ab09d6bf004463e67e81325f13eb3d34a8990a9b2b95bb7c3936b4f3bd066279

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f166ffc47eadec8e89092be4bc9a8b_JaffaCakes118.html
Size

32KB
MD5

b4f166ffc47eadec8e89092be4bc9a8b
SHA1

9b89cc7c7f78e3179053e86d88daeb78f4995d5a
SHA256

ab09d6bf004463e67e81325f13eb3d34a8990a9b2b95bb7c3936b4f3bd066279
SHA512

3b7523070fd8f8fd5b39b544f5c0b785fecc9bfa58dce6bc7bb3cfa845424462a3cd57104641204c6e80292930156c2fc5d72a2112283b79011fe7284ffdb988
SSDEEP

768:g7/rt02xYDcoe6pcxH53h69HOcgsJTL5J8:gTrt074thwOcgsJTLn8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439105633"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3306D4E1-AEDA-11EF-A567-DA9ECB958399} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2760	2428	iexplore.exe	30
PID 2428 wrote to memory of 2760	2428	iexplore.exe	30
PID 2428 wrote to memory of 2760	2428	iexplore.exe	30
PID 2428 wrote to memory of 2760	2428	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4f166ffc47eadec8e89092be4bc9a8b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f000fa48f6f67d4868bf20ab2514dd03

SHA1
9dcae07e5b3e8f2f97d581a378d706eae29a7268

SHA256
2a242f977480ec830b3d220dbcc41de9cb2fc5888c731fcd024a0ee0e42b8756

SHA512
ed3c1df4cf6d5034e508bd3fcc0412d2b2eafcc7de2daa5ae454ac31f07fb0e09a45a24606a2f2203f766725f4b0323c8161c92d51a7f2edf60a842370332d1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cedac319cca8ebf5fa65a42adee2f253

SHA1
ffda16db1eb52667403691330822b125637eadf5

SHA256
1ceedbb15cdda8ba4eb8eae6e736d1cc1341d168bb35a28836bb5e322984aa70

SHA512
d377871df085a7c14a51fdb9bd056e2c4df3aeb156998e763a9be7df94bc38180842274ff87153f2f2fe3d0ed17683689592a164eaafe5cb7123ee01d4061d1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22a2cf13d7ce464ac36ee47e7d1b13c6

SHA1
e8b221f76a1fc1a93acae1dfad9c80a896729b0f

SHA256
77dccb7eac733408e6349ab362deb2e4ee05895efc5f318c9071d28b793865da

SHA512
71063a0584f2392ab1eaf53c1612206fba4c6e1f97a70bd0d73e6842c10c3afd8b5bf1c2a27ac6a0a82667b581641ff6c5d27346db284d775b13bfd9c7025708

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0c32946b631c26d89fa621300557c0b

SHA1
47a99fb1bacf33b8a094a0a7d16873657547efbe

SHA256
ff36a32f56c007b61c69c1b9e96e25b68714b3316ffce10c6440a0af6c9474a2

SHA512
08241696cb45c1a1ce9da2a9b995d0307fb834eca5ddafb5184e5bbd50ab7ef6cc46e5b245b19fb6d3993e2dc2f9fd6b005eef60d52eeff98eac193087a829f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29fe27f06012b85efed81a4803f88162

SHA1
f15ea507b2c74a688dc3c7cebeb1e544a1794171

SHA256
1ab53dab4eaf5578b47d0e3eb2c09a89b4e975e7c95c47b4d1a74099452cd3a5

SHA512
8002a1b734d50706ad570142adf958745c289ae18e7c318b7d5fb3f525f732983707257e2f7162ab146a3b822e276808493aa66d0b930711eba673e2c2b19d93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1671bf325c7f32e73dd9d0c4afc64400

SHA1
64874922ca5680877ffa629dd2e82019f0f93ab9

SHA256
79501f5ffe9a9b8d3579b01f899f183e3f1d247f06cfe2f6b9acf13b2a1d1347

SHA512
d1ccda88a80ff28b38dc67e913a78546e2d1d71bda7a2e077393a4c09a50f91c9e394db8457bfeae72a3463db3429fa6d3160c5004631ce2d2ea47499147155f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9abbb3b201d5eb42543c8c03da766112

SHA1
2c8759979c1e7212614a2f7b6d692a1311666707

SHA256
e0bf0328f5b1892b49fc999abab7ff3c7e809b7016e8f7414ac11347900c4849

SHA512
78b82556ed72fb0cdd3fc6682a73b0e82e219ddad9f2cec1356049d3ff04df002d0eb85d0890162f3ff006138df207868c8e6d2fee1b66ab2ad4aa7f445896f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a89e7a470db90b4e98d144eba3f665b

SHA1
186399ea477316c2a90e7aeeccbcfc28a181e60a

SHA256
cfb80ff74b8d08b57c25f85dadc4f64ce6e6495a9a7a55e46860d9926a07fa54

SHA512
5073ef7d19bd30adee6b702c69df79c78f2b4a6cac908bd3e987b4cfe124e9e4e9d3d5d89a8a281ca0a543b457f83dd05366fa2bcfef75eba6a79be63571d532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23029a00efd747a1df7815d2b28c15c0

SHA1
e903698d41794583fb0d52a7571bcbeb64092a8d

SHA256
0290f32084b354a21f8fd5162650473627dbf54c9acf5e1a8c4006d64684036b

SHA512
523dfcb66b553114885a08643220bba15318065b59bece70041f665ac30c137564d4eee976669951fb2518a95e362715b1de011740a34fa4a2d18b4c16fa1c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98c65e5736b167a5eac1018e46fdb4d2

SHA1
c14e4ad19332683573ce43397f212e5f90a74039

SHA256
edf349c97df9746f26bc05c5e7923f0baf8bdc8fea0f71cb32402fcc887584bd

SHA512
24933371222abed55ea5f50902e68581e845575d1f611ae3fb26f2e3118522d323e74f6c812b46dbfae3fd1fd7cdc2504cce057e45716a8b0a53bdc2d8bebeff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae82a5f02a47b175c6598391b49526a7

SHA1
72acbcf77cf6a1659db9975ba665c64d4ed47ba6

SHA256
0c4b89802f3543a3617e52ad6bc2069981bf9e8403eb3b6024cf869d385e5f7b

SHA512
0f4d67d8a7b1dc3ec83950d8280399f35fa9d17c01c0dc46d36ca2ad8be973148ca24b1c88a9ced827a83624a6973f0c139e325249d9aad7f7aa6a8e157dd3be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0a792d881444897485e717179dc954ea

SHA1
7709b59bdfef7265de02d02d60b610af2c18e1fb

SHA256
461d1b51619944fed442bc97c346b08584b4167c70edc8eab3fbc32c2d40f43e

SHA512
119e2da0bac1a61389e28cef5d2f057111ee81c35f3b8abbb8b258c68fd7707090bb77298953f3987adebe4a99de0037171c2584f30c161d8a1a9741de847290

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87A9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar87CB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit