d4d97d30c4906dc4e51223195e1358392d9920312463641a7a783c9948bf388d

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1bf3b307ffcdf1c195eacc1e40499ca_JaffaCakes118.html
Size

39KB
MD5

c1bf3b307ffcdf1c195eacc1e40499ca
SHA1

22cf7f1783d00fbd533a0f1611ae735761a66a43
SHA256

d4d97d30c4906dc4e51223195e1358392d9920312463641a7a783c9948bf388d
SHA512

a9f28cdacd19c388fecc45b1e87c67bfe176ac7f8060283dfb6bfa4e8ecddbced0b509ec1b7bf7ad5364413b76fb0fbca2c4122dec1368bcdcd6f1711d1d25e8
SSDEEP

768:J4TdcqpX/pJdgsxrX+5pt4Y7FZeqk9jxuLyWUmaNtH:J4TdcqpvNgsxrX+5pt4Y7FZeR8eFZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000301b059fcacda2775f36cd66e2aa4616349bc1c092b5b6c8ddeb77958e8c1f8b000000000e8000000002000020000000306e0ec18da90b9f1f79465be9d11a9bb29b5d534cda6ff3c02c8a975becc444900000005572fc39605af3fdf1e0c4b0cef8e722e304534d3ad21f4e13310b7603a14f651c693d5ff24fa71a119b2aaa2b8bdbb5950e4c1c39f4bdb65fef6593fb4bba84098db5c96b2dad1d0981ff7c06d263629008cd1f0bc3d2b066aab8596e8eeb84b0fcfcccefe7df6ed74c9a92ffef8bba77bd4df85c40fc083ea1743a2cd79e4830972c986f22db3904ac4c0fa7dd82da40000000cf4e4f10fbd51b620e6661ebcddd907a21465801cc07483fd8921d7bed04c32016e68f7c754e23d2782eea06e8b22d5245d61098666f0246f31c4bf169ea40e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB524EE1-6333-11EF-99AF-7ED57E6FAC85} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01caaec40f7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430787908"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d0acb5235dc344e89ece850f3eca90e2562b6c999328f1a983523de019a2edc3000000000e8000000002000020000000fba794e0728fa49b18bc8654b1f53828f0e26534268c681d045b9acaaca7d54820000000b15925d578073f1be420d4b9683bef454633fece728d350359a35cbd8661691d40000000ea1f80bff1dc29602881f0af582e25f452f2ded7de14e93f4fd76d494cffe14e414930d541229cc43104d8a7eb40bd10eaa48e0fe9f6fcb13f4a20cba54beee9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2208	2204	iexplore.exe	30
PID 2204 wrote to memory of 2208	2204	iexplore.exe	30
PID 2204 wrote to memory of 2208	2204	iexplore.exe	30
PID 2204 wrote to memory of 2208	2204	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1bf3b307ffcdf1c195eacc1e40499ca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eb54ef113cb3e8073b3037e5749a322

SHA1
7d005b066c60c2eea012b0ed864d2cc58d8deed6

SHA256
68bef57d5ee0bc98025b0389ca6970d8fb163fb96d492be050f32b5805a99432

SHA512
51466cfca48acf489089bdc7f65c4a9fef31ef6bf81c8bc20dc29580451c96cca70d41d20ad0d0eb79997a5e4c2b128bb47cc3c49cc3c0c3f4e3e22bd917ced9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
022806b7b935dc0339b6758f31607da3

SHA1
257560881b48a312b99b6cb8078d55b45ee1ff95

SHA256
4ba47a95a1a549900c69c3308d6ea82bc64d2abf9c31ef9ccf73fda074f04c43

SHA512
36394ed74e98909e44641a8b11d8d8cd8defe87cc7fd8a5d1f25699042595183652c5ead42e628cffbaad021c5279f8845aa340f82bd21b36357e12a1a22bd65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bba79404dc49d23f78a442c71ae42023

SHA1
d10cf93c8acbfa26ebe1a87ab8ca8fb4195e006e

SHA256
8838b2c9cdec8720cb789183e56cf7c7fdfbb205e36edd26c703d657799fa686

SHA512
3334bb41c74eaa86e52a60004577189cbf0dbd522ca6815668b1a63eea850fd9377edea115866c48f9ea3a5a772538d7c978930b64f02685026577b6c901ed8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a8193a624b86ceb841740b9571a6e73

SHA1
b69acd649e9efbd73ab1984c90f0427e5b25a648

SHA256
3205e519eca79a9d4e9562486e5d24fab56fff54fb5dc0075ca886e2962e85d7

SHA512
5a87c1396921f545bb8b4d1ae06a918eade782eed819cf4aa75038e04d8ebfd09788f0bad26567e820f5d3c8c38d4e52ba3ae23337d37f82721b4b4cdbbe6d9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
078f682bc5dad4821c629d5643e823b9

SHA1
c043db89216d26f0d4312d25f63921c3e96862ed

SHA256
8ad76aa01466122aaa75fa1f3d356393ffd414582de2d9edf228ff1494de6435

SHA512
093d8d34c9e39592f8d3bd491061d9a9c0f0a9d4c654fba4c86a016874d3e23f772482a34570c363274eda1eefe1334838062ad0df703e6b32d8d48c31f4d2ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91f5da654cf427e2f0f9b8019fad8ee4

SHA1
a0266eefc53fcc0b27e2aaa18dd9840e27188728

SHA256
2ec26e0fff8cfeaaa554200f10eb66b6e2ab0e987bf474bb6765faad364f8f48

SHA512
b10126cf9ed1216125870b9948c92e5f0d9227ccff0444c8d84ff9a23d444f50923cb8b2707cce458006919affe4c3c68b8ab4fc28fa67e0abc58e0fa4ce5dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa32cba64dc8d0713c747eb8c3bba2b

SHA1
649f656511a97e8e94e98d75cd82d9481df85480

SHA256
a9277915f4c6e3d6824980d81a60e40af4b141fba0a6f128e08c0e259e6b9221

SHA512
8002da8526aee41174603c8c153e1ac03dd45f7a86bbc29e051f5e01b981188fda2c1219dee3c7312f4b5fcc5368cc0aae241317b935b4cc06d9cd4a9e50e5f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d51df5a944e5dfa73485ecde46bfd5e

SHA1
2ad753e18f3afbc223eea64227b537ae021e8ffa

SHA256
57e27334b47ae8762569c94a3bacaeaf09084a87ac5834246cb0825c6850ab89

SHA512
4ca10a113428541efe220834e029a28fc029340889a9e5a3fbcaa4a474a32f6cb48e3f59043831d6396fed9e335ee33cac4cb407b29baf068dd4ed0a146cca0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f5fbd5e997f750df1c28d0d4f35cce1

SHA1
6a558392756c4b07f7b9d8b4c4bf227db81c632b

SHA256
2ea63e9ded1710552d2be8334a37370f2af6c393bf2bd68fd8b6d58f103cb835

SHA512
1c98c27f376ace23ea93d95672d00990aad7f4217f6910b1b9545608ee910ef8e510123ff2bc5b10c0d2cda9a8da5f7d0e6e61dc136cdfaf497882721cbffc47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f285e19a5d103defd990650f49f0fcb4

SHA1
c851e9f99f46967aefc7fa59a20d019f337c0916

SHA256
b9f63b6fcf92b601ceec191dd7f62e8053b5306ac4b8ae529ffb6c478449ca54

SHA512
f4fa13e15b2013935c58948424829c2e7a62dd207f82fc767381419f1d7e1f55e4e81db29310a8726d02912089b726981f70f520b4c2c3676911b50bbad253fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9628.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9ADF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit