fab27dda15ae37768ed95c23807d26e6554641375083cc3c3fc38d7f206351bb

Analysis

max time kernel
143s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3974565cc30f07e8c56347e23e5d2a2b_JaffaCakes118.html
Size

139KB
MD5

3974565cc30f07e8c56347e23e5d2a2b
SHA1

aa95295b5890ae3b60328c243c3b9027e4e712b5
SHA256

fab27dda15ae37768ed95c23807d26e6554641375083cc3c3fc38d7f206351bb
SHA512

e53c0120c1e1870ecb3827398b4b0b8b93ac0ca9dc106040194d83a5cac69ed170b6002146c1cde3bcbf6f16bd6f4e2330d336d92414bd28075ad6ec12f94116
SSDEEP

1536:ScRKMhgal6zyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:ScTSyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434889644"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000004355fd79411fda9e04dda2658d8ebd8928b85e113299d5a932eff2d3419f45fe000000000e800000000200002000000097ae021e23b01456039ea36d7dc56310a900e2f4e0bfa472a6c87ad0f13991c92000000042a9b758069037f26588813ae62c02a2f9a6615e6970da69c07e9ae7d782893c40000000250486e5e3af3330e0948d0dd61d17806a48c67904e9bad335e0ed67336e1046045ffb9b190b714eb79d063aa7382521583a59fa997f4a526d443ef513550897	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1350EF61-8882-11EF-A58E-EA7747D117E6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e7052b8f1cdb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000696dbcfa66ace613b3d7da46f4118394f3f59d7241a9a07e4993aa488c2029d3000000000e800000000200002000000040239e92ef01e60ed3d2de564a786435b1f7538c5ca21675ec6baa468d135f4290000000fce2ef05f329c86e62fe987ac14595db13751594ee430f443e980db67df64acf80f18f36e4e320742598df210c19a67350d9d6643b6ff70e302ef91eb0df6684c096eec08ec005985f24e785cf9fd75950aaf4d0e740e52ddf80689aeaa711ac326554a205dd286773cfd6bd919b65ae99affe7cdbc00315f339d22fd8d5457027d4df361509eb0fddad2032b174192040000000217eb20bc064354352b534309a4318977e20ee2d7eda40d289b5483691d1842578a22616e915ea7dfa05375a29cb51a243cd7633e756df2a388851c1e7baaf02	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1152	iexplore.exe
1152	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2532	1152	iexplore.exe	30
PID 1152 wrote to memory of 2532	1152	iexplore.exe	30
PID 1152 wrote to memory of 2532	1152	iexplore.exe	30
PID 1152 wrote to memory of 2532	1152	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3974565cc30f07e8c56347e23e5d2a2b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65885bfc2cea672e6ce95d56bf485441

SHA1
bbb5f857c41d8dcb72b44bd6aff2d1ece4f42328

SHA256
0afc86448a5c8d95c96a0109f72852031c37487481b889e6516af015bd65c51d

SHA512
9137d9e94a2542f9aa5b2553391f0985ec10f35480e66abd599f3e3267f83d72092b848173dba9a000cc4da006c651d9317140b12621873c1d1a4383b9cc8bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47626ec8a65e77a84ba6ae8b37806f33

SHA1
b6ffc21cc60e5e3f136c710989b43498b50b2d5f

SHA256
357f911f5ba2eded052a70587357af692bab2ffe6787f86be10e4407f55f5e48

SHA512
e8d60e3975aaa17eb87ae8759b22dd8aefe31863dbe7a7c9313026292211dfc31f14ca7db87239cb4d0811967e28a42da43d124fb92f962bd5e9835cbf86a5b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
331bb12cbc7663c020b92c530766c779

SHA1
371a9a154f5b1641c6f2c9433d1b0939c1311755

SHA256
6e0ea9e98dfab2d0050269f4dc1be4efb7ee1ed4b8b299051abf7f77c7adb319

SHA512
e821b717d696ac379c529023192d083c306b45718288f0c6649b6f8cdaf8f3e15c2ed7d71b28ce15d5f50332d22813202cfcb49fb2bba11b4852bd80ef28de45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a10f49e22734f7d2ceecdc678c59e3db

SHA1
2321b817d3924310d58d78e7cef3a32904ed9fea

SHA256
c258a853bc820d5a9667101445bbce556c1c8bb2829a328cdc90d832d8a210a2

SHA512
d8732cde117e611dfb19340368c10063be0a1f9b7cec1b709e31530dea443a59371e6d9a2e4c640eeb926e9917e26601799f43fff297f6cdf238aeacd585ff78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c786963957f633a94efe9d75ef736053

SHA1
cba14d262892529a74c8d3dbfa5d90360508bd60

SHA256
59d8a28d8d1184388d266b27cf27c17bf6f714f4ccd65ea7e96ee95cc2166b9f

SHA512
32ddc63f7b8f884537855bfcd18f97cbb5aed06cc542241b597bed504144ce35135c062f49889ac0285898f3b93795c0653d93fab22deb2a7eee1814e5e142fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ebf1646e6a0d62958995f5821965758

SHA1
9be16cbfa57b24dee6a2a4dcc9742f306c609fe7

SHA256
b93ff91aec26cdecddfdb5e0547af9fbef20c397dca99557667257a7721a782b

SHA512
24feae235e991360ca07a1f890178dc660895296766166b734ef611dcd7937882fa6cdbc86639997766756ac0eba561eb2858f3f1b9d524d3a794f9314f3188f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee30bd1629935723791ec2bb4413458e

SHA1
bf069315fe29b2037e3b2ae8918795e00d78872c

SHA256
10659af4dd6f2c968232c2cba6f8955f0cf8a3f0d1a96958405b5846c79197d7

SHA512
aab868f1b56e34c01cdd5700cabf20c8b8180edb6355a9cde8aa690254024ce38cf0c810c1009d2bd7241257d6dcad3db35e11e7a704663e31fa06df0d1e4e03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c722ac2e1dbd8892ae4a1434a7cd5f7

SHA1
ead2c3f4fc96ee1c58733424c3a4dfa55a98695e

SHA256
24c18ee5c1b7ce0ca4e6428201109b1e7178ad1672d699ccbc05d228f8ac9196

SHA512
617cd872052b8e668d3a4f8fd8d604e01eb2e89d353159c22665d37a3b8347d7036986b3e7fb51d83a8f4ba7bdbd8e0c78bb9c635f3f58e3ee1da8ce713d9d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72c95a5dbd195d169ce2a4fb9ca3b70e

SHA1
17a3afa8e19d724f28008f981bf6054225f087dd

SHA256
3a14ecd834e4115c8bbbbb6b86d77612a306818c3a303f91ec71bb5a4050edf7

SHA512
0edb3e27880de836b765795a83a9391867d10b0c47d0493fbe4ff36ffe7b29104be07fc490d5ff3b1de0367fe40597c3c3ef359d7459c06e55fb11a1d897547a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10cf0591b5569596745b0cf86dcf02be

SHA1
8644c13808ed050c43b0880971b2a441e05c9e40

SHA256
28ae7c24ab2cd0b407c78b023dbc3b1235dcc4fb51cc3ff55007804340d13dc2

SHA512
da56f3afb480bc36210d3451a37002ebe893d6b8ac2438c2e0884b02df6d4d60ee538684574a9de40bb8b7703dce4648f76c10186166cbed4ca54661c0d6da41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e149de87c5e1b726829003d7defad0d

SHA1
8744223578f830615ac6288cdf1767d15ff8fed7

SHA256
84e18d608fc18f7cb6f967422f63966605af18b8423fc21a1d1b21958aef93dd

SHA512
fb73c99276bc30fecedd8f72004ae6aecf3e98ee8ce31d47d7f43051962e6e57fcee12fa96b42d232f21b1ecb2b6c8fb9405b21739dc074039d1b956ca7f6795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cebc71948d5b9d9bc0469b9f6d2b5349

SHA1
88c1e9c5ec5357a362dbbc8ce4cdbd8910c49839

SHA256
fcca0cd1dd56eab036ffdecf190729757c90643621d836e9647bd0cbebdd10f1

SHA512
94dfcb520c3566f585ce93bc1c792c7860ae541e190f7d22434019ec6c84412f8ed70eb69d8097c8d4abbd658715b5c49266222d5f1476734faa753e164d3b2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d5ce59436317533ff91af1dde88a0a1

SHA1
4fcad03acd90866d69bfc57b906d3175aded7895

SHA256
5909cae004dad3a4b9d6b0b84c19c552706c521fc145030499587ad73e130b41

SHA512
c5b34f42332ffc574ef13fd9fab9fe4f750a4a483860d8f87802e1cb50ade0a9f3983907e625d73bb88fe715ae48963520c2f442e82b7eb0d2050ffeb0b9eef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc6d229e4a6cf56285cf35d3abcfa8a6

SHA1
cf0e3887fd4f5b0e119814da254ab9c34c296404

SHA256
254bb80541854b13fa72b49a6dc3c2e86f44b13ea90829e9eff0e175a88b713b

SHA512
0bd79d7c314bdf9eb35bac160770dceed27980a1b22fe6d6f5f38683aad8c5b6995b90d542146fbbe3bd38caeeeee911de908d10a8cc96a5380289ba9d521ffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC63E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC69E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit