b8dac34774aea40869b5af4c268dd12e066410a0f142586ee1969d578ecf9fdc

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a3d1956c28524d4ef8b8b945920a27a_JaffaCakes118.html
Size

53KB
MD5

3a3d1956c28524d4ef8b8b945920a27a
SHA1

f58bf64699365e5028a786233e52764c9b840fb9
SHA256

b8dac34774aea40869b5af4c268dd12e066410a0f142586ee1969d578ecf9fdc
SHA512

8947a846e06e9cbbe6a708cc24a3c6ccca2397dff5fdec6c7a06c7d70c90755dc7d3880158e4f884bea601dc5ae157179cbde2a53524b607e97a28da22676dad
SSDEEP

1536:CkgUiIakTqGivi+PyUfrunlYs63Nj+q5Vy0R0w2AzTICbbYol/t9M/dNwIUTDmD1:CkgUiIakTqGivi+PyUfrunlYs63Nj+qI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b072b5f2a91cdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434901254"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B660AD1-889D-11EF-80CF-C28ADB222BBA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000499bec8950890cda642f7d9dcb25ab45365cec7447997d9c7c342795f608c1b9000000000e8000000002000020000000b186c978bc18c49d83ca1609c7d57781aaae137fbe8621a5ba047bb9207773102000000023134e259a64d0ad80ac1c8fbe1c014e58028eded54355c45e3120f27662d779400000001fe6e0c858e20e9cacd0a49f0a3a8128e8fa3b087318eb56137bdfb740aa0bfa531e0e81e71c16e64f8aaf0d95ad4bdbba4bea7eecfb9aae4c3a7e9e9eb7ad8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000018afa7da14b6d559431e67d147b859dab12b2d465ffc0967619073c307eea72000000000e800000000200002000000012a0201cbe7b64234593eb98091ac87e1b7a24d324e375b37801540464885f0b9000000080502361f381b9e594deaebaa6a10b5b1bd3e5084fec8d88ba095758b356392185bd16041f275f904e98acfb5fdabb869d4b0bab2c09ef55b5838d0950a0eadcc4d352d791162f55d341b650142e3b226d839ab8e091610b977d392f989c75f2683b0a251a1087e2f233cb0ee6bbcb3b5de91d33dcdd14d9ccd27697eec6be648d6675cbb0c3858dbba10a92302a87c74000000006dad292abe88dc1ec9150526ce7e23bd8bc601d925ffc1f8c22e8f52b86bd35b70b1d08035db0a6a8824a9e0ca436abbd7caa06c07f46c042333b913e3cda60	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2832	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2832	iexplore.exe
2832	iexplore.exe
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1804	2832	iexplore.exe	31
PID 2832 wrote to memory of 1804	2832	iexplore.exe	31
PID 2832 wrote to memory of 1804	2832	iexplore.exe	31
PID 2832 wrote to memory of 1804	2832	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a3d1956c28524d4ef8b8b945920a27a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a072872c42030d242f3efd80d5f9c18

SHA1
f665e550748a7b89323c43f3d46436fac5e0e48d

SHA256
8c0abc9aa44f2135e73027f9e1e0b31cd96892af1833b6c4e2d6cd3435ba398a

SHA512
520fb9f1048e5dacbed4cc97bbecf2d8c6428b2e29e422b90114a61bd7d94058aab44273cca92e66bb0fbb7990e01c2bbe066c3615ebae540d64b80f489d2d96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4de04a5135f26a8bf17062d6807755c

SHA1
eebd976a8c131dd8c06a6977b67ec779aa46d262

SHA256
8d7edeaf1fe92628e23fa754585fe64c9f3e0f787d2478eaf26638e82dddb893

SHA512
7caaefa090d627091c89b07f3eb8fd650a6ba8e4cb5ba0afe51ddbd7a1672284867da46a506d2fe9530c8584c384c8f95d1f9519e90875baac02cb1434303729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63a4ab243c36372439200eebcd571da4

SHA1
c9f578b794e9a4c4e448fa6ec9941903115541c3

SHA256
a209b0eca4d751a285786d42548cb2ce9e6e293fadfac83ffacb4cf2f0842fdd

SHA512
6dadf491975450fa31f44f47222ea8bdac79d97c8fd34f7eff53635a756e52fd248e674cae5ebdf25f77fb2e78a5d4cb92fdd572d5a0fff6feb8347b37baf622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1634a12f51f13034202ff9eb3326c79

SHA1
3d77c675aa2191490df0147d5fdeb00fbe659e75

SHA256
dfe7fcf246858659306783b4da0e6d86b206aef8d7d1378ea119e85df276e893

SHA512
9d166cbf51bffce3764240a583aff739f378046e5f1fb89460580e18a495544ea27b121055a441cb54599ace21ae0abae70ae5df9685aa3f640b7dac9f8e32f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39a2154fdff14f9cdb353bcfbe53c5e4

SHA1
f6ff641483139c23ef816bef7b9605620b4208de

SHA256
c2f192132c2cd9b9c3703c747b601cc8a98a39b4a296aed8e80e83a7946b91f7

SHA512
c2c03879f7f219c1b893d5b893fe395a4714e1ef5cab0b4fa1f8f5ea2286060dbbd0a0f09cb47ac83d9e30b531ec0e8cb4ffa761d819c5a9ca9efbe91de48e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b234e78f8e7742c2f7cf86839177dbcb

SHA1
094d5f85ec7aef2ab47af036a88ca069623a76fd

SHA256
11e12d806d124780f6a072f1478d3d3f767954a017c34eb172153818b3190df7

SHA512
96eb57de14218423fec0fbc9c3ab12b575c11e0f440a112c5e5b0ae9b3bde2421cbc33a959860220957054ea677558769ff2f7475673d682725bde1822c4ef2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21cd0313a5ed4195b1e429a4075b5497

SHA1
2c05be16c413d5ecf2b4240d71c0df8d92ade634

SHA256
3d4c77f4a2ec981b70b231df5e9beb9e9ae359b4c9b2cca50cc83807c5c344ae

SHA512
4213227e61070854f82a3a8f1e86acdea3082b45b64fa58a333274cb5b06e288df4e28bac2d79fe7508b8180652049b59a5d7d2ae320c30d99e7eb234169e1d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a815c2614f7458820127492dc3a25ece

SHA1
d3944ec081cbc0d8f44ff2a1440cfdbca15806d5

SHA256
b021a38294f8ea9cfd5c18b6a38b2e2cdac357cee1c43b963173ffbd34cf121f

SHA512
d8a0ffbabc87b346161f9ae5f5f4eb104eb0033106a7fc04fee15f0c3560aa2f00c7f7e1a2781e81935bcff9cc0c8e8fc2b2f9773a4786a6333c4598d6f49d61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86a3ead412fd1d2beffb4352dd3d2d98

SHA1
e2571bdb89a2d85ef42113941a98b86c5794717a

SHA256
65aaac659b91987dd1fee45d610ba368cd03adfd3fd6069f5a8aae116aa6afa5

SHA512
ed978803244c6a32e438deabc8ba5570ee64a62a2571b365ac16ca27c7ea889adb3ccc1e717a412eb657af79659382ed8d960561d079949df3a8c7b5500a85e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar766.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit