a15fca72a12dbadeefbc9f4d41b9b767fabc48c41ab8474d6c506aeeb0104938

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/10/2024, 21:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

36edb584697e34fadecc5c6cb38da9cb_JaffaCakes118.html
Size

7KB
MD5

36edb584697e34fadecc5c6cb38da9cb
SHA1

5046148b58b6274cf46546824932002fadd54486
SHA256

a15fca72a12dbadeefbc9f4d41b9b767fabc48c41ab8474d6c506aeeb0104938
SHA512

7b841eefab2594bce6ecd7f5ac90cd58136afd548382b24e3e1063b17458f35a12416c0f1d14290fd59a7ebcec92d0947d4a1913719744ce5a69e3a7c1c96bef
SSDEEP

96:uzVs+ux7xHLLY1k9o84d12ef7CSTUpzfqK9xJVycEZ7ru7f:csz7xHAYS/qGb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E3DD1D1-8819-11EF-8C6C-D686196AC2C0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000accab2bfdc7a1b11a7c60b9c0859338fa7df751ca8da653f3c009756c355cbd5000000000e8000000002000020000000c62cc92c9928e6f5ea21e7ba778ef02f1d82cfadc8f28194ffb19766f9b5a723900000005ebd19dd217b982dcc8a08b2c9af4cce52f114698e6dabd9d15e3906e8ea930ae9d574c05fc998924a9c6313be258b4c252ced0a2c1890abe42735f3f029378e2e6a0f17d45f3cd75ab12769a2447ea4a8871018c3acdb1ade55882bfc74fd355998cf36c7349f357c4825dc7354d4e9c22c6529d0dfa8ac4ff7934661bd12d8da21447e094792027bb0477ecc36515840000000dd158b8008708f67ad8b9ce7ad05882f2dfe975584db208a7772619d959ff2e065f94672b168b291380e066fbef4c0819dead8a283bad6480ee37f3ff45854a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000d88f49cc5cbe39503ca305e167fbd0a31013d4599ee8b55a98906e527177de74000000000e8000000002000020000000ab664a246bc4045238c0ac260c7c2cf38bb8b127442d6653d8f6d22cf6a50457200000000f4ca944806d32d48ded1836d28cb95c555ac247d55cd737f5268d479ee969a34000000032ec63a9ffd9a214fa5d08abcf45a717cfebc090ba4031166ebb82f6ee86f1fe71cfb5d10d4a0cc5adec113e711149e72819c1996e4907ed436228a7338d9d07	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407c7207261cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434844587"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
764	iexplore.exe
764	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2236	764	iexplore.exe	30
PID 764 wrote to memory of 2236	764	iexplore.exe	30
PID 764 wrote to memory of 2236	764	iexplore.exe	30
PID 764 wrote to memory of 2236	764	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36edb584697e34fadecc5c6cb38da9cb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:764 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6acd383a93554c7f425290c5880e9836

SHA1
73c03b2fbfd0db8597dada800a0d0960863a91ed

SHA256
a1cc18f9c4c39ec54ebd4642a6570feb8c324606a703cf911c8bd2191cfe92d0

SHA512
90d38e194c064a430f7cc9dbd6f2b89cf385199984ece35b19202de5ef6847df921aec2e876cc6e3ecb6c50f411a74e81d365fcd67f08f7c96120506a611a764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75b25e9b811371ce4ce2c2241a2b791b

SHA1
0b787db0977c2c8cad0311db12247d9f967b24e3

SHA256
4fd63a5b538380dcb97fc0a954b7f45d6a0fdd98576cf148378616ab08a70a6b

SHA512
ece436043e1d1c51d9bce21f7c51005ac708eaf9747593bf18dcd5c32e55a5bf74017ae04e2d7977ca884e8864af8a420b5097129fc212b8d47a3e466b56ea37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
157499058857226bc56c568ba731658e

SHA1
d36ad307023f27ebf9c2e3835926f41ca01e2cf5

SHA256
42294fbfbaa508e24f400899a92cfcf688f3f84a9d194a174ecd0b8905e8dc10

SHA512
725e07e68831716afcd929934c450e48fac29134af2b9ca57b08fb55d7fa47748192686933e5ea08df274ccd8abcad987c09c7ecb295278476ccd808b7e65f1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37c8f586d3111b1c79f4aec43f759534

SHA1
d812ff8c722c2b14015a0c712f13ebc823eec7b4

SHA256
5cc170a820987583c219a2f0b9a967d1469bc5b19d9844c805e75218300e4aa5

SHA512
2b42e4c36a5ccc9eedc6d6ca4681405b6786525034c1c625f3005d9a493afaddc389f144543dfad54807f90d8319f29c7e98b041b61df2c355df4ce60ea61e64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba02b5594a2c1c2bf063d6ca71150c21

SHA1
efc97d1a7d921aa3ea0dd1f3ac309fd2229afa09

SHA256
365aae4b787957ed782df646125eb6e9a989f76784664431afcaa950407bdfe5

SHA512
af6d669c3b4db709bffd5c9a25ce11036c596b6fd4890519540c38c50855a45b10cb013969aa8a0f9cd1e439fd808fae2e99bb30fd0a5cd0080cc71de19d0b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb3798d665f7cab39247955a1f025d61

SHA1
b51144f0315dcedabc1f382680f1fe7ba80f2755

SHA256
284dacab72c03e191c35c644aeb0ee353ca59a05d8293dd01fa4c7f056b0c5ae

SHA512
d7236b48a40843a244f35f7190adf2e3b97c0926a1752cdf04b1aff0d0de6d30d964ac2ad2a0803927e1c043622a4d799cae69dbfd7cd0cd9095f3802082bc76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6db5640114a5def422412caa0623a4fd

SHA1
7ffd7f9c7b06288c883656463d4150aeae7f7902

SHA256
2dafcfd1ea411eaa91950e1f769b56a890856789edbfc6b94e2a4d9937305bfb

SHA512
e68e2b2a4dec97f07dc8984db86d24f57d23e77919b5116e9480a9980ec8dc392955bd1e02ab4321b7ddc6fe26e8edb5a93c2bcfe077c5f3bcaac107f14d15bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6faf6c37963741a94ea2557239d1da15

SHA1
f2b2ef5516e5b5ff34cc4e45976819fecd60171a

SHA256
b3760181ad0b0536f11c243130854059843af3e68c1376ff90f134eec87737b9

SHA512
d0f0c932604e555c3b19b8707dc72c9329e91be3214a077c219f4d9ff127250640294bed1d2fb88f3ffaefc78c49f667f8d2fac0b59fe6847434459b79f40c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
179f0458b34815a2964bbfd4b912cbf4

SHA1
e7851b6e436a48930ada4ed774ef9752dae6ef3d

SHA256
fd7df26eaef4f252f44c6a5638cb2c4a61d2f247f50d2a6fc5465744065f409b

SHA512
ca7ff8602a7ee7e7c77a59f5afc1d18907574abfb04175326dcdf48f69e5fb576ba0c275db085cbfecea24775810a2b66c9474ea52f060433be1b41a00b5d9ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
913ccc57c4b612ab0efd7cf27a3f4ac5

SHA1
38ed7b34217fb39ae0d7446a146cd616384ee6db

SHA256
db7207e97fdbfcffd0cdb1852f1440258f6c62e2c59ebb3f0e89e404ca8f3606

SHA512
aa9966ac285c034dd0c7414be17da7d7cd4b555266d170faee236bbf30533e446b397e140bb7dc04cbb5afe0ca166896d9f4f45bfce77751b336d6807a6d6688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e8c1ed2e08e7e89093c18d4f6f323e0

SHA1
889bd3ba785ba65d9e0a92bb79ac3f4d2bc2567d

SHA256
c3282c04d556fbeffad85cdad60d6b03d0c6e96a59c94e468c222dcfb0191361

SHA512
acb833d549aefc665f1821f99363e287891ba7ab240f906a26725e55d5a670a0011e05fc1ea17a522d2cfadb65f4ea3437851ab20d076ab4919c54872797b6f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf04055d95d30568935e6af84974e52a

SHA1
abb80774e08e2c3033da456f8cddceb502c9ad84

SHA256
fb0b795e2e626e75a934612be18bcfb9788ff9ffe471f7c21c4187f08d63ae08

SHA512
62822e560025acb96d6365496051a19f08d6f79dd0d3dad20d9fb891ceb395472f4aa4dcf9b4e218306530511de7048dc80ea60f85e45e34ee7683ec4874def5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC8B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFDF4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit