879b435e0186a43f6af138c5b501c093b6d345440e8254538cfd7989039d17b5

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

827144bd7b5f08be43bfbdde3f7d4146_JaffaCakes118.html
Size

69KB
MD5

827144bd7b5f08be43bfbdde3f7d4146
SHA1

389b8064c2f9a2b896b93484b0300b68b567a700
SHA256

879b435e0186a43f6af138c5b501c093b6d345440e8254538cfd7989039d17b5
SHA512

844ede6d935f3194a28b3762195a09a1021524fa532d023f237c3bde15292ac8a73e30e3d0ef78f8728e1907d74472a46108ebd121b045a0eee985aa7fbb61ec
SSDEEP

768:JiNgcMWR3sI2PDDnd0g6T3wP/SoTye1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVGN:JlqA/bTvNen0tbrga90hcJNnspv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30819dde6f2bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000001b77774700c4d03136eda5178003928dcbd1316004a4f9ed1e90cb0102d93108000000000e8000000002000020000000a5a98a91e54efdedbf563c810315a9cc6c325cf284ab194172c07c5dfc5e461220000000871723c911d27545b02932fffbeda67063dd4ab59f1fccc424bc51384e9ce75540000000c82fa85e1e160d0f34a04df3da3b298369992dd011544899f54b526e4e0ee93c4a2cfe2562b041d119ee28ed8498212480ca7e52991688ba3213c7d6dcc73289	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000c6a839b52ad53f048d71173592cb4adf48f1d6730c69930cdb1dabbf930360d8000000000e800000000200002000000000b2b4c8d0a84b9167b9dbba3183621493970224ead1d527a77ac4f1be21cad890000000cc0fb6d410fe7c6a5da3c718fb405a555b121d64e95940644d8b0fa0b1cd3723b66dedd1ed76a7adac3795b8208845b2e2c464d244c7acefc05ce45d0b1e32fe409fbdef782d641e0aa9669ab94661254b2d14c544f4060a72c7d4151c91e968cc3b70af4f9a179ea677577ce419dcc935691823b5db44e288e5cb1016de5119b1057d7935b1e4423a375d19834a03c4400000005c61b550e013596bc30134026838eafb2398023b5f7e80fe27cc582178b23d2d380f055f132d7190a9478420e60b61950fcd69d195b02823de62436dad3db548	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436525575"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0895E361-9763-11EF-BDF2-7E918DD97D05} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1128	iexplore.exe
1128	iexplore.exe
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE
1532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1532	1128	iexplore.exe	31
PID 1128 wrote to memory of 1532	1128	iexplore.exe	31
PID 1128 wrote to memory of 1532	1128	iexplore.exe	31
PID 1128 wrote to memory of 1532	1128	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\827144bd7b5f08be43bfbdde3f7d4146_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1128 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6487e7b9fc7e76dc278c0fd64b92dcf2

SHA1
30bf093c1440c4713246d7f24d2fea66fd534be3

SHA256
3b6e6e5228c22295d3111cc886f3a834fde21c9e33d84ac6f4aec91ab1105893

SHA512
f44ef66fd40b6cc8c095031c8b346b601b287d4bf6c100c91d8644a00eb6ac00824339027bf038669014c18802850cd4f6dda391829dc714d6478ffc2ee1ebc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8686ca166355e19d6c7ae2f798d384f8

SHA1
24052c65e70bf763e28c17b9a9238c6e08e364a0

SHA256
39de341004dc3faf608e8e6f4a6aba0e7cc07f14bc5f846dc484443a78a4447c

SHA512
bf8a9d1b2b63a4d88d5384d70428ba6d479171385de7fb3de3f144efa5696c1f77fa3197a5a381745ebedfabe2f3c4619ae2d71f532e576b8b2821c0d4fcf16d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adb9eb6690c9aca21225d0145a3ce108

SHA1
edb154ead94895db567f24461a92ab347b809d6d

SHA256
77d32a9acb02ebdf560066e2562f9376a7079173f2de1733cdac1a045ff0e745

SHA512
b81979e70d94576ba54f73271ef89f927f0091566afb9d5e646090c4082f7460a740d6e83b8cc140e1828764d3b3568f97099d744edcc7b139f504b93536412e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ad4a46a44d7e3928603ddd9c75c7f50

SHA1
806d7a0d980bdaadc89ff05e0009383c839978e2

SHA256
ec59a2321d11cfac41ab6950a68709ae6cfa7bb78702a63f4fe6cda010d9e9f3

SHA512
a3119ef9c73da7807df5a919695c9a0687aa4acc4039713f6b081928c232e82966f5313161400daa84b1e488bab8c0a6262bd08b07d7fd11c3e22002e4ce0c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a00a44daeb8a7a840cb1eb7372224b06

SHA1
267878d109091f431793d8322a83e4b680b36e6d

SHA256
49ac6c6dc3506fe4bfc4ba1d9d3d68e911032a9f2ca320b649498e8e4b79968c

SHA512
6ae79ea1fd83e9e0bc9cec716c915191cc5a60959833df0a1755ee421e87fd527034ec4574d0fc1dee9b0dae25c10e56284bfc21997c127a085c5ea2bb8bca02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04698f17c0c8cbcee09b9569d0e57907

SHA1
648b32118a3ed80791b66a53e16a4ae65cfced94

SHA256
72c322290bbca7843304f591aa8b1aa0e9e4e44b675a4922a901ae15e45942bc

SHA512
1f642843fd8d6b564b5d9fbf5a85827db7225309417096b2ae21f7554b0efa8a460b88a0cfce13c94a525174156e34ab1ca3281a6e8d25b3b52115ace83602aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8668c2060df81574ba6a83e745116dd8

SHA1
b6b259f437b47b9ee5bcaa40810022fb63ec1b9f

SHA256
c5dc2c4e3f4e2df5330b87b0fd2875d7d71a272c8e055c3201757ece08a17ab9

SHA512
eabe367fdc39e181165243df7ce82734b77424b4b517c3e9f2ca636cc864b26bc4a78695555be4e520f9126e794ee861ca8bfc722863878ec20e666501491260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4d828c9a624c84eaead905d1c3488a5

SHA1
02d5508062ded1ba3327330ead798da7a7e95452

SHA256
8cd24e128c93ac0cd4d24e8faf95d000729c28b2e169fa1099f353e76b898805

SHA512
e1a529cca0c61074eb2523a7889608385010025a3760d8ee485ee8d43f07480b6642daaf91840898d7f06390dade298b548ccdc30f0ba832f1cdc53446915db0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6d9adadcfc08cd1c435119d7757539a

SHA1
e1174f39c48449d9e7e58b8d866457b325ee7b99

SHA256
4f18916c1f0a4a78426c87a7b7beabd8e86023ad6ac564914d35dc3e0ea9f773

SHA512
a5ade3f326a71d1e484a20d548979527e2193717b6b523bfe1ce8d30a52b234a1c044ba7a7e3ab4b5785e7c6f40eed63523d75f99ec9cdf019431408d459fa70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4713930dd545d7ee9f60f059840cd08a

SHA1
3aa03fec06bbff7cbf3f98d45ec58e41c9e69208

SHA256
ab40ef5e88b30db0f8469d5f90092c9e7582e1ade2419cc3ff272bcac96a12b3

SHA512
593fa0c8260751f04969a891982486e667ca4e5f47e4183bf84241c7020a453c8aeaceb4794ce605de5eac6b079fb8ad10c739fa124647343e9d4af01e53b441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2418c23c6d078f7458c6785688b976aa

SHA1
4a5bf2bdd6b8287ff80cc115714f5c41a3c9ec3d

SHA256
1b92ece77b3429b5bfa2aaeae870a58be1cd2a2e55b90f44dc573424a421e9be

SHA512
433b9cee5d58e8a37719ce05ff0ed564882af6b393fb209d8cf8e53bc95a55506cbcb3c50fc423eb7acd1dec43f7ba817389f883d37cab998181f4f3f1044a8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c28b018e2e898803544552153af2ea07

SHA1
8eb4eae505c7f49423dd6b41321a3c6c3c1ced74

SHA256
228809962c092c77611391728c7883f03f3763f0111125c6c650424ea9297adf

SHA512
d97450e1800d848a2ae3fab6533b7b4d6f42bf8c9c82481eeead44b5c224d998ab6a94ef8cbd40e4655f16665e26097340a6c7df80cfb236bb8c2f576b961e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f300cab3eba330dbce81f197f6d6a16

SHA1
d37ac6f3d0da547491270bbdbf8976233c6c5922

SHA256
4f874e248df7aa8d16f25812095e86d46e19cd6630bb79850d764dcd422943fb

SHA512
525879bfde92b51d267aa372996e486d463aa2a68e2562e4f7015c00a5b6d98db265b701feaec83cbc6cb90061857c4cfc98d386206cbb3eb6e75a1e46eaed9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eed5b81409056815fe475148006ac6c

SHA1
e8801252a436d35fd908485fc0b3f257e542ff76

SHA256
5e82caf796ae30f56c437503d07593c79a7e1906d7b727f7f3cb36181998a948

SHA512
25ba66fc450762d04a601ec29830eba63c41cb272b4ca3623e8948e6aa319df7eff52e7c2c1d78fcc010bbebdce4bbafd73b7150eda32bb7c15cb666f5e8191a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC1C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFC7E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit