fd1da1ed05a31c91f36805dff481006c41f5578b3bd56baf3a42a8d80929d16c

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a41738ca5ae6083507bb0a0c6b39507_JaffaCakes118.html
Size

5KB
MD5

6a41738ca5ae6083507bb0a0c6b39507
SHA1

7dc35403532119fbba7b558df167be77ca9c09f0
SHA256

fd1da1ed05a31c91f36805dff481006c41f5578b3bd56baf3a42a8d80929d16c
SHA512

2236916380356795df87a0f1245ef51cf5676ae5b38987ba2118b7f17135285f45f5b85dbaa6714d1ccdfe20addb1bfe063e7b75735ac8dd9e7d0d69eca02175
SSDEEP

96:1IPyCQ6oISUKzvehCZGaXbrI/zvXdS+ioAaKLah3xVFBcD:1Ie6XS47aXb4zGa1q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000a6b044901adcc4d91db69c0b8a813e5b23801386e8c5492edaec9901f7f78d46000000000e8000000002000020000000a5a9c7ae5681da33054fe5b723293166b709c85c6af684f32387b4f56d01e61b900000007964b5cde502be0ba95f76493035a13ce4389667b26f7e0522e5b0986d7cebab3c433e1aea4455faef76b3ac42d1107f18118e004552cdc088bb8186278cc8304d561bf6983c154c1d0b7eedae1f36f6dafc98b50fe46b99d1afeb1f6769657132eaf8994347ea03ee7dada8f49c8e3e74d5c1770cdfe81871e7b49580dc0456ea3fe547b9ccac863df48e65dd2e04e4400000003953b604bbe3d900f99b231cbc627c0dca527157efea9fb1f98c3a51152abd2520ace3b17aaa990aaf2e0140334e688c1b7a3a255cbd5e4cb1f0594a22b490a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000008ea2ae676a8c073e50933f45f23427dbc95d4fc567bc1c72af080cf6dcfd5f02000000000e8000000002000020000000da0089ae660e0daa96ca6de68697ada29265a2cd7731e491cdbc6f6db8e696c52000000058cc790b18d57fde46b8598d24c90f7a13144b66aaf52760d685a2b54c4b3ae840000000867fb565d572b1b7db0610851adb2fc6922e8cb3965fced167fd2994b9c8543a34e1350ceef9ab97bc8e181593b81fcedbcf5330cb96af6f3f22ccee55b9b3ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22F5BF91-4976-11EF-90D6-5AE8573B0ABD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427957589"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40380bf982ddda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2292	2352	iexplore.exe	31
PID 2352 wrote to memory of 2292	2352	iexplore.exe	31
PID 2352 wrote to memory of 2292	2352	iexplore.exe	31
PID 2352 wrote to memory of 2292	2352	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a41738ca5ae6083507bb0a0c6b39507_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9f504eb74ca097fea80fe8b5a0974cca

SHA1
98f6d6f82b03f1c03cf46138c171618e1637fc8f

SHA256
f433c4394a8b0f37ae1d9a9d87c00c8140699d96c64afe8fdcea48f05b324460

SHA512
611c457138be60101a8528b7b708c3596ae8ea885d6d7a89efaaa906093c3dca2a442a7bf287570964a0e596e1086eae4bd289797d5941b0d7cb615ad8722635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0bd589b5cfbdee1387d1a8cf61fe81bb

SHA1
12bb819e163ea73de1004d55699edd36d2b668fa

SHA256
3130c1cb345104770bdc7e7c5726611f9cd3b31406f0cc4282f7f69231c7a5a3

SHA512
54a48f2e08a56600845c96883293dce9aba3c2ea72b5c8d6b563e580dc7a42f4d850db79e0ec03da889db1b139385713b39467b43d579cb9fc2579fe3876e11e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
227a58bc6574666173b4b3174c449420

SHA1
25e03e535c4bd6fc3cdf4f5998b3d173cc0a4692

SHA256
c0f47eeeff6e94ede626d5943ad5316dd01790bd709a4be14f4219d5375c38a7

SHA512
ba8ba109fb25d8f50cf1b15aecc41f3c463978c55957abf9ef6957432070e6ddf5575acc348d57253b549c742d58624db9e648fe3bbf9fd0b68cf865faf42af2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
500d220ce1a8f1a4833230f75fc81565

SHA1
4e58c187d124d2bc814cec11084ebc5d395712a5

SHA256
e8e5ca1bf7ae989acb54310175444c6e19d1c1c223a5a1c8fc03ef93d07c4368

SHA512
44a097dbc532a7ba140a20d81d58275aa2dde9e776c275d8cecbeef244ab4ab174b5d914dbe8896d3f664a85cd0d6a1752d7760778777c297a2e441f378ccf27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
60529e9834d0567361893b9ec4db295f

SHA1
2b52d098df923b25bb6e2e4dd8844488de1db2d3

SHA256
68f87c297607a91225dbf6556e14e85426cab0e0757c17780d0e6003d0eee3c4

SHA512
1e24627ab614c5794235623ea4b75b503264d23a0714b24bd4c7e2e11ab6c55ed7503b29163bd1198050308d8679ae119eb762c12d2522807bbe6ccdabcb468f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
70904fce2da9a254dd1042382ed167ed

SHA1
d128f71159ba69e09171abd0f10fdc283e5105cf

SHA256
beee49b07033344d9eb7b8f532fbc636f3dac6983e1ecba306bc09b1396479e4

SHA512
d5c58b68d141e2ee4b7213c45168143ab58e7d8ce02e692a6a87c3bd904126617e1dbeb346a5458d2410a5c190f8a4c65c6b8387484de39ef4cfe3dc9aa6f081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cf48a520163d9b0c26dc9669497aad17

SHA1
7d08ba63be76312da60ab9d98a805a0fd0e262d3

SHA256
26d990551a0b4d77109bdab92f1202f0bd19f988feae1eb070858867d10b936a

SHA512
d7e558b5f4b848b7721dd24a5d4b961ada00fefdbc85fc733b701d8c9ef6912660a2a6ec8691dfd45c6763ea39579affbec828ec69bb65b2404641f5d1ddf359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
68d288ee812e7d020733519f120aea30

SHA1
533315190ed81f0b385145288e32eb00b2bf33a5

SHA256
d2aff1f88b8db5b28f273d515b214cdcf951229940601b60d087714cfda7777a

SHA512
5d5cdcf61957d03f20afbbdc5d9f1fdece27864c30b1f43df0437189ee81d2509423e173147f912c1aa924d82ccb5d42e8e30a1895c3fc46100880ff9c2e4a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
111f24af054a97b037e10e71bd965e3f

SHA1
af2513cd2e19d516d9cb2503c896a28c77ce14c4

SHA256
29d2ae923b38c9472a6a601adf18b0de52acddf280c71d415e996a0b955da6fe

SHA512
42dddfbb2843201df8f22427e6f141f418563f6e91f2b40fb93d201ca3689d7a536867a2bee3f82385efd8f21933d6d04f8269fca01fe7938f78dcedea41e3ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f2501d7eeeae145d5de4d4f00cb98a4a

SHA1
990a89e1d7626543aa456868b26dc59068cc0aa2

SHA256
a8b6a0d68041bee3ccd0e3fdf83bd7b29ce53f34be9fedd0c1a987c09dbde731

SHA512
3849953c98db94a478a247f1ebfd00adc3817858591fbf71f7ebd2256f6c031e0f1127fa0e272a1a328b8ada843b0cda9c14b2955f37164b346987ff6ecf1f0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
030af3b7d365abd98fedc79798007762

SHA1
b5c4c013e62a8adc30c709fe35e48a5a62021339

SHA256
ed7cf0e3dc73501647ab67850a242e616d3a5645c792405806734c7fff717dc8

SHA512
c5a99a5d9433756e1cc0ab35b68ae2d62cfcc4909fa2a5981144ed2c3ca4303e9680586ec8dfe458fb8118b4291958c0b7e6f2d2be4d0725bafe523b4b4555e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fe359d7fb5aaabd44459c424bb455d83

SHA1
5ecf2666cf30bca678e6fe72b60de49f99ea1c2a

SHA256
d6e7391352600fa0aea47c6e8b7e1d7de3f3de67c1147e2ac5847f740e23a948

SHA512
20e850985245c0cc26a40886e6b49f6df582558bcef94befbed3929d5b84157d57a8116e3d7b3a36cba40ec48e08897cbc8fb9270f610a352dd98fd257858617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3330222f62a4e23066e6de97755dacb7

SHA1
074f119979f2c5063e54c492a298f619b54b8670

SHA256
b7ee2e55051d63d7a268dc49eb14e2f2379c1e65504beaf786a7f3f8bf981b09

SHA512
82b5d4bf422e768b860db47da26b8ba7d103d637a388653c1c3e4faa755caf22bd310cd694d0edec43d35f9943db29c692965d76efca9c00e4377e2c68dcff3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
73d3854e54aab12747be31ebe2ab62b6

SHA1
d5f1b96c2af753d4425e2e11257886898fc944ce

SHA256
7ad548adc7108a98be2feea2a4699027c640e5ad3394c950572adeecaf802c08

SHA512
29097603d73f7280d3f708f157e6fbad61d355330ad55a54e20402a43272707b73dd0f6a24c7e6e96e7e862451077ff52814b256d6278f4ac1521e6ff0962753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
38eb9eae35a1b791c165aa161611e567

SHA1
c814426d1b4fef6d6d828fd71d04a676a65853bc

SHA256
6abcecb6a62a326b660df4c8aacc87dd1edaacf1ad0ffc20ee8aaa27e3996e19

SHA512
d4b10e79360896f03ff2701b55e9e0e9ac7b5c2eecdadc16d758922f6183c2057e0b1353765b77369cec9608f18a2404d90c3b07026f413bc96e29ef6cb89ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEBA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF6B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit