5b8818a0ed1c2e5c74e1d96fb7de4bf382cadc156b118d7a886daa5e0924e925

Analysis

max time kernel
74s
max time network
140s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

396fe56d1382ed0f8f8f8b07ca4a0ed7_JaffaCakes118.html
Size

13KB
MD5

396fe56d1382ed0f8f8f8b07ca4a0ed7
SHA1

b1757f6cff7dd2351f9257d6092f7421809cb6a7
SHA256

5b8818a0ed1c2e5c74e1d96fb7de4bf382cadc156b118d7a886daa5e0924e925
SHA512

b7f02b64a98db3883d25a1b68a8aeca0de21cda17cdba3d03700ca1bb6884a5e197f815547620df30072fc69083e9a4dd305a9a5cad7fea3f0af7ef85f4bd896
SSDEEP

192:ziEhm9KTa67xFIsHjf6gDtHSUHCMHbqTVKHeL:ziuDekxvjf6gDp9Ci2TVM2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 707a45398e1cdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434889352"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6372C781-8881-11EF-87C7-F2088C279AF6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b1319000000000200000000001066000000010000200000003be0d91e91633c80dbb77dda5b6b613b6c2aa7707948aab9b0a7c5ce1c8e066b000000000e80000000020000200000008a0211b39161f4c13d0635ad90ab630da17339d5dad73c7b08c527c9f49d63a8200000008e7e85adac042cbada5564765ea680e88920be23b410981d7e4738cd3ffef42840000000d88491fd30d1f9bc1c2574c44f701a4bf8f6980cd9eaa23db1a901b35075f9b565a28bfba96e8c185bc1ad266256158e0225fe04a01a1f6e3c24f348ff23943b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b13190000000002000000000010660000000100002000000058abab0d31084bc28959c06a5a9d0f81b11660d166c1e7937b926a6b14bc7f3b000000000e80000000020000200000003f52a787959c6a9dda972732eca7209823084f2d4de8b66028a4c51bc8384a769000000055ee96ccfc2e7a6d78b04d9cdb34d144badb921a96aa719039fcb7d4fd25288fbc98d3554a53f6f6ebdd4853a38f26142043982d52fccf4e2410f5f7a38d72095ed2e64984c206d5efe5eefb0484e671fa2415ee4a16e592f7abf465219c32c02aa180c4da4351e803ef7cc4b7e37fe6f92df7ea339e0a1be79cdca8fc32f6d8954e700692a107df7794e4c7a8445b8a400000001191987a9b92e9dcb9b69b5f6d7e742cddf5de57121180b4bea027e3a29b2be298f8b95faedc281c1c84a46af9c267f71510e0fe0535aee255a940fd855e0b94	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2864	2904	iexplore.exe	29
PID 2904 wrote to memory of 2864	2904	iexplore.exe	29
PID 2904 wrote to memory of 2864	2904	iexplore.exe	29
PID 2904 wrote to memory of 2864	2904	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\396fe56d1382ed0f8f8f8b07ca4a0ed7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a85630938a6fbda27974e65e2f17d14

SHA1
b45ebb26bc217b2241e255b4f03f8b0a506f2faf

SHA256
f65ace0d69dd30fe1b61e4ab9328e4e08d68f302725e8fd10a7aedf9a3ca63ce

SHA512
ee33eae98f9762ef2bdb58fa8c93e162439b44bfe26e5f066bb79a75a6f08f7e4d7b992ebc5bbd6ca5dd02338e4926b5f5292f8d008030900c16d873ade9ad8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c17176a07515ed4b9663b1da6b10f8ed

SHA1
21d922423eeeddbd59c3954beb84912a305ebe26

SHA256
a82c4d695cc2972f2f037aaa0727ab3f177022e463e695c149fbb7fd120201f8

SHA512
99922084032d6e309acbfc72806abcd41fb2dd02d1485fa6195e77f58ff320cab41a32e86c432a02daccb99e1ed592252136259ae631068d18bba9995896896c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54278db54cc6f08b7ee483ebf17b2866

SHA1
1595c06fb481ed24d1a79250804b1d2917fbe9fb

SHA256
cd9d6e64b3b755c6e9c7caa34a3ef71cc3975d15e688cad61fc21e00ae57ac28

SHA512
54b22683b16b7a99cbbac93a2ed776dc0b5ede334912ef7239b170b1523934824db063612f99b5b7a872775330c4bdb0a1c3cdf23c9ef427ad8aa9e67e450f3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79415da983116a3488381d7d169eae74

SHA1
c78b94bb90e613a0c7dbcad4f154f73537622b8d

SHA256
fa7d443db3da31f71be194bf776f1b16f6468d474d1fa1c571f98868c3b11196

SHA512
83e6d434517a15827ed43788954e57a041e34713b2748a90afa5d304de73d6bb729fff1cf683491ed87b0b74be46ca4c21da9cbe850c31bfb1d3295707f04e09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb04fa4f1f0e9d336aa26c60808f374c

SHA1
a972b69fed7db85f0a8708b2e59871a9322f4c5c

SHA256
3f17370d2b61eae73ba8e39b9f188c4520e55922d014cc89d2d6f2b0b055903e

SHA512
fce29f05e25f25234437270cd77c6465a2b82d2a1a71f257d766af06ad54b2e616d8c7f9ee793465938f15d1a814251cd4bdd047a2eb682712057e5c30033d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9eb25387893c5d4374ccd5eebfa478d

SHA1
4ad6c7458e430f8d3734d5356d15427c0cb28554

SHA256
77ba3759374a4b2367064a971792cad8b7d1c2b10fa00a465021278795034081

SHA512
2247861b0f4d7ee2fe40e38bda90047c2a25bb554c62fe66198003e213a35e88437af28c4ddce74336f1ccfebd85b56cac7618e9d4aaf258c41352a68a704a65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20c705f5df048ca33ac7cd0d2893baa6

SHA1
dc0f64d7d4b15ed91d5a65a35a6536e092b586ef

SHA256
35b9c457ee2fc224bb43c5c3bf0d5925428a6dacd9c79e0ee8181d94ef3bef0f

SHA512
7bd1485c3065b1045183af84885ccc2ad15a860e5193d8a55e6d35ffdb6c463e95a64e3bb0446a21f07bd8b79aa5c2315a3af86eb5affee993166a03221014bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3094532f854b46bcbc548f25bb900e71

SHA1
ac6acdd3220a912e07dd402138fd2cc0f70caafa

SHA256
896b56e97994351318e1042dd9fd4508b9afdd0a1ee4818ad057faee97bcd1cb

SHA512
8a9ebf0f528ff06b3d9544007ae058dfa4d5b322f775f4ba54bfe062e2b3b78ecb067c4e188d28bb72426c8fb0494b2b6a7420ed4d987288213d272147737b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b067dffde7843e4918ec76675346645

SHA1
c085d317c526f5f5334b58679f2003689100a8a9

SHA256
e3221358ce3fbe9a39d53cabd275a5ea57559ae8cf720705171f3d91f42ac01c

SHA512
b7980b1f8e51324e8a69e2f1ff25a53c8db3afe638a56ddff7917dd4c7bd01f0daca90fab2603ce7aae709a307c263e7a3f8a424d65fb10e09c4a36ece38dd88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
394ee2ec840733d531f515c402148ce2

SHA1
90029a9c510df33abab4c7a1cfa3837eeb007b56

SHA256
26b3f129e1d752e335e8c4f18487b5336fe63bf7bec700908b55d095d564793c

SHA512
db0377e374b2c53c30e4430cee1e8a14702402b4ebfc5fbde819b8a4566beb03f0dde0afe4e54ae895d993fc88fc0b8165b3d3ed1d91a6671ef545a82ffca671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51049bd5cca387f0a1cc9cb1ed41a9b8

SHA1
c3159c44535e10a04f247a94c4972c9fef3fd805

SHA256
f61ba61bce7835b792cc5a0b4704aeffe3fa383bce6d7cf96ebc8552ea829c87

SHA512
a23725a797a853baf79141d669284a141c7569df4b2cd5beba31a2780e29b0bb3519b65864d4e2142312d30fcfed6d2c78ab23b8073120e2366470d915457c9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8eb0b832b2d519bec099f438e7b9cba

SHA1
94e1878592ecc7efe29fc387234b7675e3c1c264

SHA256
5fe7efcc6533cd4c610ae53efe82d3389cd93065d74687c6f028a3f051e2570d

SHA512
e67acdf822a7550be19c051e81e613fe851240067beb01d00bbcb0feba3106eac96827715ac18d2025ef61514cdaa6b0275d71e85a52dd802e1ad4b97182c211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
547fd5b5d61b6042bf0af4dec2d8a80a

SHA1
c214acc4ba81f3a6fea0af5f1515b74460cedbcc

SHA256
f134b6235cee0d292c2cf31db6abbe113a7ded0eb31f62167614af1ab557b2ef

SHA512
6a655f5733bfa1ec91373954b091401d51a2dd876d5c55132da6319204566dfc6c1c3bac66ada180c7fc12818e5d03e4863c7d783db6601804d688bc096736ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d16b480cc2aa4d3fcdd2ca82f7ac865a

SHA1
328a7dc946adb1fccbe90ce899cf5e7f8fc9c0d3

SHA256
282eb83cded9ae8eeedb053562ca894600ca737584f28761d326365ec9602b85

SHA512
d259984d5f39ce3ce27c1d0d7e560e85fa2e48bb8be72b70cca5bf03066a9b773defb46358496ad3212a1c1f20af0dc9417bbf696c3d0a9bbe3e7c11515cf23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B40.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1C0F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit