0b49c4bb043a1fcb30919b0c0c4deb2e90c22bdff1ce0815f5bcae308a6af614

Analysis

max time kernel
143s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3cc28d4c010f691aa89143714dd1f953_JaffaCakes118.html
Size

139KB
MD5

3cc28d4c010f691aa89143714dd1f953
SHA1

1ed423ccfdab7519a9d4f9d915c994637ded10d6
SHA256

0b49c4bb043a1fcb30919b0c0c4deb2e90c22bdff1ce0815f5bcae308a6af614
SHA512

77daed17e01da1c965ff7a6f1006e89ab90d38caafef1b7c1947c9ce9c64d0d666383781d35e229c180f6fff92b679b142da3a8f65decb7c52757539c4ef2da8
SSDEEP

1536:SMNSdtMncPTuN5Sx8lUZtyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wd:SMehyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434940040"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69AC4561-88F7-11EF-9B14-7ED3796B1EC0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000006421115fa29da88269171a0cc0ef3b1b889e699db50619b4604bc113c56d7c19000000000e8000000002000020000000e246d956e35dfaf6d5a7024d57539e61d0437357a99fc2c2ed11a1c5376c9c9b90000000a40b918b3d8dc88695dfa27e9fe3f308bbb252e4ce230de182d104b23e03b1ca5d7372d54693f590049ee3365b3d2b1f128f416bb7e08248f28d2b351771566ea25b6350043a3b421fb1892260715ce691457103afd91761309e016a4732a6f4bfc23f7e5708c5c2e0351e493f4871c7627f50688245c77c73a5ad89d3a2bbc971cc735487ebbaff9fb17d5fed7b413340000000aaeb8e1719b8f0c03e6b85eff303ef139123ec8fcbfe864f06bed6c13ebd45415f0573e43ac0022f6b3b25d16bc1653393c23fc67d6213249c67d122713935d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000f9dc21ffbcdc5d82948c5b5078c352c178e286c1832f069fea0b00d73a03fa8b000000000e8000000002000020000000aadd13508fe58d62d84f0556b6941c204d60c45413aba7892d1e582ba3c4359a200000001a523c449f40d58ddbf29f189df30682ae9544c403fc4dbf3819b61d7ccb963e400000002eea94ef20595c337ee3f55e159e7e9e3cf1c1fbf2c2399b8f70224c716c94008683a2da2ba723ca770cf265b145e80e7dc6c330bf93d24063a8a797ffda82b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30da6181041ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2816	iexplore.exe
2816	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2348	2816	iexplore.exe	31
PID 2816 wrote to memory of 2348	2816	iexplore.exe	31
PID 2816 wrote to memory of 2348	2816	iexplore.exe	31
PID 2816 wrote to memory of 2348	2816	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cc28d4c010f691aa89143714dd1f953_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0a5f4ca75154cba589ae312f5d71733

SHA1
0421ad9306c76f3e30edcc5271e7658d2cbc9409

SHA256
68200fc579782d7358312b94b54a256f13280d3281ab671e9c6479c4c5e76d35

SHA512
cdfe10d1b1d34eb72046b86c091a672599d2636acf92695092a3839e08ea8c1a4f925834ca4aae653178ea37ffa18a910185e63e203f26c2cc27b2c92d95cefe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
040fd840956e18d491d67dbc5e014c2f

SHA1
95b2a2cfab46dda1d8831f4e2115246e231fbed2

SHA256
ef344763fe90e6056f958ee1462eb46d1e72065a31cce7f9b4a8ee51c3039845

SHA512
50f80b78dacc64e72bba6db3703901ed52d948e84b1a1522959edaf3dea1a675499d8a7b8a6afe2800c3617c8de6f2f6df77858c93adc95ff19fc9e6b7bc76da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c70955826412f3f611cacb1dfba64023

SHA1
2cc698a97a73e340f16e4303d7d88762b787e0bc

SHA256
05e192469d9b51db149ca86c3653383aca78f9bcffad3ca287863d1fcd530fff

SHA512
e2fe865cd2782a89c05ef28aabdc7334959cfd8b1fd1f706ef37b82ba7cdae03c30abd1d94074caef8177208e5a5d560e6a21114cf8efb2109f58967aa572d81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5acd4420ced862ca099da4795462d98a

SHA1
18f778f4eaafd0e35e222da3bdfcdfe0698e11ac

SHA256
ebb3eb90b261d792fd0d5db94ddd904e51bb9ed7be8173fe1bb008b82f7bd968

SHA512
4180fd178523b5c03c8e16af9ae0cf41b368be7f7abef3e10d2bc03e0798bc6d0b376862fba9b115a87892829b7b3e21cbfda439b7d002f7d8c2461e720f26c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf4bf8681b5d0ff1b970ecda9bd74a35

SHA1
2c75e0b3b7f3381c96728b66176c5234d830b301

SHA256
cebe88a79eb6808cde68d1dd11b705735f7ee76a106161cf91f219d21127dd35

SHA512
d1025463a56a36e2326ef2019c1ce8297e1eabad2bfa14af2be2728a7aff3272c56f57b2bbbb2a50fc73324d55848d1019c42c5b7d0df9a5f57a3cecb6899636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dca0a5c4e8c92c3097a84cda44d5473

SHA1
83bbb6a19a1fda8195fda668b23eb5b09dd511e9

SHA256
bde6246767ed71d32b85ae9ffc107a0d8e21aa7c83be0a2b1ec454b31091da58

SHA512
2c2722d5624bcae34d064efc21d5a83a0e6c3f592a389bcc2086e9cbc522d6c9c8ae4a7559ab7970a0cb2e37680fa9170e19cfeeb260c4c32e49833917d35c20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6a0dcb2ce274ca07cc6388a01d579eb

SHA1
73ac0bdf98f2993f1707af08b95ee07676399281

SHA256
7fcc4aa7836f4c162d7517ea98130c5d7f68e902be1f87490bb4748f129cc599

SHA512
cc6191d5103a5e75422122c036fe8e5c2533c317e8d1c8cc4f95114fc478450a979e7b887dd60c6b982222855ab5cff99c2896ca54e100b44ceefe8c4893fe57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da0fe9b49fe7c6c76438152cfbc47c40

SHA1
2861524fd3c36feac0f6bbf7603f2a643df872a6

SHA256
2c81bec81b1662c0e94e69c6b805e867b2838a555e1b4ca13928abb8001a4197

SHA512
a9bd139028002697cb64d0f58c86a514d4100756b4b1de88ca8dcdd5e283f0d9be4842cc4b126d755f39df90d58b2331ec802933037b4b73383e103677f237a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5c8f1e3d9df9b456237e036b2a51305

SHA1
7c05b7457c188d1ac51fdd35bc7361848d57c13c

SHA256
22e311daae29332a1ddc870e1f66e90a3fad2ee21138ad3f322fd830b50cd221

SHA512
b2e2fc3af26f6d5398471492daf999af791c94d212ca161b38671c04a0e91b5a35c94d5210872e103b90e4ae6c2410c132b586d9f186d31d98031b150ec64ea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cef63be623877c80bc1f1c0e6ef76662

SHA1
9454b6a58af602384e64545817bf79747380f463

SHA256
2c9727eb114538832e0c1fb863f9bcf66759c218493ddf3900602a584683d41c

SHA512
98fbca3b49f71820196cff9397f6367cfd4b53e5fc43def967a7fa3fb6e13164eea24e105d3900547c9e070380bd79546caf42d7d2d56401d2138a69df3e84ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b78f6d5303b45e057fa5b32e38291bc

SHA1
0a19c03fb8e930980c8be0a7661b53f07871a1ca

SHA256
26eedfd715d92fd57ea84e344885ce8cbd2943b8afefe9186ae71049442d9aac

SHA512
7157dd761856c6c389d302c059eeb498d7f5bfec93daddf78a405bc6c056ef9b1981c4ce3b365c141d6f8998d8b395477bbac6fb8b631ab6a2471413279b9eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE3E9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE880.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit