403e7c6d11e123c7d49483527fae85d7de07cb7fbea61fb0e0dbee2eff1f4388

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

85a9d5d40c770a33c52c19dad0c23eba_JaffaCakes118.html
Size

53KB
MD5

85a9d5d40c770a33c52c19dad0c23eba
SHA1

78ccf3f41c165a630f8b2dcb975f124c6c8f5808
SHA256

403e7c6d11e123c7d49483527fae85d7de07cb7fbea61fb0e0dbee2eff1f4388
SHA512

99b087e340a7a9de9f9b0819bdec19acef66233f21fc38f77d1dcd4e9d343b57da86d3893ca6955c4bd393083411f3a0c316b2b12300e56b262b7cc092e45a0d
SSDEEP

1536:CkgUiIakTqGivi+PyUwrunlYbj63Nj+q5Vy0R0w2AzTICbbMou1/t9M/dNwIUTDv:CkgUiIakTqGivi+PyUwrunlY/63Nj+qM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429446466"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000d8dbb92bea1b2e93cb2857adf6cf090289d5ce0765c55f240538cdd0a771362e000000000e80000000020000200000003234e3f5661600a64521d110f3879c1cc3e549dc5c58ffb9b75f4eeb8563bb362000000015b6579483798782efde7370759f50b741228a593d3464baa623582597e8dc91400000002e95a3aa0673042dc01ca8779093cb08ad1afe9c394786453cf82f6fa0de2ae8fe9a791906c3c1d3fa6f984a2fdb6708da96bc52e2d37a8fdc83fc35d89b6452	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3656571-5700-11EF-A1A6-7AEB201C29E3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000006cb073de954174bd46985faaca5de1487cce6b792146b44cc0ee0a4298d9d09d000000000e80000000020000200000006742bfd6fa2f905305bb61fb8dfb96c64bb3e010532efedbacc402ecc30ac7a290000000d1162904a5b000ff21ce3711d859d2427bbb8e8cda72c1239bb468dd4dfc01c5625c10771e04e3560b5a1fdc126c528fe669c37d8a2c9f23dba8b9db53c934bc5fec3471ccd6df9921b32e55a4a45fdd0fd66e20758452348d9801494daf4463abf054e877177719ecf49b54281f24ddffc0e744cff60fa84a1698102fb3f70d79910bf0409c4d4542a7746912183677400000003a1f2d32d3c1635b7da546522f281150d7cc5ad91feb8f2e0a5f6000eb2a5a5b15aa3208d157ff3a44eb76c8654d1fcebe77c063d772ed45bf1239b055e04ac4	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b7c1880debda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2688	2752	iexplore.exe	30
PID 2752 wrote to memory of 2688	2752	iexplore.exe	30
PID 2752 wrote to memory of 2688	2752	iexplore.exe	30
PID 2752 wrote to memory of 2688	2752	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\85a9d5d40c770a33c52c19dad0c23eba_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfffeda99787d1acf4a00fa61f7f978a

SHA1
7bedf0176985404dfb6136ba22e4adeb03264f69

SHA256
bbdd91b4039a6556c3040b6c2d5e07778c73d276d84e024e237fcef1dd00972a

SHA512
8898d02f206645cbb6168e5446703b0b4b35bd03af18fc524db8648f3d374c651a9b76f231e1fb6c557cf382a96f545fd0e969f43f0b3ce6b24c969727d9d749

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4392169ab36175c8bf9c596060c532c

SHA1
6c2f08eb01215fa215e8538e418dd54a104d29b6

SHA256
25dc4dd1a7b667cbb481b10080f154a53feede1eabacfa2a37f420df28e6dd0e

SHA512
fcdefe6c615a05142f2e8b85610b02c1f25b3958aaa2c3c8b8c1370b7b21d41b2286a47b23f3556e8fce8a2d6f28bfdbd89722c0bdba16f1fa74072ca901b6e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15ed5ed37e9a2e5f8551c55baae70841

SHA1
5b75186eea6a1b395bf3501e1c7d52f65e0eec40

SHA256
da327485e30826b8b6aad1fe54a66ee2e7cb2a8d0ab15bd126f94e0a1cdc8541

SHA512
9650b5aa50cdce737ac71ad7774faf1c55bfa5d058b0f59ac5221c3ee18dc2fa90b59ac0c6b7f113eaed538d433a064d94f6741936b3085787321cfad62346a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e243f49c736073e5137672dd6cb7ef2e

SHA1
df658a2f228381145079b359469d445cb2c1f6f3

SHA256
a49fd39718aa95405fe19cf37a99886a1023095ff04c340c9e84a73233b8c307

SHA512
3da5389a7e08c3340c789100aca1ab98126936104a2642d2dc3294b1a69da4d9b5609ec9fd45f1fba907accd9384d8a832748587e2268844b6e925fdd7a253b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7005ab04876ba0d213c95f6ab9236a6

SHA1
36a871e164a4b054626579c672cd307b7746b029

SHA256
7097deef307d711311a76ff87c87c2a48c3cb065f324bd87d6d79465bdc5dc74

SHA512
1a305eb5afe18f433f465e8ef75bc16079a272f5e141902ab01dd26e6d16506e6b8fa26452e136bdf040c989c6550d3f82afcea633fa3bf07562fcf0aa265c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af14aec6a66248273563e4b56032ad41

SHA1
c68752e584ec4a9b1e690347eeaa880c5e8075da

SHA256
b54380497a7659161285862872d37de5b8abdeabb8ca354e589e5e94ef74edc1

SHA512
8240886ee4e8e991851c304b7a68219c24690ba6079f587a80766f43e606f1112a08ba03a75c090eafed67c7463a19d0f41d2c9770b3671fc8feff66a8803abc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
766ea8de2223a839dd796230711a8785

SHA1
855013bdd1f9c2d2a46580a3253cd470cb3b9bfe

SHA256
66d30e3b3af8a9cf24e3b15ac71150d808b972bc1ee1e30a7ef0b5bf93dc88f5

SHA512
f4b26cff68803e988d6d06b4612f82f2d12fb5d1c4f7e0a7154116f093f023ad5b1d489db59e9628ac351a225d8771e62a02ef11a628da4a5848896923c272ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fb8d7f657025f1bc97633c5c93b833e

SHA1
aee5d35a3f9fec73c695100f6b3e62a6f87e722c

SHA256
41cd1caba709628bd148c6ea4e9906afbf3772aac25584c072f93f50e0be8fc3

SHA512
6d7d99b168d870e37b00f8e7e63f6cbc1ac71e8c8f151d7dbf861ff9bbf6149e792dec2f3b9f5df125319f53a366049a656c67b088fab4309e44eb5851061ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a359f3bd808546b26ab79fa93ae3d81d

SHA1
baea33e118020c6e90646eedc1dec3401c5eb6e7

SHA256
4d312705e9622b1a26fae72e7d7d17f4576171827f2a4ad13302b93eaa77b8cc

SHA512
96d8573a08ba3da71ab54145c478cd7b22c2c4910ef77a53d10ff5a48fadba1732fb79d3f718c5fdc888e8d14bb9d22353547050dbaeda26b3c86cf6dabe8649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
616ac211237c0fc1664b6db048747979

SHA1
18e2ed8cfe5f02aee9fda60f2088bb5adf68d5df

SHA256
59b85e493d836757dea786fa8b35f12aa6a6ca957f20bbb8f22670dc6a12c37d

SHA512
c62d30204d63bd4e7298f130fbcd6f90d34a5e1030c4a89658591f26bc3416288395297a166b7afad2c10f71ece365c331408d188a4ca6e50c1bab4f37a53f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87c5e3d3e08f03eed71d1fc644b6b4b6

SHA1
1f7825c674c59cb9f2a21331b82de6a823699f4f

SHA256
619310f81e57e2b05798203d1a265fe9c5d6df532bed716ee7cc8e30f900fc54

SHA512
e0a26fe38e228e6fd85c6b03a3ce51746338737520d7a65555dd390c132c583edfc4ece978809de2dad66b03379d512c15f4e3cc65d4aa98a6cdf4cefae1fc08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57c14bb3faf148349bd57827d1583644

SHA1
31596d79a8550ab4068efc7a689b79e60eb8908e

SHA256
cfaca16156b26e88ade89d9fdfaba76b2cd81b2e07ad7fe0c8e8d58c39969cce

SHA512
83858d5aa3a63410b43146942084687035d504eb3169e02b1efebc79a774d2c464a7c00091b0e7449645f65c00f1d8b2ce1c697bf09e1ee681770a742667b433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69470ad4268a0889c71a746a0860fa25

SHA1
5c344dee6efb7c6a5b994bc74f7b1c425dc082e5

SHA256
f1cca137f895e526096570540974bc0fe1e0ecd1a51613fdc582e839fb5452e9

SHA512
6738beb5fc764b6b495998998de974be2ba04350f609df367c55fb11e3a3cd4457047cc5e725ce6ef6a5980a74b596dd6f71f7e18d37b552abdf2a33e7f836c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
754c9a1e35927e5042e10d32659de88a

SHA1
2d9d00cf390c1ce733a98b3f2cbd667a5da26c9a

SHA256
0d23bed242c5d03ae636afa01e789b7e68de9ad79899b474444650e7887014f6

SHA512
1975628a2beed5c6a3ef35e1b1d53b644b8921bbd3a9e1f01cf670e285efa9436f861e75556cc2240e8137bf2ca9ba66e7a88db8434105c61d2cb1859eb57b16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z2D3H3V6\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab46C3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4734.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit