bcbbcd23512988f38ae99f5b7100b1208a0512b59088802c623fb36e47671311

Analysis

max time kernel
143s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c14c4c530a2ff2f7dc68c9687d167b3_JaffaCakes118.html
Size

48KB
MD5

3c14c4c530a2ff2f7dc68c9687d167b3
SHA1

a94e9417285383bbad49d3a6669d2d07a9bf4ce3
SHA256

bcbbcd23512988f38ae99f5b7100b1208a0512b59088802c623fb36e47671311
SHA512

b89379cbfc828f7e9b76163b96004fa96f4afcd9a48b084fe3ac6e17780833b782469b50b27e8ae22b4c459b4a006181ffd0ff5dc4044ad08297622705ffd704
SSDEEP

384:VMIek6fg1/pXZzaHQ0ce9tOCQsg/6ITetOM/cyghSLQqRh52I9hxlhjdaiWKWPVu:VMIcgbZup0lt0yuyTYKYnyx6r

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000000765b697060f6409c4aa26fe3a4192fc65193651e617da7283a64ce50b3dd5c1000000000e8000000002000020000000b14d4dfda4dff5053f07dd462ae555aa54bd9df9e8d3cb15603bfeb2df7873ae900000006c3cc338c4e2432b2bf92ccec77133c578d33f65f5a17878af7a4186644080f50899060ca059174f97ed2da3722a6ef37a1a1cfa72a104d5499c051948d604379bd1357a4ba9cf5210de5aedf7ee8c4ce4e344a3e1ffcdea033f0940997ebd95b76f7929a7380caa4be3ea311d34ea55885614d1fd7bb7f6c42c1ef29646d75db1c2b0a2aec1a57609a267780ca636a540000000ee29d56f223206a04e26ad25bfacaa0846d4cc3893c8fadef04c8d51f0983575592c182f6e9ad0379bafd635cb86690dfea387d71488dc17e462eb019519052a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434929772"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79C33701-88DF-11EF-BFBC-7694D31B45CA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000004a0fe3407179f6a9b1423428f457b9994e6316ea3516de12e4cba062011272e6000000000e8000000002000020000000fe2a7473ef4267eaa05e7242b50e693899e19bac926f060c0738e5ec13db88d120000000d09e0ee71b8dcbdc8271af6a656d4b382f4125ac739868727766697afbce928240000000cf06dbbf885d22564209697ac9db4cd3db3add763342bfba7a42bce83aba703b8c5a69222c17ec1559e646eb5d8688ab81fddce043a6bd5538aadb1a8c2dff9c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05d216bec1cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2792	iexplore.exe
2792	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2696	2792	iexplore.exe	30
PID 2792 wrote to memory of 2696	2792	iexplore.exe	30
PID 2792 wrote to memory of 2696	2792	iexplore.exe	30
PID 2792 wrote to memory of 2696	2792	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c14c4c530a2ff2f7dc68c9687d167b3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
053fc927a5b48e99d385523d9b1f8429

SHA1
52cf6e6897827cc127e8af945561463c7088de8e

SHA256
a96d542c1f2c1ad55b06238205319cf7008cf5b04fd18ce3b8a2b6e00f82282a

SHA512
8c29bd66d60f829931d5381460c7f6e864385fa78a9ac364f054a2f6808d60efd8079deff8d802d3c65f66989bb71d716b89ba5125a10b560d0d81e1fb5446d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9889cf45c80cdf985c51a8064cf7153b

SHA1
221cde039cbabbe68ff99775dfa54cf4c7b03c65

SHA256
a2957ce84619d850782a9310c15d397b6a8ae796f084c1ecace72dc1b8f70d2b

SHA512
6d11c30e3da3e4272bcb9c98e6848179aac0d0f9cd80a8adcd718aa9cd7fc8c660ce2c9d94b564b7fa27741b4335b2f66449e4cfe6dfbe0f9d2e0343d6ce1607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89a5297a74bb8febdeeb47bc85c0d72d

SHA1
548507934b3a70d420fe66af728bfea3669c05a4

SHA256
3fb6a2f5c649fb5f946a26bf57546a70f300e5e8d783ab33f53edb279f09d405

SHA512
fa78deb14a9e9c51fbb1549be323fd53d70d0f7e50dd7a85120ab83229ed0bae3b25871a9f71c3813d629fea80c81c5f8764272c0aea0a4ef7870fe659f0c835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a433aed01890b774e2f6f70db867b83f

SHA1
d888a804833d3a798f1f32eafccb7458492af492

SHA256
7eaca7f39c82d833d1b85125485b32e18876765a03a366ce3996cf92955c48e4

SHA512
ecca96e7b5908ef7f7586d1cb1453cc9a94f52631874acbb314f2640f3cac462bdc7980c1dda31ef3c8a5a10aee21cf6383354b7b205c66529aee80f27a766f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98a96f1eb3af29754187fba9752c4417

SHA1
3087b494b97b3ddf9886a923bb5de94cb1416fde

SHA256
37ef9ef1c24a11b958fbf0b639b7f28df237d2995c19be2e6926e2e5493088d2

SHA512
9c23919621e46aadd2851f1c40080d559224b52ecab7bc013e79d57e9246170c33de910b3b4ee654e3684df3807a173c228b534bef425ac8df74af2f9f68032a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0264cd0e1fac16f6a0afd0ceefee20d8

SHA1
cee2fbbe2c15a878f63e5a1223354ef7fa6dcc60

SHA256
e2872f44fc79f75099af4c379611fdb5939c98766008b3920492d4685174f867

SHA512
7c45056128e0e7b188165fd996e0c745917266c014a8216bfbf349b17414bd40656b3d185534f646a8abbb1a480bf5a02a8938eaab91b11a3f47ded76065cb44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4892f1bcfa3e82cc352cadb767161ce1

SHA1
2e11f6dd8c580760795dc8f83916845d5328694b

SHA256
e952b0c09ae911fe3b15f27f5171498e37c663cc84906c043a8d558d99b3b350

SHA512
3be289c33c0a641f35e8e705ef9ab295cdbf4ffd74a50b65aed71e94e8a2a3bc60ee7fce1d7d88af5191f3207ad6d5d29f3f73ed13821f61d0b5a64dad3283bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e56dd89fe7278ec8151280ee4671a5f8

SHA1
f99cd8da12626fe71fcd6a7a140fbd2a47245fb5

SHA256
7d9b6e71b0cdb40357493abbd3415590563908a408b8fe8c5987d7349154f867

SHA512
2d60b53b6510774db937c7df483759ef63d3c28b5fe05cbb975ee970b1a4975b3aaf8d735781212dcdb4b3e87e2fc344931911dfe8d77799db1794b3b547790b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be7def190bfda67de153669c722e53a9

SHA1
a71498d5b4463073ceca6ca8fd8c9e33e79c432a

SHA256
541e4d89e6c7026bbb3edafc485980a6b76dba1088e5431521a8dca555c14425

SHA512
534f33f8290d6a2b275822cbf8831e0aac81cabbccde50cc7ac25c6cc20b48afca2f2f21e5cfd1c20d1f86f077db78ce54a0658ddcbe1ee67fbdbf7a10e3d02c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab454D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45EC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit