ffede4f99897448c83d546407a09007d69f749f6107d2c21e0d6bb400d8b262b

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01340d46247cc4a7b7d96bff12d19d0f_JaffaCakes118.html
Size

8KB
MD5

01340d46247cc4a7b7d96bff12d19d0f
SHA1

ac00a5487b814d9d1551316788230ff64e28eb10
SHA256

ffede4f99897448c83d546407a09007d69f749f6107d2c21e0d6bb400d8b262b
SHA512

9726e4844d418fc1effabe62d43c57732a857a60402f4ad420af74e5bdcaa508cda44d3ba8a1026686494179c2c7da5b84c54677082fc889b0238009820a1195
SSDEEP

192:0TFmX9p56k7t6oe3U/QTxq1kKrRcJAlfUPB4mn4+MmCedvx5hRGCCB:BpVAFARf+4m4xmHlU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A358E671-7F23-11EF-9CC3-FA59FB4FA467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000bc3b07eeb26ea92e1e55196feb2f3f6f3ac84c31ed4143a8b1a266166e9ff021000000000e8000000002000020000000277c159a75775701f97e591ca5e0ab63f2a7d341d6f1cea22eca1e6f4a6d903c9000000084699dae3cbbbe7f77904bd59c3ec0821918932841ce447994cb34a7b3eff4f34d8e7b8e848055d922a77ef44eca67f814e5bb99bc9676a5086a71505ae44420436c1a6b3ae55c7947ca6b23da1e590d85f643cba088801a161cdb3a5d5f40d37ecd8f3cfbf54e83c8f0e578b868dcd1b5d75cdd4e9f3a8ad71920a890cfec3272e2f26e71aff1f189ae1293f28b801540000000fbe0081cd0133162f3147988d9df1f7e28ecac47e1de4aee67bff616bd20225c6c30d67373d717e365fb26b225a89e812c19fade7f72d21594bb1caa5f0432a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10317e7a3013db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000028f5927fca345baf7fe9c28587affaca69d5c7961487b54992bd1c32532d1fd000000000e8000000002000020000000d80980c35aedad9c29fa1480062ca36eb62683455dbb4535616309c1013af9982000000041f27617638b3be38035da51bf62f49c68204cf41a7dd4c73cfcacf588ab5445400000009f0d036eca6e6358cd25d26c1f8e5ef0d07f3749490d768f6e777e3a84bae3df337c0ba07f201de19d68fe4c815ac93040ad4ff9e9162326a3c17931f5989d82	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433859518"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
1480	IEXPLORE.EXE
1480	IEXPLORE.EXE
1480	IEXPLORE.EXE
1480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1480	1928	iexplore.exe	30
PID 1928 wrote to memory of 1480	1928	iexplore.exe	30
PID 1928 wrote to memory of 1480	1928	iexplore.exe	30
PID 1928 wrote to memory of 1480	1928	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01340d46247cc4a7b7d96bff12d19d0f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66ff79ca38052a803d606b9b9ad67014

SHA1
5b0de4e6750ae1944dca9cd05423859f27cb11d8

SHA256
ca0e9b83dd5d5e36827efd6793a03677ad8f974bf1855c3790f3d2521e3a5235

SHA512
210c325806ce07b5043aa02bde9ca6888da136bef8856042dbc9ca5b1fcf9f4c3e65f313c2297839d0241d8295d2b7b44542f8de86cb4296477e391462a5625d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e974ae8261fad14953fea4a286595ed

SHA1
f8d68cc5f3c96bfba6635d9cb4af73e0775609e8

SHA256
8cbc1f3d595fd1a8c2e3d8338024866fbeee4f742caf41cc713d621a162d778f

SHA512
d31c435cc48d321560680a389cd5cc95c9fac88d990e358d01143e046c3fccf6bd1d3c6974f5aa8a7c55dbe3e7b454897b9ff59e211afd35fa2881540881091a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d418cb2579f11f353b37bf183e4e6034

SHA1
d27636e94a3a00386150d3bfa51c13e8abb4599b

SHA256
7dfd15e2bc3aac35421bcc04c3dbceaf70fad2d761b933f568c0427e0cac754c

SHA512
8257a5c6080884a7ff8cfc5602854a93bcddbc367ead80a391263219fc754b04223b623cd85ed14da8165ffa3db6069fe2a8043a298b25b53abd275179d335c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37d6d1f0aecbe24ee0e1ab055461866b

SHA1
6527d35e19d657cf1b51067a7dd9e6a72c340c24

SHA256
ed14e0177abf2261043b52dcdd6224d1adae5c2c3080787e5ef42dfbdbf398dc

SHA512
9dc3057b63fe6cd5fc1c1a1ef907f99b32c153e6ad542aa76565834d7b9e5bd3de6af1f89610cd5a746f271aeba7bd3aa8f3117e7e857ecac8fcf60c027a55dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7581bd0465f862841b7e769bbd1b77a7

SHA1
9f2e613f4e2dc6adc34c2f26ffc25e40b60b722f

SHA256
5d78438a50844fa974c449a490b9be24f46ffc1f82119f172bdf7827c2f87850

SHA512
0e903dd566f4dcf633767feb60a2848499e3a69f04b7b157225b63148837121eafad2750f3f0d00ca7a270668be29ba3b5b4403daf8fe319bca3661a2d6dff8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ee8a2649966fe56fd085272baad17fa

SHA1
5ca3b4091b8526e75f66f09cc77c7265b9b89509

SHA256
99f57ed5f3e3a7f8a166c62ddafbaf97509cae0ebb65865ed8e56c43aa6558dd

SHA512
d5c85bd66e745b7d367d0e26be1e694d54d7efc80f00691b101fc78202d5698c6fde066a7ee6349e15bbeb5c3d65c9590e4d68f65ae6092d641975e9a1991d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efb22185cf7aa5332e8ca2da3c0c81ed

SHA1
5a32ac8c636ef6778d460a8aa182cac5577bcffb

SHA256
833ff9852026dcb7876740d796b26b74f77105dd679b222b67b48fefd0744634

SHA512
b0c7bd9294f2821016c34d8aa8dedcb0bcb83e67e075723fb65362e8e47274281ae77b42b42412f97a61656a1794170e55e186be378d18843acd6d440600a0a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e99d534147ec6c1ff9b74faf640cffb6

SHA1
399c53ac6b03805b7bc1a19788ac1260cb26bc83

SHA256
4dcc81c6aa91a09e780186060c4b52684b523c5b799b331184b637ed62c6b694

SHA512
2d7e308092724d13365da2f8328c74350053a64963be4088707712d410d1d037d7b182d8e3567a8b73b723f13bc659c10fc4d1450338d6f0c9c7a7e662ead986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc99de3363a6d7e610bd6e9a142e9c32

SHA1
aab2276b0ac099d3ee3cd7f85bbc1717fbd6d19b

SHA256
d9db35691eed0e40207adda6bc53c660957ca3ef72fa3dd32ae0d946bb850fee

SHA512
d1369d5308698ef1de1186bcfee1aeb040318650b710aa666684ff3fd86671dba783efab5e552fe70c05d75b100ba6fda3c21d25266204838e2d0f89dc2cfb63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a402a8a5ba135e59794a111c1b71c60d

SHA1
fd9db3343fb409770e285ba40b2bcb93d3ccedef

SHA256
42118596948aad80374cb919b3c931ef11ccfc694b740cf18e2e6415ce1308cc

SHA512
5fc2192d0f8193b5d4581773074a9ca6a5053283c9df5b8b64497db4865bda82afdaeb7dcf5d2ae9f7d4b9116b62368ad77acb296c05a74b964343cb69a91b38

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE958.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE95A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit