96c70afb0fc6b146e7cee25366c95b4b5cc4e64b2fc635bda5a775dacd99124a

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

448e29624f56364b7eedf44ce6f8d850_JaffaCakes118.html
Size

19KB
MD5

448e29624f56364b7eedf44ce6f8d850
SHA1

d4208a098ef27dea517a10ba3466a71193ed3e73
SHA256

96c70afb0fc6b146e7cee25366c95b4b5cc4e64b2fc635bda5a775dacd99124a
SHA512

f37b128153c86fa8da3d4b88c5a7441b7fe5b8cc4f55bfc407f89df271adf360cf093f94822ae888d6702f6fab3646b00e84834674ecf95bb835ed9678e39c52
SSDEEP

384:zidKhgESdTVBD8caQ3R8+bvzemLxXucfIk99heazVc9yT7:ziuSdTgct3i+2mQOIk9S8qyT7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409e7f3e8b1edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6858EF51-8A7E-11EF-8B05-6E295C7D81A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000003a503f913b4ab107b5402e90d5025b20d858c25d26d596c7f4ed67433ef3ab83000000000e8000000002000020000000ccaf49567ec007e00fa24375cbb91fd5b689b7971db883be40084222b3ab13aa200000002bc7d8627b7db6845601b948bb5ec310aed0227cfd39c0961fb6a5bacb7bac65400000004f9c471a8ac61e2a8618f2f3a9bd675ec4798d866e03a30fd8a2b9276b7fbbc05af94acf48f1d50cd47f5981e1bd1aebe99ac08966b82a1b254b305b41459795	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000052196f1b66284d00377f2c800eb857c79547992dc9fbe19c1a1a8947d8a23ee9000000000e800000000200002000000072a8b9c92f328d9ebaf8ed51563cb75f6665a4d08f9c3c9c098f0618fbe1ba2b90000000569bfb009c0d314d40d448e376eff81d2856023fd67cdf57c9250daa78192348c378e1e2276c6ac80652685daf7a128c61263063f5cfbc8d986edec65c8d600429542b3bb479a9d202e9d138f52707d90ed8855150bc3d78642dfc95fe6a5fb46a56005ca9ef077451dc84fe4e33e7c2f3fcf19d1b431ad059fdaee8ecebf43db8a4299ec0a19b14709d219518c51a9d40000000f24457d1c13389dcb0626df2987482532e1290afc8c05173009c4f05ecfda56a325bc20dbd719a95bbc0cec764d95878c8d3a2bd1a0c144998b000c9efa19d5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435107967"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2828	iexplore.exe
2828	iexplore.exe
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1232	2828	iexplore.exe	28
PID 2828 wrote to memory of 1232	2828	iexplore.exe	28
PID 2828 wrote to memory of 1232	2828	iexplore.exe	28
PID 2828 wrote to memory of 1232	2828	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\448e29624f56364b7eedf44ce6f8d850_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2828 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb67f50ed52a37fd994271a2ae5ae492

SHA1
82390923772e8372bd9f6b09fa9c725ad8fadb61

SHA256
de13f5360a23f26b849d0374f685efb1dc08fa4c9900fa7880089cdcd45fbfc7

SHA512
9dc8a63290f4956af28bf1862317bcd7b068d171546efdc8b64850a1206bc9c2588e36469b244c8ffc1f06b9baa9996b1039b431e6561c6c46f6b49793fec591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d37d467302497afeeb58486056245c2

SHA1
86d8969839bf73eb752718cd8d84edf9b5e5760e

SHA256
4904be0364b95ab553f0b9de6c6c169340df50c168a98298e3114b501df6fca6

SHA512
08b5536ee0e32e132a696135ae2d9681fe147b3a8741e7a86166beb4539510f1fbb685e6ee872a70f5faa10719e7db75055526a1e81b0dc7cf96d39e14f91234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44cb63be1735d9daaf079ae2fb1dd5b6

SHA1
100ab321f749e29ef38b731cf5d29ec1f7f89d5d

SHA256
1bb49a2020c176a840de84a7d39e1402091bf8fbcb58554ca89c8230c27a2ceb

SHA512
dd57e6c91b125e53a4faca34c3c7a5f4e7a67d2f22957db33b7f76c3ee67227c3e0321d434d98025d95341aaff652c0a7db3e7e642452ac6c17c8e76da38d27d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ab3c1ca57e5c320fa3734b173e9f2c0

SHA1
bd9596e5ad63515b9a0fa7a5dc935911f639cd2d

SHA256
9edd3fb13cefe906a176cd01a81133f35b712b2faf57769a4af5d39d7219da6d

SHA512
61825963aa5ddc55d7812633e1a037e4398bf68fb93547304f10c3dbd789f11e77350c3f0598fc1c344388ed7a119d6ca8ca46fd14bad68bc0b5f0287ade1e35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca67dd71bcf238f5a2ca381ee3868b74

SHA1
d22046532ceee8140d5fc1d9b403157f5d91b2e1

SHA256
ca8e3ef9d828d3e5abc6adc63b9a8a123d09165803fc9d5b31a399fff8780a22

SHA512
de4d322bd66c9e5e3fb30f0f6fd0670b8449c0754b0246bb25575f1a6717fb6a18514a592cb58b6b7435c6f18bc601649064f2f2ebf16c6ae48a3c8f69d40d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0da4407e535c64be150c8c0b409c4cd8

SHA1
179e45105c9d7852e4c26b815784a3b2c430b574

SHA256
3e654e1cbc9d13f755444f2f17f336d697ae30ddd1f356393a34ef2773ebb983

SHA512
6a213771d2fffb270dd596d48b34a3758fdb7deac1bcc864fc4060a57578373bf29779e1e07069f678b13d9dda0be80c4ec7fc1c52bbef5149f9db95ed270d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efcdcbe78e7df0dda92e63c919e84fc5

SHA1
325247c4ef32eedd1ecadb029b828a1078a4523f

SHA256
3d7d799e639bb5e9cf177463d996831020950a9a2c4c29db1e45bd69aeefc35a

SHA512
5ce27b66c434addd6736facd7af075953bf7ef6f96ae8c15ae938975cc3b024d4f194b6de3196393aa8265238fc2bb27923c9ed7e4b3cbacfa03307b275b7285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31090e60856010faebedcb9eceff2130

SHA1
0c6f8ec89fecbb1d7268d5b228841229d85d0acd

SHA256
aaa8530a2a428153d32c15bd029edeca97047a9a52003755fe0b76159d72f683

SHA512
9e9dc410637e8a03ef2dc0083994b1da2655a2c3bf6342c08a89ff1f3734476bf9ec25fbb24d25cbed9e9110dc2bcad43c08233a7d4de5104c757bfa3877a73b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b096ed3af6e9756ba09bc30e4aed675

SHA1
a426701b9414536b455c943f720f0aebf6880bcc

SHA256
0666c6a4681194666d1f3989687f67e2af93a6f7050bf9902caacbc15306d878

SHA512
29d58ab04dd0012a002b4714263d5e2a6412670b3310abdfcf8d847f0a1388717eeb0b6f319085578fc40721267db5f10c6f7968c3c894e15bb29195cd355948

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7e9cb101b8e8098cd571a4f7d89a7f2

SHA1
627778574e2dd1cd4c29f0becd45d096bfce87ff

SHA256
2d85c85e21474227fc809207d43709268f8214eacfd5e600c9df0e620106e131

SHA512
d5e572c8c40f6c66de9c3938129f0308fa334ac2219af8927fcbdb9a28ce774437415a7910dc8ea410b7386af9b9b73336b5e74e76f806c458b902443f5fcf2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e4aa001ccbbcd7273297af8a2a4e6b9

SHA1
f548285595e140875ebaff1f92ada0cef2dccd90

SHA256
5be47a12e41560a4f150167c0a22d2967b483a94556ae8f01dd9c2682fe16a10

SHA512
0757f42808db4d2f1d7becb6761a3007e2c7a33df8516485816d92cfa929e6f82a0a8114fd765321f77b776ce778fed9a6a6ec3855f2cb053b8a5ad859e64ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9C8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA88.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit