2e80251811d068452f282e228437a13421b19e84c42912ba571848591a3d10fd

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

771c3cec8b3210ecb54425586ad90415_JaffaCakes118.html
Size

10KB
MD5

771c3cec8b3210ecb54425586ad90415
SHA1

0cb2e9377201da8e31a5a0cb120b0f318d15e1c3
SHA256

2e80251811d068452f282e228437a13421b19e84c42912ba571848591a3d10fd
SHA512

3393fb26dd5f779d3616a1031d5963d0682f8a9158971250da60d02cd112e840573377fdd12b480d0e683ed8307beee782883e07d5df7ecca178b02e1f1778d6
SSDEEP

192:aRUqMFyHPMWJWylSg9kZppfRp0BRpQMiqUz7DcyMv3TQ167pKTS/mOCPXhq+q4Jv:aD53BiqUAnv3TnpKTCmrPc0t

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000082c0371fb92e708f3545df75b21df03bc0bf18218d0c69c8b1b25f0dc7eecb7000000000e800000000200002000000023535a864871d763cfef92c88f214dd71ca1445104e125ecee2efd0aa17ecb50900000007546426b9c20dad42c7f8578a9645238a8d37459cff2fd82100fe985cc0afeaa093089929c797c336c7bb5114933ddbc1a11d23c34e5eba9d4149ec0b56906992db08bb8d44081556b0b633cead9f72b20f54ad620defc5379a15f2340a212552a44c1c4fb4a341e41b4aa4f994b6fbb5b7dbef10ed209f3a9448107919db3734a13f5723f37256107dd7e92080f99f44000000062e91e8d86f9184eb5adf27cc09149c255a1ae78b4304faeae9f8fcd94459e12d2b9a39785de84ac9ac0433704d94cb09cfcf5cfb5f0d757d01350fb48402515	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E9D1141-4E3D-11EF-88C1-C26A93CEF43F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428483075"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000068fe1bd4af0b17f14f475f7f01b6bfb6d9daa547a8d9426402bfaf7c85422024000000000e80000000020000200000006b22dd0ff86429a51fbc2d95c40bc2e3701570a7965cc3bfe6629840807ff776200000008f9dbc5c2cda930dbe55fb6abd1880006e778a01d102ffb59865b72bb461adda40000000b0cdcf0442c2c0d7f2cafbbdf5445cb7751617165713da6b31b718997782a6e1cc550ca5fc63cd5631f2a9f6d30f93f8e6effe72e39f703d0ea93e2b3dd3ab90	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0005a5744ae2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	iexplore.exe
2136	iexplore.exe
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 576	2136	iexplore.exe	30
PID 2136 wrote to memory of 576	2136	iexplore.exe	30
PID 2136 wrote to memory of 576	2136	iexplore.exe	30
PID 2136 wrote to memory of 576	2136	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\771c3cec8b3210ecb54425586ad90415_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0097588f81ca3d2bf42016050816fd79

SHA1
8293d4cf701592b844825fccff4111b5785f3dc8

SHA256
3a3c691c1bce29f2973ea5516536eb680a7e6afdfa50074ac61044a7c770b1f6

SHA512
ce4ebbbe6bf2201f45afa476d96cfebc7325e4ad32d07d6cfd11a5a96604e36f66fbdf065a3f1b928ae0c6cc636b4fd823ce687b189137078ea2ac8f7e89806e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
004160f486659c12744f17875302b975

SHA1
38fbc11adeb0249b57e0c7130d67f8ac0bcb3896

SHA256
1958c7a790610e8ce006364c80ae505cd9f88d949b76c77c14b2cb1d472754d2

SHA512
eda40ac83137f1146dd62ef18458265bcce774698b36e1e8520c8de218ee22018fa449c3f05a6d25df7f5ace7d094f00afc37ec658e35b31ae91fbdad8311309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86529af4357afb917990cf6d7cf1f1dc

SHA1
c498bae64fed8475687a133d0467d49b3f48ab97

SHA256
350d0626cfc72acb17ef8c18bb9261c97ab98b46e95477939be6f0415ab781b1

SHA512
46fe93fadea13ecc55e6e7a9fb5d0f5c019ed7fce796ac8ef1006198e6d32df38db38b6c771c65bfd7ad60b05c03c4eb6ece4b4ce89f6812ccc8f064ddb1cec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb70a9f17147b7888ba63bf3cce6637f

SHA1
68099c66ccd75f4605b18eae166d2e48f8f35ff3

SHA256
dfa7b6464df451a4bca514a65255bfd0af4add6ca0079dceb3dc5fa8cefe2f78

SHA512
7db668c8e0097bfb24c9ee26f22f1e7409f6762d83cbe1468066d4dd1115b5a198756d7d3f2a92b165ba1548002356e05af041d7dbc89e0dbe14568c3e444e6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
449108b3a198765cd4afae873a06b057

SHA1
982a05edc0a64d11726f5132bffbbff98b2e6985

SHA256
dc37181c8aac2f67f7fe1426a40748b12a0c46136b68270d84ff61b1a36a0dbe

SHA512
9bf5851c2c4b1699e366c33e0b1cf7ee517942050070601b2518ffb83ccddd316ad6710308d669ae6832798d053c5ca3d3ba0fa8e0c78b2b7552ab469296a8c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98ccfa754a3bddc70df042f36cc59b4b

SHA1
47551c8558e65972b625b7852da48c9e1b1b104a

SHA256
fe9f6bebde308bf4b6ab3c52c111a8cab389a152ef437edc9a636bc956edfeb0

SHA512
6781fb8ef71e6f3c6a6445ced95509e08e0d4bcb207a04119e9fb529cd8cea7437c3931f969a979dc6b96f7c3e3f215d1b30481690477842a38972dc8aac9859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1d867b495021d47c77cdfbb1379e527

SHA1
034e8e0d35cc428d4240de377eec831976f49fd7

SHA256
01268b76322ea4b060c351180c8bad2a543756630125bc49b783587a82497c12

SHA512
ad15bea0cf033e223ffb49bb625adb799c82208e5514cf4b7ff40fc9ae342bfe6ffd037731813f619fdd4a3bf645389037845b45ad7cd71f9db4e3169a49a27f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb5f19b8a22f325e02444c2d00b682c7

SHA1
8d204028809f826bedf98ad5ec65581f9c79cb0c

SHA256
b19f5157039256bb2c592d6489aa86d325cd5e578925283e60ea997bd4100164

SHA512
000b47b193b6730ef4bf210e9e85ff997cda56d7a861bc5397053ab89a6cfe0fe37388fe3c9d4a9ef2ec5d9cf4edb51c3052e300f4609d53075968e1c6228de5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93e4c4b02482d2717d123dfd512d9d0d

SHA1
2ac7a19ccd27905c26614311fc7ef7335c960257

SHA256
a188d84ec5f418514119612233db72d0c50ac2577e405882d1b8c7dae103a054

SHA512
9c9fc0cf077e71a8de1bd07617f967c142f5e4e0b96d3d8b5334ac8f2b99c84c397c423d1279d18e501d08cec1a43c8e66263f70928647333d7ec0e4b3ff9419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50751bd5977ad812fdde4c2740bc9a47

SHA1
c269839b05ef5fc91627620ccc90a86f965052eb

SHA256
3e21cc99231aedcfc903962cf78f0ce625440d97c9005100b48680addc39e552

SHA512
40156d0d012eec8dbb1393d5d3c4b6cfddc5a501d4adb5da9847b5696f5250fa3616e464d71c744f5e89707480864d731c817ecc1d3e62b1932bd10295107607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2f2acd998eb2772b494c379419ad7a7

SHA1
1a43867a9b8f58efc787d737cc142eb8c70e817e

SHA256
1b5d03383a0b5eb3332968e5fc2bd38900e39cb7c118e59565e9a61f95afd53f

SHA512
a8037b720a242565d855610897bbdc628f88dd920dca5f8f21a085fa7afae4607e1b5f8f630a3cb3058062de3885dceaaa5b331938ca568d0d32631e2f413848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fd4b07de5a6ab91747d94d08d464597

SHA1
e315defc0569591a20a7975d85e3d427c6c27c13

SHA256
28fdf33f8f345696ad12982b2a2bcd3a20fcb710393d5a204c5d7ef07b4c006d

SHA512
e80ab60ed353307e3a6caedc69253e1674ed3151f594ef24a2f0c071d46728f912637fd6b15472f51680f6de7f1f463ee5dcb929735f4f5bf8f3f0575336a56f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
632fd56c697d55fa95ac0f62650fd7c5

SHA1
0c927db655b7248deaa9d08d1f2c158dfa6b9298

SHA256
7556e317f612cc21974d5b31f4e59e031bddc8a79df2915fc77a153198b1f3d3

SHA512
cf4cd5716a63618409e1bdfe53fdaee357f32bc27af22688beed542848890881a2fb63f863ceb7824a9d91cb84c8ddc6bb6aeb6deabcd1e40b498ec7ea682c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46c05a8dc5ee5492b5d7e81b37c00566

SHA1
c8941db28bce231f47d899a98077843218b6f81f

SHA256
c0c1ed9aee39e0080ad15dbd5be600345943bf697f658a85b3a8317566d98ce1

SHA512
fbbeda3cc6f91a066b09eeb3ddbfba83bbae1c629d8d797a953282ac38257fb5e5206bd194a20906bddd74636bee959135f5dce4cf432413a24a05f77dabdee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF089.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0EA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit