1e0dfdb4367b60a420da1e17a8f175a121f47a14e32584abe11f80c672032c21

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6fde7d7cde0308323f3bd51024808aad_JaffaCakes118.html
Size

6KB
MD5

6fde7d7cde0308323f3bd51024808aad
SHA1

bc75603d6b0b26e010a0609cd51b601d92586893
SHA256

1e0dfdb4367b60a420da1e17a8f175a121f47a14e32584abe11f80c672032c21
SHA512

a88ef2143c83f3de415672acc5ce24246ced31f5364478bd59337e09ef0ce9f6c71d0e548247e2d2f51d07cfe251a2c44f236a558ea534754bb7a392727f8705
SSDEEP

96:uzVs+ux77OLLY1k9o84d12ef7CSTUSV/6/NcEZ7ru7f:csz77OAYS/Z4Nb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fa720c9bdeda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000cdc0448b1515b6b52555b4b5a9f9f35a70e04b20d56aa4be64ae8e56c1e39a3d000000000e8000000002000020000000fa5df9eb3e7cef51322a9e300f9b6b3cc94d548ca36ad18c38a66afdabde0d7a90000000c3dac809bc131a90789b08570b05ab64e5cebb4e5941f1dde336420116a94a730fa8ca13846177ff913f5c65702726cb1c8b07bb8ceac50f38ad5b7b4de236ec28e242a170df9540705259b5cadcf3af57f81f6627f546015d26ce9f5fbfe4e45c55cfc961cbd4dab98aac777ec13894c4b7035c034c4fe6af44556c9a5d03db0eeeb3516a4004528f2579829a5d84af400000008e85456a8bea8373525774fcd0298954ec66c3fb902d0bbf2f39e185990083456cc6b3c7f6cd57f941fa14113b18f28e4343553fe8ef130942183660cec84885	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428077843"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000e141fdc6c2269041190f96ac074fd7c5947664878da1fb7556eadd27c26fe6b5000000000e8000000002000020000000f053c7519ba625b7b72023a15cc8062715e5a2e67261d043b7a64176f8a9f342200000007a95e9db2996ae4652b15922ac7da81c11925e6d3d66e33b316b24971440fc1a40000000e352ca871e89df566f7fbdfa088881ab75110b69e64d61675153f9131be657799acd5f1fe7534eb70adccff61ca86d549dede8dd5c11eac63329c382f6daf179	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EBF4E01-4A8E-11EF-838F-D692ACB8436A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2736	iexplore.exe
2736	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2720	2736	iexplore.exe	30
PID 2736 wrote to memory of 2720	2736	iexplore.exe	30
PID 2736 wrote to memory of 2720	2736	iexplore.exe	30
PID 2736 wrote to memory of 2720	2736	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6fde7d7cde0308323f3bd51024808aad_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c92333f43346637d9edceedf37fe72a

SHA1
039896ffd63b14991836856c472259ace82a527f

SHA256
684f162fbe517479e1f73cde9890212292ebad72392e113a0874890d075079e3

SHA512
24c9a1680a815c4a079b49b1d724648eac8837f069ec14085dbb626c1e3de50ff0f466688bfbe73cea3a7e0b98ac2be26cfd1703db061ce0ff05b5d9a6663d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f87dbe5b82a359e9dc1ecdb894d8c4e1

SHA1
63e46df721425973a891f40ace1ea7721579c9bc

SHA256
082a854d0525cecf69ed5440cb926211b1df192e9a415d552031aed6eb732339

SHA512
1ab13775cc87fbbca720ff7e22df5fa87862b84c5a3c382ac4079fb16e13aacbfe590595ff1b99746816d9c02c3c8d0068ebf7e61ea149384636afa0ebc9a725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87665e6a77535d37f4dbb36e92c32d0b

SHA1
91efc5ae13c29ceed6f2a46facb12ff0eeeb5abb

SHA256
445525548f6a8c3ad3d689218994f8e9055a055fdc57394a7b21c72b38f5c97c

SHA512
859e12e4aaef3987224ff0df76838dd31a29f96854f5df40cd9e4d0029fd3de02181c1b0d4d983a8344eb0adea99d66a819b6cc31146db88c1f1dfbedc0c5095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
751e9f3355f5e9e6f287625e4190105f

SHA1
b0e9733274206463673ce71c8e718e544f3d9213

SHA256
2fb7cd4988649404079bb8a8e141e4060aa2e3221a388253fa9fbc4f75d1993e

SHA512
cb7f0eb8909ed26ab76c9307de01428251539d569d2f1ad5cb2582a7b5297ee7a6b9db5a41880513b39dcc3efea56ed71c53446dd520ca0a774ab0c6f0f1baa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
867c839486e71b5d94cd85723ac904b7

SHA1
1be8370450d04f2f3bcb882ae0428f9d0c7f671e

SHA256
ddbb9e55163b1f2edda1812c0b22eb115ede343cfaf358b2bb33260617e94a85

SHA512
88f67b86720a15c1169547c52d558466ab5cd6625433f69f56b482e46bca3982be0dd78f88fd3b549608c70a3000db3fdc41f32e58c6c90df0ec998c1b5b811c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f1f7b11e94ac79aaeaa008d59b32288

SHA1
25edfc91542a75968a854a84575ca9882e3db344

SHA256
3884853c41e8cbe782206fbc77fca82112a9263d4396a731a3be246a3af9b81c

SHA512
d8deb51a32fd4227da5f3121077d688006e711c6477f0cb0e8613dfd9ab8f49dd3a62a138de6fd95ef19c38f275ee1a919a91ed0954940dd0f5a0225fb080696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa1c67349ad79fb13793ae426bdefe7f

SHA1
b82f49adc3ad4ba6817b5862ec6cb122163fdeec

SHA256
496d589005a4000d7c8ead7d19270dbf2ec4f10e25c64afbd56f321c46956f41

SHA512
aac49222a27ae8823f0d879628b6baa2e543f31cce39e6ac7af0460d2ede9d70cdfbe4caebfabece6c08a0bb01e80f7c7d2c16e7f5ecb178345463982a457844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e08ce1dd7c2624ba7dfdbf05c8d294e

SHA1
c01fedc6fede54f0abc148a5fea7be9358447015

SHA256
54368c2bf8388478cde759456e0f238e1671d1ee3691da1d243a1acd1acf61e5

SHA512
f49ad8108a09d011440d0f61b40bc2eea212faea2be1fc571231aa648d217e83cee5ae6600ccb6043cbb1ffbd1d4b19a42f2b73f97cd1399c4ed19a901b8d784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b09849ebc555741a7fcead4b37ec282b

SHA1
89ea9f961c3f169ba3aaddb7dc8511e5b8836442

SHA256
9b8662a3f1f34506f2bb280d95f149f10fd826d17671b2a74d2238a7ccf92376

SHA512
4ab3dbf8afd317880603c4d151565a98114e4ffbec4729d503991770acf4ecd42f8ba7010408032748bad758146c257c00577ce4a0ec634bac7b12fecca1af6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a738877e439f797f22823d8ef8d21c2

SHA1
475e39b4e8763182cf310ee88360add6214a125d

SHA256
77364549b4708cc76ab15ddbfe888343a6746c815b1f80d31e31f31b3c634a70

SHA512
79dc7ace5a73279fe08d8b9330efb690a2492dd635aab6f595bd892afffcc699beb924db9d6de0ec15f3696fccd6d1bd0c0f850a50e08579a449b9630edf08de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aac0352c20cbabb2a8460d7179c45f71

SHA1
4c53463a1abfcfd7bf0dbe3899ca5ac611420c1d

SHA256
a2df1fcfa753e77611a1a59102d4a90f455565c7c396e6995f58912a18c47940

SHA512
14f243929c02de8e00106eaed0c2290373b93fbdcacd073201a0643aa65fcf0dec059de08c625c583b1cdb79975db33c95c503f8054f9b94a052bddbdde3c986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b71480dde6b5e7cd1797716c8c9a2c7

SHA1
a1a14bf1698c49c4d7f942154505136435c9be71

SHA256
ab0cfec49a50aa001ab21c2d61a172cd4be43121ba4123d8eeb33d8f4eea1d46

SHA512
6f93d4840f472859196217382759fd3b313c7f41b7428db3fbb5a5e6ae546bd19bc41a052f829f5e5d58479f1c4e04b0c30880cfced74d59703e6a4cb0e758da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
429b827d8519d294cde35b5ac1bad023

SHA1
2343351d1c29ed22bd999c407e443a6b456c8213

SHA256
de6cd308955abaed2ec91af1e8ef4bd504f81b5e038b22cfbc7ec85ceff69d60

SHA512
1f3a1d9d2a216fbdd1c851d600b3978ae68c927a818b9f98e555ea8ce17ba0ef3f4ffeaaee97c13714560e0f23352fde57d4a62acbd6b002574cd066723f78d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3150.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar323D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit