9ebb10f14a711163e5bd1e7438c4295ebc8ddf49ba0beb3c1dc1e3292d95eb85

Analysis

max time kernel
135s
max time network
134s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5255746dbdfdf3e2b51665acafa6de93_JaffaCakes118.html
Size

53KB
MD5

5255746dbdfdf3e2b51665acafa6de93
SHA1

892a088b30ef9359e4f89a9087148dbcdade038a
SHA256

9ebb10f14a711163e5bd1e7438c4295ebc8ddf49ba0beb3c1dc1e3292d95eb85
SHA512

fca89dd5d28ba1a4abb21a1677ad2240a4927c5c9d987822b1cb70c2db52fcae700dca82b1d576089cd0de33b8d22800140112b233dc3618f0e6639d489449ad
SSDEEP

1536:CkgUiIakTqGivi+PyUGrunlYh63Nj+q5VyvR0w2AzTICbbDoe/t9M/dNwIUTDmDX:CkgUiIakTqGivi+PyUGrunlYh63Nj+qf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1B6C3B1-8C92-11EF-B4AF-66AD3A2062CD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ff5d7e9f20db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435336557"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b1319000000000200000000001066000000010000200000003bcaec8186a8d544d5221e97ce27a3f7e3294bcedb5a4fbdf61361b4753b5158000000000e800000000200002000000078bba92cdf8f15df3501bf250c07378f1dfe17beb1aff3b230db4d92d8355c67200000003c874bbd797e85f622badc04b26c19329b9daaca5de2f9f05ad535159ff1b3c840000000e3bd6804d859cdc49f093becba2bf86c282aea7a99e4448a32f096973cac35fb44adbf0a3a1a66da3e90f58697e392de300558f4af0e335d3290615f2a8cd3fc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000cd07ab8a965ed102af8b1717af2f1c39e08e4bd56a050f19def7255530e7b042000000000e80000000020000200000001ebacfd8337868c14c5f0a992659e43ce414d783aac1ac62a16c53fb953f85a290000000183ae9b381d208141b99c7c13a88de01ce0675483437ec2684e758b54e20cf028f6bceb90e2cff71b4ac44b1feca97a9e932d6cbd60afc127e344039d585c45d7190dc422b5ba6a4e2141780c865885296e9c6b46f3a2be495fd0ed80c1ae96b66a3065d1634d9582bd1bf226b0020fd5df75e02d1a6a6c2cd1f49310a6c24aad0be3160451197df8f0caf40fc422bbc400000008cca805f43d6b340e15ea857291644db15f2fb0e40abacaf547db9a87d332f3bc6833ea661fdae2bfbff8443556f6d9d92c486ece4e3c612410d0f91f4475c32	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2796	iexplore.exe
2796	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2812	2796	iexplore.exe	30
PID 2796 wrote to memory of 2812	2796	iexplore.exe	30
PID 2796 wrote to memory of 2812	2796	iexplore.exe	30
PID 2796 wrote to memory of 2812	2796	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5255746dbdfdf3e2b51665acafa6de93_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e515b3d481907e31ca0bf56eb1d4aca7

SHA1
20615fdf9b8d231fd2f122aee7f24a7b84d3a4e8

SHA256
bb36e72be21ee42421739c6166401fe3bc22a30cf590a3dbf77d3aad0db6ab03

SHA512
dbed482338537e07af404b76e02672ed1ed660f5a4b48bef1567249ebc12040335ffe08f5b1df7318edab8a8c7b2f99b16d131c0f4603de2207dca32081a8b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0823dd9b16f86f61fa27e025be5ce17

SHA1
9425c8fb42b304c8ba704dbe112b0074c25a3aae

SHA256
39358b2c8a35a23ac050513aca5e769720eba2aa1a8ae5d43a6f60e62723c3c0

SHA512
13f9d049b4e6d176a09f8ffb51ef1878b014cf4889519dff76ab9e25a8e604fb5778abec24c742edbb23ca7a76e1186ff9fab67325677cd4589556d10b1cff36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d2092c92ac32fd8e3d3c2b08df030d6

SHA1
a59a8bf6541f5604acb52cff22611510ca721619

SHA256
70f2a91abefd29e0e0856676d9906a10bd4e7488bff99139fbdbb617a1058a20

SHA512
e0c7e9e8b50fc9eb9193ae79ad3933f4ba6a6a644319aa805ecc00e1e74f3e65a48f87e2066a3cc5c857395e28a81232728fac992fd7b82cdf81e125754767e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ac42657e0ece28dd5b65e2a54946de5

SHA1
6d6060237b460014dade9a1211038d1f62b72fa1

SHA256
9f83d8053fe20b3a6433f1fbab636357094c9d120f144ec133e674f9b7ff49e3

SHA512
ab29227591f142b4d2435ffd1484259f5f6ab320538ebc2ebf3ead1dd2a0d5cbca0fffd564d499cd49c07e3a11559e2901e73c98cb7c522d0ce2400341282d77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bac61fe79b7425b3623d4aa9649eae6

SHA1
d92c34e7d411732bcc73a4037f2bcf0f013c8349

SHA256
8b915de3cc1c15da88532d4a35062bbc7dfdd741e2b17074b2270300ee9be429

SHA512
da7d11692d93512aef213b7c2d5d29d341f9ebe62ecedfec61c842ac2d0239f08132af8dabe48c4ba06f6cecee6d145f86ce8515644b543378c1e86389273dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebf6c725f9312c84d2df7dd4d331e3c2

SHA1
a9b7eccadca5beaf7dca5a5d0e3027b45721c61d

SHA256
890c0f69c01ba505c9ba5837777eb1ceb9efdd32943fc3dec55d6e1f4c4ca8fd

SHA512
e834d3e0300c582f8cb24d2c6c2b28798c9c5623ef7314b1774566ce04ea4def0966a250554b7258847ac4dcc5d98a2b6ae37d177d17a6e5cf6ee5f9f84d5c7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56e3d371163eb42f9c2d1096daf7489b

SHA1
d82438b509e24316727a5275f1c161f1443b2d02

SHA256
1a6db318ff8f5258a997fc3c364c208898dedac534f10870e52a6dea14b46333

SHA512
e1e4acf68738c1767293cfede75bfaf7e11fedfda9bde8a52efb9897593613e164b6cc917896b111e7e9bf78199a663107c2af4a5f0e279b7113debe07f7f494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1d868e040655cbdeba2e4e8f394fa97

SHA1
4aae1d04aa268f549873250ee9fe18e6820d6d0a

SHA256
b4a8bf7b21512bda92b28a3d301b92e9b009005e31e9cc1d5e6106a94cfa0c44

SHA512
2057aec2d7b92130a97e99b714e7cbc703979e519f947f4fd0f680228fbd18a084b31a92cd6f7c6f98dd74818764fa64c95973f230df511516762ee1f36c4d5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bb9977f2ae38477484169b7e6bd3f3e

SHA1
eba1de0949cfa5a08a5c0569a8c94d5facf17202

SHA256
c9b90f95c0e8d90f4c1d3bb9b88f5a164aedc37f6c45b03cd9c8c101d71e73a9

SHA512
e4d407bd91d2df900e85e28a624a4fe89e0431b401e7f8c18ce32f73dbddf5a6edc75083546bd18cfa08d7e67baa2b075f7b098b7cba9141aa6f260d3800ccf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71bc81e2362b250923418f6315507ad6

SHA1
414ca812f8a8e162998a61fdf59dd70ac34ada79

SHA256
41680f44536e38033385526c88385b5e4f21937d1bf9c9298a3f5962ad565c30

SHA512
000b37b41483e60e598fe2e5e3d23086ea9ef718548b689031f96bc94b725b9cfcabd02dacb9368b2533398822fd0b4588c0628646afbe45b9eb179f0356cf6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DUME8XYE\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA7E6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA856.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit