d5b9325673aba6ee8fae494dd8dacc1679ccc32883b2688f37a409c8c4f1fd19

Analysis

max time kernel
118s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82cf4f222900e0a607d8936d16cd1bff_JaffaCakes118.html
Size

6KB
MD5

82cf4f222900e0a607d8936d16cd1bff
SHA1

9f3f3aaec8e7997c862faff5864bbe593f36d011
SHA256

d5b9325673aba6ee8fae494dd8dacc1679ccc32883b2688f37a409c8c4f1fd19
SHA512

c3915c9164992fa39ac630fd7424cb87f1e93738571c3984b01eb66cff73a7a8d648b719508e32ea553122a80b7831ae341e53632ed785adef3167b2306aefa3
SSDEEP

96:uzVs+ux7Qr/LLY1k9o84d12ef7CSTUzoY/6/NcEZ7ru7f:csz7Qr/AYS/s4Nb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B0E44D1-507C-11EF-929A-5A77BF4D32F0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00427f988e4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428729806"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000e1e62d551a477b90f05e1dfca5aed03ca827989d9348538f9d19e0002d88067f000000000e800000000200002000000065e052bfbdecd80737767eca44300aa961ea81e8acaa4d8b3405069731d083282000000085ad64561bce81121d043acad6ad988395302f650442fd415cbfebaf4708666440000000e867287b9f229406ccf75d975d237b87ed3c061cec037ed5f792dc9fff8ef90e0a90df8f0137717102688e9bedaac69ad3425898e7e7a5b161b2c48377d80ee3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000d59769972508747d48e6e46600f40db74d0532986c5780085a2bfbcc3e3f8b4a000000000e8000000002000020000000491621cefcdd8033821b2c3ebd1ae1497193649defb72452e1de29726c1fabbe900000005449ccfa6d06df21d4d0d5cedda67e3795c6a93860a12622f6bb726765256ace5b56245e4eb36ddf1a166aeef8fa1fd837ec433947d84c0f026b637a60c30a4a9e889dde5f2b66f2e2074c79e1ff902f1c294dd7807162e61a27186c37f390f62515f8c3e1d86494adfe945ad5e1e68b6576404e0c8e9fe486ed92a06e129d4104e6f91a1889acf849f62f7b45ed4de74000000034934c8372df77043251af38eed93f7a6bcd89739d176473d3b384194bf4e2a6a036042f8bc34a79d823fcc5d4cb5d33b69a8836fb7c64fee7875fdef326e890	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2736	2848	iexplore.exe	30
PID 2848 wrote to memory of 2736	2848	iexplore.exe	30
PID 2848 wrote to memory of 2736	2848	iexplore.exe	30
PID 2848 wrote to memory of 2736	2848	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82cf4f222900e0a607d8936d16cd1bff_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
95aed09e5315b5b8573fee03962733b9

SHA1
2c9500d93e5ad8aeca50ab97839b1ccfb5906cea

SHA256
fc9b887dc26d2daf89fdf0eeb8fe77c1965eeee1613ee40b5bcb7ca9a4077627

SHA512
1c8c2bd4eee0c180131285c408e38ca6f160d641863a7687256934e1b6af22ac96bcdc5d094472147081e2838e68e2d4a8a44a463644ccc79adf666e26a9e2a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4a3c8884659358ee53607bff6f3b46de

SHA1
9cfd01fd92d92d12d01f415fe4e8f459523be3c4

SHA256
a44b7a69d33d1a5439bf29d3fb433430ac390cdd3a4ea678b19bc63d9f5774c7

SHA512
72d5dcf51b1bb7d7fadde6bbfa23759521770dfa83700cc12713ec5481ff878116ad1300a5703b8aa9654dab64034514258c572cdc3e7d710421fe63bda0fb48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c7895c38d8cf9e77fd0d162f47dcbe59

SHA1
3bc8a01c7f31efd2db764e79959b4d0ad38b4a43

SHA256
21fe9c90cbbfe5d513af31ce4a3aed93bc53c295fc412ee36b75c5ad502721f7

SHA512
12a94cf30bf88695b152f93573e9dee97933eb5a99cf900b524811cb9eb524c6ec909c2f3b85980299089a683fbc4081192241bab10d6ccddda7f6f784a9e9aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
02aeb786ef4609e88c1a86f34dd7eae0

SHA1
b546da8991c92085a25b2d197541dd509bbd86ae

SHA256
7a65537b45da1fb3a9c9e6a44c6923c63511f4db7f14da2c22f2cb8e8971e463

SHA512
6202eb5b667e954e9946abb9a91f231f29f9b5c71f4d83bb115acef8862f558e2840c292505a1a68cfef355d70620d10e4dcc88080b7abc22d69108a9715a569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3ee79366ced7a4a35b7455d6d3ab0613

SHA1
5cd4e10d0ad645c3f5eb76c9da7403f771922250

SHA256
88e1e1ef0ac392dfcb2381de28c98e2b7ba299d64183d570cf352cd898c30a63

SHA512
0841fc422dc7cd5bcf1180ff27251d571dbff2cf7a2a7d74a8ae83ab8322b6753f04f78c476cb65232bb7f6f89e254a0a48083c6f73878134e387c461760106c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cc3ba20c75873cc4b65cf34860f3d1cc

SHA1
b22d6b43050c4143ac5b4a86a4b746ae873cf7d0

SHA256
8bcaf1ddd9b5b591509d55d6a0e1a6a13698f6d172c2b36ee921ee63c98c5567

SHA512
33e73f6e14f7c47ae5eabe630c76fc2eae32469e2ddcb94796589457e970fd7f1820ed9b732b60c67aa5df58dbee94b0e32477daa2b92e63387166f900f12b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4a8e2b09a734714bbff3a7a57ab145d3

SHA1
af4dd7a6e1de0534bfc61b5edf027f7cd208fae8

SHA256
f333a1f4d2731c648f4e32fff1bfcea9e21699e2b40ed981f035136025ee9e6e

SHA512
dd8b746fa65a236f6ee4d0f9c5d025cfd0ab60e44562895120d93d49a04893580789ba14b770e9b0d74ef6c9fea7b8087552473b54426bc3898576f36c99dcd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D32.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EEC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit