9563e4b03c01ed2739566f44bdeab8690

SHA512
f3dfa4698ac8c3d67f022d53d507b3b4c4c1135cf7664ef725ec9e76e31215f0ef94fdfb52f3a93cf3e7442eec2d48e5005880751f645ef9a7cfb47a38318d55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94b5fd4b57602cb1a5a17e2240f3bb62

SHA1
40cb92ae402877d82090af3a82d30959783a34f9

SHA256
95dc26c41af000e6ecb19740bda207edd2f5c219f063435906295d87794e970b

SHA512
78b39c8ee31c079c0741458ee4fb542c34f664df118131a003267d8d9a855d8eb89c99c0fe5809e404cbdd385d63ee5a926977b1000df1ff0b195ecce4a714d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
475cb48a4689acb30883a51e18acec05

SHA1
89defeb6f64b26858b141b89ac25ac6f2d843ddc

SHA256
7fcf880b8c689413153be9ffabee89fe828fefc64d026fc4eabd98b290a8d5a9

SHA512
6813fea2388626b4fd78789f808915e45be95733bd454eff5c5cc5f4ab77ef0be6deb7488f2f363dbb1c36e6bb821d1a023eb00295555a6b6a395ed1a1e905d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
672189b658259566053c5d8283f70c07

SHA1
fdf87dc554ad51b8b797d4a0f61f853eb0f649c6

SHA256
7d8b39945d8d8a5f3250e743e6aadb03a384195bb15f929f042de3f02a1a0f33

SHA512
1a8f64dd6fe98836ab5161e05c19de6d8c9a1b44eb53f463c79a1f3a0629651bed8a85734670462ef8d23cacef195afc48e90ad392ca11e30c7f08e2445d5639

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab74A6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7545.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit