a3ff3f0c484add105ee68618857b8f4742ecff7793eb5829115b0fc4c9cbb5bb

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3bddd76bb3a27aaf4c6532a6277184b4_JaffaCakes118.html
Size

58KB
MD5

3bddd76bb3a27aaf4c6532a6277184b4
SHA1

eaded5400723c24cf3d254e110382a9b3f871848
SHA256

a3ff3f0c484add105ee68618857b8f4742ecff7793eb5829115b0fc4c9cbb5bb
SHA512

e67133043558db87f98ecc9be7d55043902c39058977866b5045e8c21627545dc882172f766b7e1352b891802046efffc44bb12cf647acc1c3d2aef6731418e6
SSDEEP

1536:gQZBCCOdf0IxCyzigfnfmafHflfMf6fkfqfOf/fufUf6fifMlfzf+fMfwfNfKfZq:gk2V0IxlPjftkScyW32MiK0lbWU4Fixq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0571054e41cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7748CA61-88D7-11EF-97EC-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000ff54d0e358ec41f7fd4f1fee0894fd3db98ec32b112109811b7f449b82555608000000000e8000000002000020000000cdeb10184ac9b35caf219846a7719fd490d6f9198848f8fd5c35d1c2969527ee9000000066ce0ee62ced5c598bbfdb2e3fa64ee4152ab34eea172a5b1bb51ce664e8a92e69831b892184aff4dddec0e6ebd28c5d9d4baf1c554d591187b44ffb8d0f073d9fcbff6734d9d1298ebcafe95bef5b5ac3af4b956819ec166af4a9346c87db893954d631da11c8a851cff546c3737b68bc14316bbf67c05319635a8404fc9acd340e4c80b2e90283a275bc499061cf8740000000c47895c1ef122293c906ed90a10993f64473bd8cce6f2b96eb6dd631abe009407a675653070533ffdb5a4c1934586cb4c30da0d00e7f794698f0f4a70da061c6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434926323"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000007235c0f6371e612d0fc2c5e179f5e401b51bf79d2986051ff21c1565839baed7000000000e8000000002000020000000e3bc197084163349d5888a47fe9c0042c5347c82d1f3b9e23033cd871047af5e200000001f37499c4cc8f08d3165764183790d42672d9d6c746ce17793ce217fa4986c5140000000d464ccab321c280291df94a3b516861ced6affbe0af1a4836084ca5a359e8d9d756205ac4eb50bd22cfee692c590eb07b5ddd30d6824c96201f2cce6d9372f5f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
532	IEXPLORE.EXE
532	IEXPLORE.EXE
532	IEXPLORE.EXE
532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 532	1724	iexplore.exe	30
PID 1724 wrote to memory of 532	1724	iexplore.exe	30
PID 1724 wrote to memory of 532	1724	iexplore.exe	30
PID 1724 wrote to memory of 532	1724	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3bddd76bb3a27aaf4c6532a6277184b4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5cced62e8b6162c610df464c3fe5e99f

SHA1
19dea2c87bac49908f93aa566fd815a8a6bc8ff6

SHA256
e16fdb639784ebf7796c051af5eb6ccfa03f0d53ee7dfb2c19a8e00bfcfd6eaa

SHA512
a656ccbd9233433ff920d73644c40ead46d4af28b3f8d59d423fd7cbd96abf8df75a4134dd956f941423fcbf58804430ed19ae7fb3a13599cc0e6a0864e28d4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f50bf30dd4eeea769ae6049b9acc765

SHA1
6a1224210d95909e50653a3536fb50b6fd0ace3e

SHA256
fe727221bec09221a5160df8560aead2b805f27bb3ba5369ed26695d0422a653

SHA512
f7710655a0d4300097499423677d8afd557abfac06867d5562da4b018697dcac245f3bd3eeed36e0c518e9f6e791e648c5f290f879c46b2c853f08350bc37f43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2356176ac075ae7632436a26d1550e2

SHA1
d57e100de0ee84cf9ea78f892beb5d6c8e695c27

SHA256
bf813cf3eedcf7ab06c46b8c82129dfdedcf48b3dcfefa8109a00f8a1c06c0b3

SHA512
31fdd26fc2e1fd5e0df8eefe6413c95bb94581e8b9645cd28cb4351bc08d6d8de519e937da0e1deb5347f7c55e6b68bc06c5cf81111e7ae847cd6bff41e86a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00c9b185ee7bd6517372bb599a201842

SHA1
c3184a11a2dcbf1e6d1e981106b495b811d1a1b2

SHA256
a869faed6712d621438dfa2f3dfc22e304de57b6651af418244daf69053f6fc4

SHA512
177950cc2ded562f9c041e375567c72cc93869a65abf23a35a67e2701d5d3ecbd851a9eefc1b91b8991cc73a09d487459bbc5e1107a73d9a10872d4acc012d36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4b085a1643067f514308b173487842c

SHA1
a786c6fa6983105b3ed0dbb2fd56f39a3b5697ef

SHA256
e4c61f0977f5e9c563ea2a90062611b897feaebeecbde0ee100b89228e363f65

SHA512
089546f299f06fedb18af4bda8f1006fa7b207d5e5e7b2d522846c54d8b62bad5e9c6b16254a79bc034cd7d388ed1f60b428af5db70efdd5a478d9ac43e762f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42dd70f5e634a54774d142a65468e6a4

SHA1
a513717b37774a93f46a4d246b5cdbc8e2f64168

SHA256
1cc441cdd0f0967f9e293f45786acefa2f00d3dd5b8e78b4d83cc4dcedfd0434

SHA512
e4017b7f81e266c5139e78281c629593f4b341f6109f42eb14abf9938519a3f4cb1f97d1929d8654aa9d8000358b0dceccfc93785482c2573b27ae5a1b5a5c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3958eecd71797905f6bee73c0b3598b

SHA1
b8f57aea6e9c25192bfde5eaee6428a9bfce045d

SHA256
35bdc79a7e5fc21bfdb2e72c303fe688ff1395a7c625d0f76746e5fa6d3695ef

SHA512
02e8028e6f3f2a5d1b255bfb05f1d823e64d9c3ac087f524225d4cf3eabf9a7a87c665331fabf89f4c9bd1b172cd1eb2af9910403788599cb580da3e83951597

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
399b550b4bd9fa8ee154a4f5ce970188

SHA1
c519c80c1c8d6e01599ac33a92368dd4d7f08afd

SHA256
371acda56e65f9d0a26977a4a2ae66ff28d5e6014a29777f3a94a3a1616f5888

SHA512
4ee1116257b49adadd792513162a33eae739af33cddf620c825343b0250292c0b14c687bba9542c39ebf8726e58ac506eff07d197f3b0a0956151a118ec59ae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bee9881889d49dc54e18dad1b97cd305

SHA1
e6d49eb300abfb5290c5225f518a757f6487f1f7

SHA256
4136b4c9364833eb09797e011659fd9adafc2c720a0ef569d2deaccb7d9a4a97

SHA512
9f792208197b1c587f4f78cb9ddbf839d6f9a891e432429d12d612d01aaab461540a45d79993c3fcd6acd4ebe7dd3582f166e0b7b55cbe94c98b23acd31cdf5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4de407fa599bba6c9508da3c1021e27

SHA1
0e3a4e15075b8b3ad478f7f63f34e8273b57e385

SHA256
1a2154f7a8892f4c6bec4fc3a5dfb318cb04ce6d69cba5a9bd8ae018e2a097cf

SHA512
0e50c992fa317cf1330cc46b9d84f5df935d4c84f937462fdaa0fed48910a68e784f281a2be4ac9144dfcf6a851dc22e4c78ae68f250578308a1a35a2342d624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75d172821051013c7e54026b2178e414

SHA1
1b7b8828a52f6ffdc07ab995ff3e9adf515d6a2c

SHA256
d3a1e4bbacf0add2837532aa78681f64fca33f9cc654431604a525e9e2a0522d

SHA512
4cb43ebd893fba52a9ff7b5b4cb32db564da150672e1e31fe94fc6c032e50c155ec5692c92a92118cae85838e074b64a2a2c2aa8a9488e7024d5a1618f697e27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e51a21cd45a3c5703522a5e6e56a9d63

SHA1
8b662f377d61e269d3c7364b3d043cefb684c21c

SHA256
64e84f85d5d01af17aec4e23f56e8ad045b5f64c596ddfbb175bb50881330b06

SHA512
6426265eeff93abc06987dc45425e190c8bf35ec69f688835a62d22ece92143fc457662004d53618747eacbba3202519f4f1502902eb627b1c4668870b811694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6bd45f566df98ad23127ab75ec746b99

SHA1
2a6462f0f5fc492944a1b7153301bd3109ca4d02

SHA256
2012b40931f8e48b6a83c4e27e4c7729884877a56e55ba89c0b5d69e4cacf549

SHA512
274925b86dc918f33e2cd95d0558b65b8bd39a05030d10b45d4ec988ac558384e9cc39b8eb2ecfef91ed835ad1ac6d50a20d1f1f40c0ad7e2daf2079d83bf82c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab58E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar590.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit