8286ab5ee357a48ce1dccc3ed8e6cc66dc8277b75c89090353937ecac9f9d2e4

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f0b8b63c71cc7d9dda82fe66280b3a9_JaffaCakes118.html
Size

40KB
MD5

9f0b8b63c71cc7d9dda82fe66280b3a9
SHA1

49b8e4a1266aecddc7f67cf1febc93fb0abe20ea
SHA256

8286ab5ee357a48ce1dccc3ed8e6cc66dc8277b75c89090353937ecac9f9d2e4
SHA512

11b848d75d359b58e98153042e2572135bfc762819ed87788719b169d5c1c9c866107b7d1ce4745eee34f1df730e5d7dfd37ece7a28db53c6729b7695c7291db
SSDEEP

768:db2dwfjErAG7YPKNn681ZktlAa4AF7UuiFH6on46H5UkB0vNmB6/2FW:N2dwLErAG7EwGxFJfNmB6/2FW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A70E1711-AB95-11EF-926E-C6DA928D33CD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b6a37ba23fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000004e90a93c9f84707c927521ca9d7b49d8dec4554fef0a8d3a38a382cc8fcdf317000000000e8000000002000020000000e28b957526ed4a2e4a4339e62a986f607a5fc9bd0600d9c692d0fe57df93031e900000004d443897813adfd61cb2884a5591e163c69720e5df84006e969e1274bca0b0ef07faa398c3c026e4031d0df696a0c9d7d48c12e1fa14aceb6f6df576b1d844aa79568d3869612cbdae13bb2cfc189f3107da611b199225872c13d3eb02db7850968fdf0fbcad1577183e878027e8df80198b734836ddf552d2c57613174554246c1d21ac8a05a82f78c9f8499209d6e4400000000016c31cac4a18783c99458f9c5f560ec5631c4f93e169b63ab859203d43dbbb7e0fd76d4d77aa8da0a79cb963c8ad5ec2571e2aa6014c8165075569209b89b6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000714e88d358ddfe6873d22aa10fc611d526af8f36279ee94297f9f7562936de95000000000e80000000020000200000007048bf07b4f0602958cce826b1870693d74c3848839e41d4df346a19aa60791f2000000076227cd845b2598ebfa750693736f91784850e97ac9763dde8f2527baecbce8140000000884507321cf9a9c8c4c1f157acb37043ab7ca11ce6240684cea53104588c7af136de26553c041bd3313b4a660188c5596bfb0ab24bc4473f2363aada9b221229	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438746339"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3028 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3028 iexplore.exe
3028 iexplore.exe
1192 IEXPLORE.EXE
1192 IEXPLORE.EXE
1192 IEXPLORE.EXE
1192 IEXPLORE.EXE

pid	process
3028	iexplore.exe

pid	process
3028	iexplore.exe
3028	iexplore.exe
1192	IEXPLORE.EXE
1192	IEXPLORE.EXE
1192	IEXPLORE.EXE
1192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3028 wrote to memory of 1192	3028	iexplore.exe	IEXPLORE.EXE
PID 3028 wrote to memory of 1192	3028	iexplore.exe	IEXPLORE.EXE
PID 3028 wrote to memory of 1192	3028	iexplore.exe	IEXPLORE.EXE
PID 3028 wrote to memory of 1192	3028	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9f0b8b63c71cc7d9dda82fe66280b3a9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32febd2218183ec6d3a0434662bf4049

SHA1
d60f287daefdce21d6c3bce692de309e239e5ddb

SHA256
1519b6d7bffdf856a320dcc5c60988f16dc64de12b1100e45999af0dd1264fb5

SHA512
b361d259219c48158a017c1d3dac96a6edd4677e0a5df05ad7451a7edc8a843454d5a5199bfc95c5fd5fb3f9cccd0f835401ea84eaeb7bf7f2273d545f14bda3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01ec07addbb7379cc7ae6513e2ada39d

SHA1
f706aeec5f9d9b418672d22e96e36915dd91d658

SHA256
7cce409961563fc584c7583a49294292b0bab45cac400489a34e647329df4623

SHA512
23e3f4c832f714077034bd96375fdca709156563feaf3c6fbcf21d7f0e9e8a53d81f418ef9f9b45194df8be0b5899749d330fad8338f451903f37063d89dae87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
372e1b5ec606716dcc798be613d97bf2

SHA1
8e84957ccbc169eea3878c8018312fc0f1963e6c

SHA256
c59b143c0e0d5e51fd180e03e53cd8d4667c899090e7aa8f8113867a0356d309

SHA512
1b2318a485ba359826509bafd9aff4e2eedabbf6e44654d91374e0a1f7a14efc5a0e1bc6f26cf8ae9882f1a09a5f608ec4e21f89109e411e266192114076e1d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e35ae651012b32544d469fa52ab9fb8d

SHA1
361c4a4349e8e914597694fde3e0fb0851751c5c

SHA256
ca7d108d2ce76ea574924dfbbe690704df35a92ac1432b77d831948a0b53a0be

SHA512
9f3854866ea707ae4dc2331fda7f0a0ec8a27fe4a0c68cace86128fe035f04ebea6e16af427f0ce00add16a7145f396314160ff7ab56e5ca0094364db2187454

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eb1dce1290a88a159f4ee708a11084a

SHA1
0704e630476dbde9bc012f16533606724b8873bc

SHA256
3d11aa594f90f92e9bc3aeee5a6cc9d57b752792b0172ceb123fb457528f3172

SHA512
4ffaa627c66ea3ef9c29efff3afa7b19c92be31fcf233a2884e50395736792fc233278e54f97cd7f7ca3930278e6838cc0ff1f0b401e54bc0f41243ab5fad6fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b03993431e8fa6a6432e07b05ca71992

SHA1
bbddef48c79ce000565ef77e97aea9b89d2be3dd

SHA256
d86b10c55a6de6dca4974f0150177659ebbb55ac1ce602bd81a1da5306c62845

SHA512
8e68176fee9d6fa0779828a799362ff006e32c7c30e9285b29b9f6ab2746304893ba5293d3765cc29f31db8df79cb3bd0c9727fda456b9c0c967f70ef79eb837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac7dabeb22c84427e46db46993cd7b5a

SHA1
efdf784471a2002cb97af41a44f4ded8f50f3e71

SHA256
311374a2faa604c2098c1014cb59c027b18da997737f017cc9e7cb8e125a2826

SHA512
87a8a700ebb8dfd5d6a92c48599683d1bef2cbb86a4c1b2b3a4ebef2c94bb346bfa13461a355bf46afe9fab4bcc80708032d0c4fd8e09a25f1b5051eb61bb075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35a20856b4ca9e8eeef9c537bfbe518f

SHA1
f156547237a0dd391aec15e559b049fe8032bfd1

SHA256
d49612895fe09632c48b4888f9659894f2eb14b811abc0364a3cb237daad5b2d

SHA512
5010ac8de47f565b9ef41ca424e285cc87da89439b90ac35b27c05a89346add2f343eda1a4ed91bf3c96f9bcf6961a493925eca3b07fd243c33cdd5c43b40131

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc5c0d4efe901c3e13f6aa3dcb2fb4ac

SHA1
2f8f39f2c01a1cc4ae05351208ae8a3629613048

SHA256
eac5169b59bc1e7c0a7f57e9a27ae961391f9c2a380a041e144b95e0d7ffbde1

SHA512
da4bdcd07ebd1ee339ffa04806a3f87601c37d885616f7a0e57a2b077ec4418e359a8859e2adfd964763b85db3a52a9f2fcc5aa1e64bffd4bdbd6c741f6d197b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6b615fb9c5f71f1d952faefb519465d

SHA1
361f309561f0998a93c8cc2f49ca2bada738c70d

SHA256
59eec57358d7f553484ab56091d0887ff18234aa4eeb8b4366ce1e59dce9253f

SHA512
260c09a9fb17b1519ccae08923543fcae9b04be03a588f7f10e38228e1206305ffdbba8620e50c63539e40dd54dd9924f584ee99954cf31455c74dfb44c7b31a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
858f30caee380e9d2b04d33453467bff

SHA1
2985bd4eeaf379b779ad7145a50e824b9f25018f

SHA256
18a9d0539daff0cb25f0da72419e545bb9bdef066f07734c2093889a11418d17

SHA512
d44de6459b7a6a33c6b3513d24dae2891d38cafdee0d9182eeb4bbdd7fef04d1c13fe2b89b6c904d6badf9d4e117842691740af79ffaafd04c5e5a105a6f44ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95EB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar965C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit