b56afc3cb96703e6acd21fc11daa06c640fc3f08aa2f60b271d9eb250f0f89cf

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a9b13702b131a8b6ceb946fa2415607_JaffaCakes118.html
Size

53KB
MD5

2a9b13702b131a8b6ceb946fa2415607
SHA1

4c9d7ce04d6b549ba1beaaf9e66f21db8c52ce70
SHA256

b56afc3cb96703e6acd21fc11daa06c640fc3f08aa2f60b271d9eb250f0f89cf
SHA512

80e0c584fb076bb7dfbfff9bc8b814967ebfdf2cd2cb44cf27d2c197e60713081590440de9cfb904ac96629d04dcca103b2117e284539973cec4a11759880748
SSDEEP

1536:CkgUiIakTqGivi+PyU8runlYS63Nj+q5VyvR0w2AzTICbbTor/t9M/dNwIUEDmDE:CkgUiIakTqGivi+PyU8runlYS63Nj+qa

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301208704e1adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000b0dc0fdb8338735e4ac0c691c1760b11883a2e5de6fb279919c8b27b718a8cb2000000000e80000000020000200000003c894555193038c8563498938715c9f30f6b936750c9fc228dd90555d2c545c4200000007272bc2b1d171d6a9ed26f67a52d15f7c2bd59332b3ebaf0ff8af880d96c851e40000000285edc8e853e9ec8ad6c404db3ac94f48892655038d87877de956bc7ed773fba081e6841cc708d3f0403753451199dc637f4342434fbd502fd98a75b671f2c65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434642049"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000e16fe8a10b4ef43bc1b4c226c574c93419b77ab5aab001e4b3aa0ac6bdf7fd15000000000e80000000020000200000008b5dd29fadb358ac1eab4b7b501298ec620bbe8aaf06d6c5f33ecce8e6e867909000000011b808b43539dd8b8de096fae855fa8b9f56c7211aa02eb8c3dca66950612deacf8fccf55495c9d2bfddc1fc49c6d1faccf15e85723597d203fe01cd323c6bac64e5617a7eb172d220f38a212d628bb1cc041bd4759120d74651da79789f1f3c09643656202162ab933f1c549cf8a767a084c3021953d1ab8a0c1fbd38d5d0451e53bce792e510f54e47cbbabc464a26400000005e1070eb8172a5528538f68e38bc74ae8c19f3956e14c0aab7d2126471f783f0fb9f6f61422472cba8b80092389c0d006abbcecd145e3e7fcf34cd15e1b3c3be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98974771-8641-11EF-A364-FA59FB4FA467} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
1808	IEXPLORE.EXE
1808	IEXPLORE.EXE
1808	IEXPLORE.EXE
1808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1808	1924	iexplore.exe	30
PID 1924 wrote to memory of 1808	1924	iexplore.exe	30
PID 1924 wrote to memory of 1808	1924	iexplore.exe	30
PID 1924 wrote to memory of 1808	1924	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a9b13702b131a8b6ceb946fa2415607_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5849fb21425685cddd630df23be852fe

SHA1
f849e2efbad56903739b91cc7f63492581af000f

SHA256
33ec19c4da4f8db0038be47ffa59fe4ebae51736f6c5b816682b8ef2e4bbb22a

SHA512
f24d92cf77862691c8878bba43f3a422e9e69822f81a366b76469eff25ebae26624aa3488584c680218a0ec96343e137ffc93a506f43c35cffc8f8fac6dfca5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0576187cd6151c2492e16c72f3ca5b0e

SHA1
2fda51b99720fde62c376866a853dcf7d319865a

SHA256
c5965991736f9d79eb4b842ae16ffaee3b588bf3fbe51562dbad173c732abb55

SHA512
1bcbbb97fb8cc5387f1c2d051e516ea14fc15c35af1fd9f7ab0652c9885589be0d256a6b0af0eba413794753224eed68165c8d6d01a6f0d8a1950f19a965da7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d21350a486b38a2b986d7df703d518e

SHA1
294b97f8da341ca4c5c8601cc3dd8b28677d4aea

SHA256
06c3b0fb390fa4472324336979e42ea8adcf34d4d2a846a2c83e5628169da18a

SHA512
5a7892ef3627c7c30ea6076e0eba3f87fd57d2a7b304a4e0751a2f900b5003afbbf5d3a8fe85c4656be0dfafeed968055b726a0420bf7c353966d1ca2ebd983e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b06beba138f6b6a9f5b00a852b9f9538

SHA1
7998db6c40a796861e2f056ddbd696cf21fdd6c4

SHA256
97c6518f30174df27d597fb569b20aebf950414729f25e37a21a14472be68580

SHA512
8408b2988405ea1daaad1dd7911a95f48b0ba74666493f1183b12303bd769cd92946e1be4ab8c02fdca2027fcb2b325c28c5a4f91096b4cdb304964a54c71adb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
097a3f275ddeabba460c4fb22fbe8d61

SHA1
b383a6d28b725a1fe9caf21d72ef986894d13782

SHA256
4272757972e73096b05d4b68f7537bd0066580c7bfe8b950e4e18bc4ef5ba210

SHA512
8d7b5b4eeb6e11c229a172768622c12cb2991511b9d411b4585087534f4f377723ceb60397921a848c56719e485206303298de8a29965f4d1f036332f372b07a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35a590dc2a472dff4ff14e6bb5d93d4f

SHA1
3944caf9170294a64b15217e004118c378a2a950

SHA256
9c4d47e034ffc41090cc634629ebdd7d6e2dfbb21a8301a3a32f0eb3400715a4

SHA512
56085dc10785f3610a0962864a9a015660c0a90291d96c0f817befdd9e23932df954cfd34f745b88972a8b6c252a807a80e1a3a57fda86bf5246483a4166fbf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc607287d44fb48a98de670b1611cc77

SHA1
c37536ee7f108cee4d247c2314c5b915160cf089

SHA256
a2ad8d961a74d0e51e64c27b6ec34ccd99d10df15bd6019f651d29df365072ef

SHA512
6f94c3856634449d3c2ce6299648fc950fff10c7133a8a419808097e430d60e5d74c0d2ac3d00356d853f5000c8bf606e688f571d5a5db5d51329f2bf35b3765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c4308d42be9f4d3995e7e815b633b98

SHA1
24124fd5828017fbf36ce9dfd6c9596d4cc7807f

SHA256
03b402168119f0be53054e3b7ad3741d854ae4adef6bc91a5b497bf12cb7025d

SHA512
2066b97444d8d574f08d6e84a39984514fbe7cf04e1e509b686e69fc5de44f394ff8a81498e088850154e139e7fe07ae1edafc2939ea694a78dd587a159d4050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27e3e8f36277c145c0ff1d237e465126

SHA1
857cc0eda450972fb2c764ff22110d14c1ed6b7a

SHA256
1294cbcba27f3d1f2cef025901d8fb798f3e67bfef8be3ac1bc3ff5d7006ed6f

SHA512
50db6bf89fd04a58a6cfed1ae8afb0461e8a947b8c7649cf202f04429e0e9e58da21833eae1b38855cfa4cb69b729456e6469f1b06ff6aaada9a6202049a2b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d08a72c90182f5ea7a750a9825e9734

SHA1
de564ea07fc6d55db2ac544a3fbf64006bf5a95a

SHA256
753d93d4474fd44ceef1e0655198ece9b097036c5bcd1f7a2e85c8707ab45566

SHA512
90dba61208437a3d01901277e8503f14ec2a8e13dd6f4cfa5a8cd0a9f816827a1ccf78ffde9caed5a3b6766b163ece65b4d4d80c74c6aef5d9e07cd9aa7fe2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD930.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD9D1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit