ade05e9859422fb8ee1dd48afbe323c7d9dbf5a9a22ec74efc3152ce99f44984

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04aabce919aea06bd8b24fde02dd42ff_JaffaCakes118.html
Size

129KB
MD5

04aabce919aea06bd8b24fde02dd42ff
SHA1

ba70b30f733be9a74f856dd2aaecc41cd3669fbb
SHA256

ade05e9859422fb8ee1dd48afbe323c7d9dbf5a9a22ec74efc3152ce99f44984
SHA512

f38e608d5cfaf5276b60f43ecb3e1f2364fe156881f63d43850a4479b08b34a5dc86e9389bf66d4f4ee70d6d2c2a82b32241ce214e465f6a550bff58d85662d8
SSDEEP

1536:zlbQMEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:z+yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433925437"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D8B3E91-7FBD-11EF-9DC4-5A85C185DB3E} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2512	2248	iexplore.exe	30
PID 2248 wrote to memory of 2512	2248	iexplore.exe	30
PID 2248 wrote to memory of 2512	2248	iexplore.exe	30
PID 2248 wrote to memory of 2512	2248	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04aabce919aea06bd8b24fde02dd42ff_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
dcb19c531764560dcd565fee334e54ec

SHA1
f23bfa816947e1f7310a4e457a35eedf049881fd

SHA256
e59e0be0a16edc730d28b828fa66387466ae9af33c59d8ed1d0c1c57cbfc1543

SHA512
4e1b025c715c08e9eb4160c772af4285d298f92bd4e703dfa138718dcb52fc2c152a179bb89658c4b64923002c9a86467d1e3055ce38844b50e4ae47a578aa54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd8180173578cc1a52366694dd67d381

SHA1
e6bf4fe251a2dbcb1c1e6a335e41cafd88e6ecbb

SHA256
df273438986ee918463c9e41f82d26f25d5219e2e59ce0e317e18e7f9ab488bd

SHA512
63d37556487d1c7608ae5067d2987cad8b45cee0379d65b5e31ba685ea9adbf4685bc1ce4820d39acf22b42c1e898d624407e0762285b822d59b0c8e11c88e33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f186b72231d121031588528c354c111

SHA1
3a9a00d22c7ad1efcf255683e957b73a4013c26d

SHA256
4b63cbf89f26a37a1dece84fa8b599fe059025b917042341f711915af39c6a6e

SHA512
adaf594fc158f64c0b0b2842b4b8565652e2de6b42d0b454d96c2d310ad1db6409437971eba4195065af720ecee3df043fd0a8290effdab37f99cf4537ca9e42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
877e1468c6879438759d04e2c3f1a5b1

SHA1
6f3d2d56637da3ede2520a0d7d2395b48523827a

SHA256
d7695de6d1bd4b0e2b4da2079c0ae62b64decfffcda0d23cfeee59e7599116d8

SHA512
fd85f9f5939a33eac050713da3861398d62b17d3066260db157162cc4137193eeb7a95832d2824a459897e7213cb00f11f8b637d469b80b1860504f28da0b1e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16f02c4f0c3dec847ab81242d28f6593

SHA1
e1905934a4f31730a3ac04b14e30e18bfc3a62bc

SHA256
e1df6973ae57d3adcc9085eb0fb2b80b12124ed5a14cba6fca4afb585ad947a5

SHA512
744a8d6f36801894bdc290e401c3a9c3de3f71bc7950c2753bc2fe841b780f1a5c8454339a9b0c1865242be980f003d9eeaf912cabf1e82d3e65b616457e1e89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3509328b5c4a07b6432181f045feecb3

SHA1
59fa76192bbf4685f3b5f65690ca0d3436b6fecd

SHA256
dc4555f78138568dca342ec3156e3848275b92fc24984499129510728c8f2519

SHA512
6a0b7844d9d4ccbd816a82e5e3563f8e453720c7dbcf28453bd0d4ac85202f68448729ff4955cd0b6dd7903afe2b250a99c7eebd389ecd0f9a2988e3cf9d887b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
297eea3e38ea60f73e1463ea96d7ac78

SHA1
abbcc9680f0810212f198159a19e7fdd33c90b4a

SHA256
a3eb4614b03ee09042dc82b1dbca62119b9f9f960644b7ad5fb6caee7c9fbc31

SHA512
ab27130312158600679d3962e19d5dfadace447d2db8b2a502574153ee9756f06613c9156b56eefd4066b72107d28247af37c11794298c53b9b5f0ff97053d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d593a0fa815e2fb34114c8b4fa68cbf1

SHA1
219c10806933b125c5864344e173ec6e44104a7d

SHA256
0df3c8ad28172d00ffcf3876432c70e00488ed20fc92bc74988fe777d8ff88df

SHA512
3a2670f64fd203248d409b05417b333699e6ab139eedc1671d636d09d5281dab3d30c050b28bb09df122b7f76cfa628dc684bc5caf8188bfa6d079af7f29b0a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40f540a334661582eb3d5ff3ed93d2cc

SHA1
667ac49d50b37c4443b7bd0434bc851d45c90c60

SHA256
0ee800d22cdeac76f7236bc2ce0da6e094bb2c4aded10e161a255da637557d3d

SHA512
81892740e8ee517ad96ae495ce0e68a58bdf1a0f0747eeee4de86730d456166d7fa1632dc5bd32d80dab1b351933f764d0cb7b7cf4b0dc1803af77fe586d12fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdb3439d24530bbe28674ece559bb7d8

SHA1
8193abca64dbbed21f5b46d15691e9aefc1ba5a4

SHA256
d95b3180a1b47a00114eae3f23a9a2ab3dc7955f461e05748e8d031e761c68f2

SHA512
2946a4a4f2647f5f9c83c0475c198e437893f9eec5f06a6be7754702c375775c6ee53b7f6e4f41574775238b5dd01e472358b51e762bae337c92864f2060aa7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
69d7e9b79d6a0e92a08c08277fe74ac3

SHA1
25ae8e3253ef3c48617245e75add1519c0d030ab

SHA256
b8f2c1155ad59007f477563c6b0749548ebe6b2a2ec522b2a6e3bc539763a05c

SHA512
8a2e59cf4a2f6e088ae6f021a3ad9215d8670b89df2bf708d207e97e71e867310deae20b886ff2f086eb3aebbe1fc43866b15e7c3c60c1339403f9b64a5cda44

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC4C7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC4C8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit