18443012d336e973dae04f615295c54506f53151793fe5622580310d430d271d

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81c53a6684a5cfb176db5129ebb2c3e4_JaffaCakes118.html
Size

9KB
MD5

81c53a6684a5cfb176db5129ebb2c3e4
SHA1

c8309998582fb538ee40b306b406e5be2e35ab59
SHA256

18443012d336e973dae04f615295c54506f53151793fe5622580310d430d271d
SHA512

2941b201eed345559aa52410989cd9e3d9ce241f74915bdf78069324d34bd0b0a2cc9c7a91e0b14b26f9f29b986c2df9e476cde1580c0b2a990fdfedffb457a4
SSDEEP

96:uzVs+ux7Pg0LLY1k9o84d12ef7CSTUGGT/kPsepUlVHcEZ7ru7f:csz7Pg0AYS/P/UPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428708407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000021b5827542bc1ad3554b1edfc80da0edb701efc84ec6f5c6a7f75ee2fe733662000000000e80000000020000200000002ac14430c37f4f7f1489b399cda1afcef998c32aa2eb98de6093d73467cb164420000000ffbe38966bd260c49f3234dfdc719244aa85e5086ff6f94aa6634990e42f5397400000001704ede7dc9310bc0545dda8a41b2f7319b0396d8061dec7465734a31517c1e3cc8b48bfac5d9cfc13438ebe320e49b778e7913a718f461985132a09d7b855a7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{455A79B1-504A-11EF-B6C3-72D3501DAA0F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c1d11b57e4da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000050443671ecae49045dd49bceccaf5de842f004f4bdf879252312f9fb12e33112000000000e8000000002000020000000ca8c75e7ea1daad9390ea028f2aebb64984a255365ddf6e8c658be1971a63bd290000000695b91e4780c5b1c59218931a983788ed5d8da947b658ac17f8d69cadad5c91e21ff8205340c7449080fead4050b95a8d090a2aaa1d72c8459761dc681d3b3f0b0851ec38bd3b3afc0a266d740753cea3131ac89311fd3ea55adb1570a330a1b53bc682e394d074805d771394eb009866c1f19164287726055fc9e83fbfada7f9b0e58dadd67ec396e8ef0f0baa4f3034000000037790649d30d1cbfe26f2c49796731b709e5b068750905863ef469cfe2407612157f86ea007c84a7a94366cd4aa9ab9a25b72fe827833e41418a8f16bb49679f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
588	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
588	iexplore.exe
588	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 2672	588	iexplore.exe	31
PID 588 wrote to memory of 2672	588	iexplore.exe	31
PID 588 wrote to memory of 2672	588	iexplore.exe	31
PID 588 wrote to memory of 2672	588	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81c53a6684a5cfb176db5129ebb2c3e4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:588 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d7d282aee5c1b9abd3013da45b3b2a5

SHA1
d5b9429308122b61a48bb297b3a74fd824ac9645

SHA256
82cc119ce771bdecc19e65404e99488f89c5f116f6d101b3534bc55ab12920b8

SHA512
59f1fd89acd089190527554a5f116670dcaad82178ff13a9124180eeac0625b216e44fc2e905ebe7e927a4f0cfe023f350e34847a48b44d2f49dce879175202b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
430b4ee78f6514d99a1bc452f32c6f23

SHA1
157acb015559aba29e2fd65958816520f0c6d46d

SHA256
36f10651ff9c859b9c52b40a7237454168e314bbfe38fa14a1094050da33e8a1

SHA512
384b77c52391d9dc6fd9987033d3223d785604075c1aa1e9a9127aa668c79af35e40eb14fc1038d688fc590c026b07937de44c302e2212261814b0ab7ec208fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56ad0f1a8741143378cf92da48122589

SHA1
67b9e541fbdc27b849b8b269c98a9aaf64509c6c

SHA256
9ae2c5e0627ced1ec2b8b073d924083af00e9325ac5bb58bcfd498128d3d6c00

SHA512
86d51d3ae49cd11d92bd394ee0dc2269f52d9a6b8a46b10c604892df48046a2fbe71fdc1a730649603782bb07305aa46f64451cbd7970bca707f2bbe5ad72739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a7d6fd8d87d62b2cc659a60dd1b5280

SHA1
031b33ea3507b50fdb3cdda46c5fdb78d52d15b0

SHA256
891d00ec75fd2e60cde20c5f998a1625115a3121901861192f6f36116348e307

SHA512
da42b869c59fe809355b141be03ccd8b7e0b5c9ae0cd1cdadde9ce4c153ce312490855e6a4be4681788f7582a041f64f50e33a8c969e38c988b526edc33a132d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0610f991a5189a9271e4fd484c1218a

SHA1
92a08b3d44339da1c188d0ade6f5519529b0fe2d

SHA256
424a24af45b307497ee712fe6b4d1505dd3aabc97c934949dc071a165998d110

SHA512
426c7a937d70090c6b60a953d7ebc8b4d0d189277624a8a2c43986b58371aa0102243ef7b0c6674778b24d2550c1817c2dc434f56c575f413b5519eaa1c3da4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38c581ab06f0032c3ec082692527a7cf

SHA1
c993cf1309d41932702fef3e28ac4ee937b6b407

SHA256
f12c73a23693340183f4eb2d33b0cd42b613f826397715a018191c9ae6af98ac

SHA512
33d3314f997b8029c4f683eee9c324624b7cd1c4d004f39697e427b88352cf2d4b2cff183c80379dbc4dcc6132e5e0fb8513ab3f8e7a547dfa9510398a55870c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c708eb3882437e2dd61fd0623f53b5c4

SHA1
503f7d634e7147e2c824432f03af45635996a2b3

SHA256
9513073818858800598d01d27ed7ff03192481736c96ccb2bccd03354693402c

SHA512
507545086c456cdfb946de01aabbba9f9e31f53a184b692406c300501e0645703be9a7bad182c4550ee705e9902e25e17ef05408bd12214e1c45ee018fd976e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c989b87f71cbc34e01bbbf2552397ef

SHA1
10e564d09c979718a222bbe339703bbbdeb45f24

SHA256
00f131fddbbfe3de82233de90de597ac9f601ad2cb93fd8f4136efe2d0cbbea8

SHA512
0ed5bbe9d8f8f6fe3ecc4cb7b5ae5931228bb51f5f9731fad35ffe17dce5e030491741f689a51abfc25b72d9c5e7481f042107fb626f725f09581418d490db97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ba72e2c9b99854a97c79875a1739e6f

SHA1
875e70face15faf2f7de6317f749bd973b30b917

SHA256
d75d29ec81b0e58d46dfcf419c751199f23a125e83b59f0a5994388b2ce76c02

SHA512
a434730837603ffba5fcb97556bd7836fcae90e44abd4073daf51149e720a018d5afdb1b975cf43b13e4c3876521f04f02e5b59af5be7443d077d0d0f6b6cbce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e344914d3644daeb5768dc6edb63619

SHA1
a465afba0a53e271f015af06cc68dd7982cc44f5

SHA256
55fd9f75a66298aef591cd38c4fa97f2840223aca44bbf760978d9c81d137619

SHA512
23f3204a990333d3405bbc10c659064672967f4b7f5655a737182ecdb5b6133e4e038eda358f884f4c3ee0650f30433f20546f57560ec0512bcdaa77025f43e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae7cc6f8f0097069868529cbab1802fb

SHA1
a1b7a4b65ff67998e6ea3be55e1d3f20c633d2e2

SHA256
399b0064480acbfd78e725437383924cbb242958d9c561b7ad242107f88754a7

SHA512
7e80495bfc239f94f766c5a3c4daca7228354d53800976b76e5f189cd257fcc1b0ebf1de41158bf29527f6a9efc69409e44aab200db5285f2b94fa5af82e1f89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c03e0c1d7b018956d4b69670580c1b5

SHA1
a7cbdf3fee37a7735aac64408f1e76d790a508cd

SHA256
9646f3100197a41683dad099395ec03beef41b36710c44636d539005bfd5fa46

SHA512
1bb5b49857d787b3af6fc4045334cac28c285c3c36841481f6335ecedbfca74e5ce04d931b05c805d96816f696332b961cb3987e98fc0dbcb8c4b19699a8b458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef0e09eb11a6c7932cec5b5420421d2f

SHA1
13b629562c44a7b233d4554717b12f99f7618c7d

SHA256
ef477aaec8e7c9869d12b3d399c4f60172c1d396e65b060c5bcf44c9b13055c1

SHA512
5b9aaf876e1b5ceb956f6a2217c7cc41a9974eb2e927f74d9286e520b312b89a6d4b7f2479837b08619ce68da887db031a3f30a943728b744525a9861856589a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8051abdbd9707cb3d1efc7bd03b162cc

SHA1
18621dd6cf701c8a103990e7b2f4033355eee5fb

SHA256
e45a0c4dfae63abe62d68b868efe0697f89dd74fe3241f6b145a59483e3382f8

SHA512
174d989a5fb1347a4920571e16fa61528d23c10b8d82b0d54b9c082aa644c173f86e3f9259fe83f88a1fcc2c3a23c49ec750183055a07ae4a484920992b57718

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4BE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF51E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit