466a51e5011504eb9bdeace113cfcd18812382837c846ca9fbb598330657a7b3

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44957dd57aadaed74d16c3e7d19c8e00_JaffaCakes118.html
Size

56KB
MD5

44957dd57aadaed74d16c3e7d19c8e00
SHA1

5d1f5c6a3f937ffa81f5ea55d31f728cd2c4a46a
SHA256

466a51e5011504eb9bdeace113cfcd18812382837c846ca9fbb598330657a7b3
SHA512

bd512f0beacea1766166e5e27510a5c4722640262c0b606fe2625c396bd289fb31ab22341d7431be77a2deff6276d308e0f819228c084b2383a4cc54d69226c4
SSDEEP

1536:yHWY+Q0JL3zZpdSnCrML0/tRmqNdHvnPQp4qrXlmiO3DxaO3Dxw0Sf3h1pW2siEe:IWY+Q0JL3zZpdSnCrML0/tRmqNdHvnPo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000047082ad4fc9cc7979abb0899d8245ac124da16fdfa77458bf1edbbb131804c18000000000e80000000020000200000003d7d925d33be8c7986e9d5f328931a3f1a4367d9f6aebe2c3bd593aae8f1f941200000009666097be0ba9f2c236a49d0c5df6bc5d326d17e611bb68ea516002f48d84c81400000008fa3e54efd63a310eb9239f10000714f4efeb7bb7a156fa92dde85e9f350aa60caf227784316922dc0acf717b68a3dcf175eb7f13205aa225a541ffc9386c82c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000ee9719b85f98174f332a0658af1ac21c290cb5caaac14065fe45e332295ffdc6000000000e8000000002000020000000b50b6f248819dc190fe8f2df575c902ace187987c3c83199bcbd7b604c459f50900000009e135ba04ea77ca0f175762a4c7cded97f716832a542cce0f18f53d75436b08bb126f7e86fec6ae8b08fb19e54e2a9059e936391bffcafddd73fe06766b2e0b6cf9c62777eb6181afecf368fbb9ec490638484a8001cba5e6b7d7df4e4da4d96c05a7d3b173abef10c9d95e4f7dd20d2894d584ff356e03f5e26b73d0e8052bdd0e88cc03c0229854856aed52f9d8fd44000000070c6cf837f67aa6997ca78ec8b5f390fc408e7018be6aa92702d04fe07aa18c9b11271c93b4d02b36ed2e8d39966a7e159dfda6ea2984ae7c7a771d53c68736b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D69F921-8A7F-11EF-9DC4-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435108405"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c8c7448c1edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2496	2356	iexplore.exe	30
PID 2356 wrote to memory of 2496	2356	iexplore.exe	30
PID 2356 wrote to memory of 2496	2356	iexplore.exe	30
PID 2356 wrote to memory of 2496	2356	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44957dd57aadaed74d16c3e7d19c8e00_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ca556ef9217e71908e45984b4e4d68b

SHA1
ccc18e99da098c28a146d47ebbf546f62380e8d8

SHA256
c988e8fb3a1cc180f53a104c511b714eccfd84539969d26ae0884b65d091903f

SHA512
155b0ab704180b384a26ec833619bc1fd297be721072474410f90e1c940b4da4ba0f2d1726ce527d7049ab76e56a7372d7623233c1d529b1aaaf1e95dddfb48f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b114926e1f4d9ef9720f57fa731c4f8

SHA1
5243053450f1eb363382de7f19b6deab998a0618

SHA256
8c27af771ed142ef629deada2161f48a0fa2fa3aaae9afcaac1a1e2b0fa927bb

SHA512
a483b256e79b87a7e6869ba043b413c196b628deebbc1e7566603a0d29e91ba1df4b64559cae73c07588746c35797973ebec2854d2380d2b21e4cd04e5b36570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b022c46e224d097a2ca83e400007759

SHA1
aa4f8c9544107133a7619d03b4d21430a93f09d4

SHA256
f9c1d483653f8662592bddee65c874826a231892ab8c645dc44e7fe76026fe15

SHA512
3bfd2ca52f3e04a72fcdf7891016c637dd1859d64f0e2e928dfc75f5d7ff67bec73532dd28a09de89aea50dfe53414f4666ea1440975dff8c46b1125b2a6c844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd07a85736ac89298da3f9fe2974a201

SHA1
b322ebe421e4cadaf0f6802df07e282ef5707848

SHA256
5bd5d0be574ea532121a5cb963cf7931cd2999f9ad98c36c2207ab5020c93c3b

SHA512
71a405d048c4fe6e81b61551c3b9f93bb582fcfa91abe9fcd6f49625f76798f643c39d9cdcbb6646f3178668b58ef2f3fb72eeaa4505cf6a1bffec081fdaedfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
378311edd925f860b52c9f1b8d0e219e

SHA1
e96884430cd8e3c8f74d24feb26cac9f08201c0c

SHA256
e30d4ae9a977be37363ad243e2ec260eca3f87f5e4d6d769f20968bd61cb77fb

SHA512
18802d836f4a18b9f42876d3c05c84ae5dc94ab1c0b32dfce08710c798b021e72f3fb5f2d6c21602e55b11d0a53c3cc26c7a744f81db2514e937fc50aa0f03d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f3f0233fc9cca53484e6859a6d6b8d2

SHA1
f10ea757a6358cb26b3f29f111c92fd20b417eb0

SHA256
e50178976789e52d967b97dbaf4a94dd0fa2797377367e1ad234540b086c4057

SHA512
7aed306879eaba7698075d2f6c8f6032ca55bf72c36f7f74f8707f722ca423fbf38d7e9cfbdfb6e4df26c2d7fd6b62e831cdd771220dac5299153aaac156f561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
031fddfd63149a8617c935180b55e9dc

SHA1
3c522d35f4f292e5e040c79ecd73425d808fec25

SHA256
0bc7814a4086418f32482ac5ffea0d335fa306b8fc8eec37d6ddfcfc40ca78e3

SHA512
18d97a005f4114da521a70007e5d5114b2aaa8ad66eddf3939424d366815b3decf5e0e5fb74a5da5a356be890da921eaf49996a4e5d80a437a5f12e59abb5b2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29f64cc971ba1cf5fde17e2109456161

SHA1
23248583f4baabd66c3024e31951a28d0d9c0019

SHA256
3e580f17e35e2cfdf1019083e6c627349717e17d682d5dc5ddf2974d169f1b27

SHA512
6ac5ecacd1c8464e93112e78e81d6cfb74fd6852a02f1716093d410f2250324df4d7407e0db02f16e1f6c3aedc7ba799104e6baa3dc9c5e8983fb36c86ce8e03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2bcc93e27734bb2b389b9e0d81db16e

SHA1
aeea49f1db834f590e51ea2e60b7dd7d7d8af805

SHA256
01ee215ec442c9b712ba777f8bd5d0b6d4730c6e13281fa482619b5edb4a5fc3

SHA512
370e858b756d89991153de2c7e5e66ee1b3b2b7c83a03fed1f6118fc4df260871d5da4aafa27690de33dace8a816b3c107b0c8ad37cfc6b1ac15f6a19b0e9d9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c534d6e57770a2d8934678afb58febb5

SHA1
046603ad5f14bf0512cdcd9723678de5c858dc77

SHA256
0c568970f35c740e9384c9e79869205ac60272704c0c04be52e70bf84d757594

SHA512
2df76058d52a8d661bf8f1e12070498776a72d88108396684f5fcf611a0610a2dfb8581d087d11707cc0b9201230d79fc0fe0c51741ee33d237f2767baa40f45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5f09a5200fc346cb345aa934303580a

SHA1
1411da62aadf82913627ac7e5a10de69608d6c36

SHA256
789ff6323af665745a861a9eca6b92b11e84d7d2de28243ec8db6885f6cc10d4

SHA512
b10daa3147553ff4d7b118e0cd0df496ef3806a8f0fff479ae67bdc1805d4a4b4636ab8c6d27210135e6317a7463dda4091da99e02b06089acf19444ead3a251

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF0E7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF176.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit