bafe4ab2903ab12eca808c268e9a9c50175d10451096d2d52ed05904b84e2e7f

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e197b8e24cf49235ec51b574740d585_JaffaCakes118.html
Size

29KB
MD5

3e197b8e24cf49235ec51b574740d585
SHA1

b05b54203c5a8feeee60a38d98d5c854ada9937e
SHA256

bafe4ab2903ab12eca808c268e9a9c50175d10451096d2d52ed05904b84e2e7f
SHA512

0df14e5e632742f7283810a58fcfa4754f41232a7dcc8071a6d27f9be6220c760cb2a60f01fe30774914163a86e3779013fb8c77ca1612c8296c597d78d0c855
SSDEEP

384:SIDtlh33rv8nmWR/T/glh+VNYKddQmjSmTLr1lL/HF0sVbC7sMA5HD:SElh33Y3vRnVbCIJD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DB45B41-8925-11EF-B9F2-E62D5E492327} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434959718"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000d1bd3275d386a20e3060a5d4c21c7136a446d22cf0902f63269441c4acd16f72000000000e80000000020000200000001c071e4fc393e70e176290604d6c9b6382717009795b8e68946ea24689e997f49000000067dd7e85c4976a16093bc72f9ca0ce7f1a040ad6d3f4beb220be4e89752042f44eafac7f342b5806b3391b3aed22e34f015435ccf34de94af20d5ac30ba947bc3882ae8af7b56075ba3f89edbc0a8f1ac69f5fbbdb539821b75f1cf79ac59a2b095361c98edc1e639b8e478c7675d86dbab3e4b513e65c1dfbe49c85374ea16fcb9ac3c643d82593e3d53f0782344ce240000000638f502d785ec9b677ff9f3a79ce7536c758995785d8c669803d4d8449eec02e11c238e277d889e956f2f90dec53205b5e22a328dee509f9bc7352dcfad78ad4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0300b2d321ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000e9280d4ed9b2c96e771ec4783e701badfb380226f283890c3ae8eab4232a3156000000000e80000000020000200000007882d28c13295fd11b0e516ff8ca9a5751a6066c97ca21bcd681ae470359e49e200000006a8123e4b48ec0092946fd61730ec225e4e469519cb48c8320eb0dc0b77c86dc400000005faf700f872073d737cec9ca11c56070b8a58d6152cdc87419f64da166a36086a1c0d968d0ea7faa52cff58d261e88473c825b052260b1e3d334a0c4740c7d82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
768	iexplore.exe
768	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2420	768	iexplore.exe	30
PID 768 wrote to memory of 2420	768	iexplore.exe	30
PID 768 wrote to memory of 2420	768	iexplore.exe	30
PID 768 wrote to memory of 2420	768	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e197b8e24cf49235ec51b574740d585_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81c0537196070228ee176b5563ee46b1

SHA1
5f7229684a97107dc985879a267394987ccc0aa3

SHA256
0bf7d9a6e35b56afd9e2392f1bf16b67fd21cfc0f89adff3d4887d5e8070ff77

SHA512
67d7c507caafa7c625cee2ae07f02392fafcc0c9429bb70b53c6e81d2c567004ae324f783e4de5611e206e882e7129af132f1f0b908c82fc096935ce5d799085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b843317127c3d0496f79bd755b23c2ee

SHA1
4bf22dbcf32da7898d6d6c0744fb795c16b2d8db

SHA256
ffa239f1c6419e121ca383bc902a9f631d3d2e4d77ebbb5810e389d5bcedf8c5

SHA512
2d0cfb9a05ae4756e24471e4618d1c88b4575ceffb670ef12ea5e205c1bb333120ff1fc3b10ce8a0e0eefe10eb5d1c0b38141e5d2624dee4ab0a0449edfc9fbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae2a831320a4ed79ba86e2495c3abfaa

SHA1
a38a1f2353edd12524a7c69d841e24c707b2af5c

SHA256
68348f6976cdffb2c361a1dc4439314e88c09e08ef1948156167c72cc169ace9

SHA512
8c888839b1f6135e592f337aa93906d7f790925beb2746b5f25801095805d7159efa8c3940ce6a87d335a1f9e6e10b89a68d79506b8f559b41327be3e7dd6fe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fda5041872a7b8d236a695aabc16d861

SHA1
0964f92bfad786bc0b8f14156a3fb15da0e9a4f6

SHA256
6e4d0005ebe1da975978574fcb2875095b51f895c8e49dfcd0530dcbba412a41

SHA512
0031ec249cc8a3a8ccbe50cabe273ec65f4922a067b12e351cb1a42f2860f8917ec35be736c27b4f2c00536d4a92309f88cbe44c514ea08fa0db5db0c1a1bbc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a66487dc61941f7bc8b56699bdc85212

SHA1
667da2e57ae963e53974c10da24b443ed66d21b0

SHA256
b026097b987d386a24ac2fd8618fc8467cf0af9cf73e06e6a279c0bccd55e931

SHA512
dc7a9d65db481246284ac98194a08c70629623672f00e87fd3365c1b18773a676af0eb2c7e03a6c7921b2c8bba6018080935370b66afd470b5c3be32dc9324c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f971dbb7928cf8253dd84050f52551ee

SHA1
e359a148c9fd9da8d27ed0cca0b2e1439f038c41

SHA256
0f77e2cc0f1d20b2196ae87a5e1258a0981efea7b8986ea8394a24370c700357

SHA512
26cbe2c81a197c7a1b4adfd8f514ca3ab19dc18ec7a1a6e9e2b407f9da2e6a4600831ed9f9cfabc65a3abfcf561621e8c5f4aff783aed8671ab6dc5a5adca791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb60bf2b13dd3d64ee52d43babb5fe35

SHA1
1e03979d041050831b93d32dd551ac8ce7af850c

SHA256
f5e1d8e7c43fba572ce099d38256bd90ea03e0ae75f35bcf15695218bf282836

SHA512
a01f7543aa45963ff36036c3737b8e623a25bab6f6349c467076061745bee8f314e1d0072f6fd58958d4a4d35714b34e369dd78ec213bf310359d2abe2a7bf72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ba3726a192b134b8dc97b1fcd598238

SHA1
0e35aaa82bf50d7d4d6dcb8ad82cdaa674d44a53

SHA256
80dd553a22eb1423b1f9722b67e80b61fb7ee918d387ab609a369530f3d2e3cf

SHA512
6920b94ac32d20bcf5350a7a5cc2f9c48003c27a6759babe7a5e321445fb1bc6c3f0e0df4c088fff9f2b2bb3dab53d783d24ec9b7f92d712d375e683d62043a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6510ebecd25208ca6264f8536dd88271

SHA1
c22684612b20546e368cd6ee55026353ee63c0ed

SHA256
94aa187e2fce8c75481b7ee4e62a7c0bfa35bf81b984044e9ccd9ad895b65e2c

SHA512
27c25bcbe86decef7112bfc903146321ccc40e3b7b7ecde3d85a748dacf25ad772e20c270b0d04a79b966a231e5395c8b0fb8092e0ca2f55bf4244852fec3c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bea73bdf3b6593d3c93111ef682c6f3

SHA1
c3fbbfe8cf0921e46a7256e294b0d3fca597db56

SHA256
c3a92e9433da699697867d00924f771da409f0719affe49348249c8da57281c2

SHA512
e24a33748b08c2af568dac7a54fe76d9252bcf5f5b4dd64402af1707af6001b376853435ed53238df2944889b0584b4f5b4020739f4c212a4e50f3b57a87f4d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91e4ad4d39fa3253198d5248909be8e5

SHA1
88f93915a7f3d7581c475101b8e116e0e40304f7

SHA256
bead59c7decd8fcddb88cc6ae66d266c05daed03fe4026c7630f776e7fb2d639

SHA512
34cea9184141533ac82f2099dc37fa806fa92f0f7f972ae4f0dd687a277a0cde6a2f8991ecbf721d5ebb157163bacc3929c1bf60326a5add2400e12223f4893f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54ea4c5b11ab113046c2152a3fa36641

SHA1
f01ad871dc878c4e5eb363e089de6c5b8edd16a6

SHA256
d0b1a9ef75cc1fe2c86c020fae5c8e15bbc1aca259b87ca92822ed67ac7b660c

SHA512
0d04fd04caf20c56f14e35757ecde58633682fe52a31061b4aaf70de485a9aaf9ca3e087d632a50cf43e62e177de7e4c65d7377e2f7ff64394064a6fff649b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaf9ab3a55e6e999112dd32b75f0d03c

SHA1
0c1ec2c6d66a80bb3c484348df4e1a14c3ea89cc

SHA256
a93a363e153a86a66db460871b4e5b098583ba7f72a217ff7848bd2e4b6e3d19

SHA512
9c9ec36a7adbd645309114d92056b8f6c94ee52b7b5d4516d8ceb92b19ca8c2868dafe4230769465e657ce3a9cc5b4ac88d6104d9ff09bfa6a08e8ed706a5da8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c6f067409590e7ae35df5c0865138c

SHA1
1837dcb1a034d510c4dde605807348ac3c5d479e

SHA256
2aa53d35b28844d24438c185868b7e1049745f6b9bdee43865d78c25d35c0ef3

SHA512
b68c6dfb8bbedbf65c2d3459d31e67ee300414c393603834b69422a65ece1c6f2667a4e42ff045becb988a8df9d3bf6d22d06e888508f9f0f2df7da0c29c50a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab587E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar58E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit