0ac5ada7ce7ee2316bd715e26a0edb00e5d4ede4f511a2f248a8f6849659ee33

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02348978e8251ba8c79bf44e856a6662_JaffaCakes118.html
Size

41KB
MD5

02348978e8251ba8c79bf44e856a6662
SHA1

0767ca26a96ee9befd6be35e1cf897648da3ce4a
SHA256

0ac5ada7ce7ee2316bd715e26a0edb00e5d4ede4f511a2f248a8f6849659ee33
SHA512

8099cb05b55e0755f010786d821aa9a4d3bbfd3c5c80c965c407e61c1a07e9074886837225f7ff75ce58cbcb7fbbdf8b1622ea5a3397ec47565ce7e93b106a35
SSDEEP

384:hxOnxYRsu2gKpXf2L4pTuTvjRsCThHqL21lcqoKMSw8I30:EYRsNgK5f2L4pTuTvj5ThP1lahE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000000f4998dddec6692bf8befc07534cbfbc6853f919dcd7a49d2b01ffd135b045c1000000000e800000000200002000000043a40f6c2111b1c6d5d1f9e85b1e9b888a7487e313822953e5dc4a8e248bff5520000000b3d5293cc6c18313a3f9aaffee8a332e0d20f5c7407f8e5d46edf4740ea7f8a7400000004a52e241a113b406b53f890653fdfd7d95bd5b402ae72a94a2136a3fdbf29a7308c1d17d06cf3099290ab548ae51bcb6e74f9651a01066e5c370114783e28ae3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73753C61-7F46-11EF-9BF6-6AE4CEDF004B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e121e15a3062aabaeee63e300287dc885d3b82bfded52b73011ecc4b3f40d4f8000000000e8000000002000020000000b3feda0148fb2988a746d18da94c457fd355a1ff5967de07b7bba519a7a668e590000000fd22c1c5186220668867f0f55dc703758190a3227fd622b15aa906145c9472acb5fb8cb16d30a8ae8ffffec6407377c06ed5b58420e44504d10844b4aaf3c77fc48391944fce101c8571222f39c5e6a80cdda54f802c12f812b44d32b44443b60153da5950491ed777c62c2f25bbe614dae622b56a05afe9a3522edacd367965c632519a470530d43612dda7fb822504400000001bb6a951e4154554d5bc9898d71b87e211044c20a2db886cfbae04acc3383e1cee9cfd8c6c21bf468d86862099d13deae95384b1fe85ef458975704f586242a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04e0b4a5313db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433874507"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2436	2084	iexplore.exe	30
PID 2084 wrote to memory of 2436	2084	iexplore.exe	30
PID 2084 wrote to memory of 2436	2084	iexplore.exe	30
PID 2084 wrote to memory of 2436	2084	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02348978e8251ba8c79bf44e856a6662_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ff8c0372e638ef1435bd00cee29199e4

SHA1
b37e406135ff0796613d217742efe24112052155

SHA256
68636b64951736c0b13bd2c7afb5794e84f8880ee8e682c1ca65819212e13cae

SHA512
54f796e3b0962ec782c4c83e3de0bb01c4b207a3087dff8b69d32c051a9dcdcdb6173e7f3da6722b7a3e3c04044c3efb5581a82a860ad28312ca4d81ba9d13fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
547804f97e7824bb75d55aafce109f39

SHA1
f289f1b1874818b60f9d036c576de9b1bd69ae98

SHA256
f6e814d88140b01326c3a7c3a1ce1cf89c538f5383f87a98750d6851ddda594d

SHA512
295217b96c4cd70ecae623efcdefd4ad46ff1b9b1f93fd2485b9ba5b0bc275eddffa603f6c8c340cdbdbdeb54f11bbfdae035c5866204bc31cb9f40f01f22d91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5749aff10bf7f4e86df775a52adc6646

SHA1
fbebb757adde798c354097feabb66c8b1ee85f91

SHA256
a436cb03d56e25b60f84f5fbe3d6c877a7c84f0e10e8ffe68d2b9d5fcec78225

SHA512
1b50d5aed26c322f5e030fb6b2fdf0cfdd25a9e45ee4ce816e1c07b5d6bc0bb818a6270e45d3dea1f6968bb94c60815f07fe4bc906e7e24b0d8d8cfba1406cc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9251ddc586fdb4281f3b2fb27f4da2f0

SHA1
16247141167afd71ba994cb944ddbda9c6c20b53

SHA256
226b2e3ee889416e8f53cda3e93b9938ad00453ac22b21da6bcf038fe3705926

SHA512
ee2c4dea091b2c2bd939e09170fe79dce66f96a9c2171b4998926b0b0ff877e33936818b8a7a06620b7daf0588fafcbc837a8aec79b69270845a04e9d8490635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acbb32f156a7f0ecfb8ec9e04b46200d

SHA1
6ccd7fefc278af3aca17066a85cfede1af473173

SHA256
21738a1fb6709e75d6b9cdce8018a720fe1a2cab0bd12d2df56c4489dbc5898f

SHA512
d147e7adb5bf8d5ad16b1e5f6baa2fe8e6d4e81466511cc02f3d41ea4cb3a895a956f96748caf54ec2ef52924f41d9e610479c69e0a90b2234163e8a0102df08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7875fc76e739f45aefd7e74f79389c75

SHA1
72f538f9e900dea500e64deba8d5d0711033cbf7

SHA256
27fb26e9de5033cdfe46e1eb29e0bb6e6417608fad7960f724cfcf9f2288f411

SHA512
4cdab41b9894170097621da5fa4815cf64ac58e6f03627fd754b252cb6806b049df795f207477e1981718b55db4f533372c10ab706fa9806db531edaca4f21d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8884f39530e1c26740c5ea46362a80ec

SHA1
d2345e8523dcc119fd013ead40642fb207bc166e

SHA256
a44ef10910cf14b90e1aeba4d1d642bedfabe147061bc53a19435e8b6106be0f

SHA512
725ae2a9334e93ff527bf88c8538d63872c7e7797cae717ad88fa04bccab638f5f6a1ec9247e34b183bda7350a5cec1adc0082d3b67cf0bac2558f150a3f15d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24c79bbb1261c5af17eeb80111d600e0

SHA1
4e70a892195100bf68f063acd514fc548f2a0c72

SHA256
de5e7ddea319a2bc2327c9260aa96e4ff32f5dd23351c27e7e32283d3da1135f

SHA512
da563f1aa9f3439b6a1e845e763ee4b4b4d44221409f9cac498751f1b0657ba72e7a63879bbea55625901d65b9fc0e3f82362d7e27fc742f5e432eff99b11e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd00ffebe5b6ebfc9f14de0d1aae37e4

SHA1
74745e9637a3af8c4ec90dbbe396e90cefebe44f

SHA256
79ce809421e59c87b857662f2fadeb89bdabd7d66506a75f13c533cb9cbd250e

SHA512
e2174ea4b989fe078c2d40e29604a9b82cfd7458b6438a206e563d5c5874b71a077d7526db96ef96bafa01df07ab80d25f7f06702f85be09de7508d591f54de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7385596980e170ab65a87bb8cb30c5c4

SHA1
abbbad612d3f453e813ac9f3327492063966948e

SHA256
228b78ba8d678857f4d94ed2f2a3a0dbb3f457e2c7240971b2f10a6cf5081a8a

SHA512
61eb6fcbd51f7bad5bd6b431eb63e90f728f1c246acaa0109fffa0a8a44bab25209a20118ba6358535e561322deed94533cd3c0dbadfab14318dafa8a4d1dce9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d50f19643f2ebf6e3b2013adeffc449

SHA1
a11f989ffa5b2ba290a165068b5096ab1ed456e6

SHA256
1eb4e63f9f2b3e4cc459de9357505dcbb224e1c0961616483a38ccbd228b08fa

SHA512
9f4a8bab83cc53e2f5d03e903a6c43920c6370dd3587c1eaf9a1c50887d90a32fe4027af8b2c3501356269020942a698f95e65ec51645610225d802ca7f09788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3007d7a819d01c0a1b857e9ccada1165

SHA1
a2b4f35c1bb05a7de7b4af05264046b0547ce984

SHA256
fc45c0d8668c14ab3816e5121a5fe4237aff1eb6c8ecff2fb6128dba704a635a

SHA512
7450763937e8bd55c9ffdafae3932006c7f4468845a3662c7ce333d40edad3c537b5e6edaa2293cc1c392a648c938a00b4a8a3724ac0ac77145b8e70acbb03f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar572.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit