d30e64c21ae5d3e80c76ffbdc02fe4eab0fee50c2e907b94bcc903418c77225c

Analysis

max time kernel
141s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

840e901f8be7b8af95ca5853566c89d5_JaffaCakes118.html
Size

196KB
MD5

840e901f8be7b8af95ca5853566c89d5
SHA1

69074618ebbbb42b31886aec7f6c7aca53299a7a
SHA256

d30e64c21ae5d3e80c76ffbdc02fe4eab0fee50c2e907b94bcc903418c77225c
SHA512

49d52c10365c16b3a6a1d04f196f4de046cff96b50d183988bee8ebef7880b0d42513bba53bbf638675e03b7512a02ebfb4b78801e2cca6d09518db74e8b124e
SSDEEP

3072:jzSpebM+kLhEtjb9U4HiCiXonLprou0ys+lw0Jmz80K:jzSpew+kLmRhku0ys+VJmAF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d061377cb7eada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000926e012f097d65ff2e880f04aa2ca3819b0227d8a365135f9c34c7c63d65d0c0000000000e8000000002000020000000930f25f6d9b66c32769ef6ab95d4d2d10ae669c678e7fc705d26d911df40c9da20000000e7ea924bedcb15aea130fc72fe6c21bd0b6a140f1cd777cbdecc2cb9e713325040000000ecf52f9844e5ac3f7df981b87e5deeda35731d033ecee518d4418c5659eaedcbbe7fe55d4f1a1ec7f00ff2a245c10b053227a5d167d30e6868368a8049d6f963	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C796DE1-56AA-11EF-8EE0-F67F0CB12BFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429409465"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000ad3c4e5d363a3ab864354113a1792ec7855093367d2b027bad5e2ebd3335fce7000000000e8000000002000020000000e03ce9aea52730be60d53fbdd8bc8b50216a0027f7620e294a524f4a571a295e90000000211285f6633a096c69045a3f0bb92bdb673e1e87a4119477ebe95c3108d382a1ba2ea2f9816e157bdf87da75a0de5f58cd841cb76916e1b1cce37d25a12d831698167625a32d3efa1bc0241ce59b3e5358e46a4d772a674f07364028e48e836043776e0796013b7fe3f5b5ed2983b5b40a77a407e9b32c6b750ab91d67e5362ce3ff71325a3c4760c34428223d4a814640000000815d2c427312eddbc2eb9d08b2809231e7b4b3e3c68b6d62760d2432e73f7b3279aaeac50068ff79409a2c30b40e5f42afd257cc2b567d94bb98af5df6ffdac2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2568	iexplore.exe
2568	iexplore.exe
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1100	2568	iexplore.exe	30
PID 2568 wrote to memory of 1100	2568	iexplore.exe	30
PID 2568 wrote to memory of 1100	2568	iexplore.exe	30
PID 2568 wrote to memory of 1100	2568	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\840e901f8be7b8af95ca5853566c89d5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b9d85a9d6e59b311a6d0aa6167ced674

SHA1
0d3ff2e7875f67eb4d33f92648e7afad5a385343

SHA256
5856a42fd3febc1af1d6595c96764c56f858ed9620921fe22efc503547365ee2

SHA512
2a26b2b4e540dba4e3afb1e5c0e3fad18bae1ab2758f9f5501553b1ff261a7966698f3f7d450100bd1b3172f91fafcc818991fa1806dacd41e4718f0eff2385c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e655ab43984df93d97f458c21489ece6

SHA1
eed902e8538b6519edec5d4530c6583e80863c8b

SHA256
4fd2a61cdfc339eb23e11e60edc6d3bedae951f380b35bedaeccda95dc24c8f5

SHA512
bc6163508821ec298c35413cd464f0ebe8059a2dc12c3aa206f81dfdfa531a3a9b9d6df519f6493820cde449ea49eb21dc9166c7921ae771e00329c5c130ced9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ba5c6a9ee8ac8c457f92084302d84ee

SHA1
7d02a3ef37a68ba7bb64f4c2ed18580df4e1670f

SHA256
8caacfd5d298e3d7587e241383bdb7d3eb39a5a89916fb78a970bd3d35b045d2

SHA512
1d1faf9357833c68282692286edc58b954da595a221eae3cd24c85a8ec91d1bf830d220ad5cbfecbe12b08808844282e630710849c4aa613df7db818f3ff546f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79ca2cf8c4146c055ab6fe81ac5957bd

SHA1
9b1ff77594c2b6dbf96ffaa7b3174cbc0526d963

SHA256
3db5c06c6b42e42a30aba39bc12ff498f21eba343fa30737804e99a1724d58d6

SHA512
2430d4ebf085a199e3a3ff9bf2ca105582d9d67e13fcfc61195ae39323f393e0eef8d8c4bb676862431da497703777a534b625873c6d6da4d9745b21c725161a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c7177be53847aa10b8fb1f7b34601a4

SHA1
45360daf308cd2a77011f9d01db7fb835738d611

SHA256
cb042475a0bbb4b4c95f3dbbc3682d972ab336c1fdeddbf8ab1b6f004da0d3ae

SHA512
6105f9e57a1c30e9fb93e2b983684f3da607f10b5fe21e4f693d184d93436e784edd5dbd8d0ff2144dc125f72056755a6bf9acd26dc42b10e0fa1efa1b9e94e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc2b657a03dacb830aecee73efba3337

SHA1
3c2550e604de61db980f30e2aae7e6ea30609c67

SHA256
622d16e34a4a42d3708bb8108a0a88f9e4819c6d96fd8e5180099b4868b6307c

SHA512
a73b8d24c959fd52abe4460e688b9b430cc9c8c12ea01817a7f2d3298d22f0b033904203de1b0bde3a82652cf7d8b2f8dedb5430e1eb0114f5fd2266652ecbb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e97ec35c1446f6389bed341b263b062

SHA1
eeac6a1a1b84abb5d381b8d5738019b667ab92a1

SHA256
1a1559f46dec4ac686f7c58fc832975970d5a392af3ff0a8e2586b9fe3f2fe39

SHA512
60a5fd514be7adba0ebc7d0513a5c14e1bc5aa383c63ff6db8c3d6888521dcd64543f5f0d05111855cdfd827c3de9f3a1f6ac7d86fb5d94404ff5d1d6775fae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
881504854ba5b5234eccace3d0708bb2

SHA1
2024de99f8920e96fc63e12f254be0c12aa6d185

SHA256
2ca7d3ea550da67900c3be84d8bc2d800b1d806682452a471f3166d75f7346ee

SHA512
d2ef0e727adcc19a3e6af3492ed099a5830912bb2d55d805f5df5d9689fb903c1c0558650303a90d4232a3fd0bcff046bb518cc2d0db27afafd6803ca3687e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b361a48a8750cf7ac5eca5b5ffc6936

SHA1
76c1fc1beac63b1ddca280d8a531e4108051d38f

SHA256
46f01b047f0a01260beec9b2759d782b09ac9380bed9bcf07754c6ec7c085b24

SHA512
f81f3e4b39fbff639920a738bf0fa54d52ca98fb44755db9e2d732e232619e0f85b03ff355e28be152d0adee44f2da50aa29ef378df2df4bca9ebea8706063a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84c4f2ca177b05f7de53f3f8951b3fbe

SHA1
7d88067f83eaed4f0bd58e49c51ea38b501a03ac

SHA256
e85566d260d51bcf6a4c07347fe1883ba2a8b1347473089519d4e19345e32428

SHA512
e8182892f4ea40f14e7efe24e35f433c2fd6c74de06f1c554859c418f486d74c8be43de50117ebdfdf89d94ceb8db5b68244cc011500a139c80937d3cf07b5a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
864da4caf023e89750981483dfa00fbf

SHA1
3b8e7fa4d53d0a13fe52c36645f0963a631330fa

SHA256
760634add3ea091f63d01355e8f368e2f818a78c1e55aa416f8293f7ee13e04e

SHA512
1761e784eb37df3169cd41c7ed099e25942a01ffa5759e34bd3fc67d430acbc8e24f59633c35489158b7f8af089f7dbf5bbabd9ea30fd1faf5cd547b98f55b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3d3bcb0b66e84920113883ef3eb0f710

SHA1
6314e755543d06b89442c862f27b8da713056c4d

SHA256
8111768147ba116fb9be235197eff5fa5b6038fef03a6834fdd4e68afa582d76

SHA512
251da883bf329591941041c7aabc39c35ccf73824eeca864ad34ff19285bf2eee152533ee0ccef52bd36212a9bf5ff5c877ce0998e5d3c278c1ccd65bfe94b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
24bcdabb3742924f610ede5fa9f16060

SHA1
7ce8be26d7b959f741515f9464d3d4bce82f5b08

SHA256
28087d92cb9c6fa98e3abb39ea4139f3ea68f10649466cb67e2553eefe343999

SHA512
bc006740e74b415432f25082408df73ed70402056a9c38a50e29fba493526118d97852cd9b0036d2cf96982be051fa9d0425aa14b7736c76b2a94e610780e9af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8A46.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A59.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit