4a68ed032e28fad6d272a6e53f5398da9fbc0d5978ba9e9661350ffab57a696f

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d09dbf5b7f53cbe6b7110aa4f31d8247_JaffaCakes118.html
Size

851B
MD5

d09dbf5b7f53cbe6b7110aa4f31d8247
SHA1

daf1b9a2325ba5ba748d56cedeb4b496f65a690a
SHA256

4a68ed032e28fad6d272a6e53f5398da9fbc0d5978ba9e9661350ffab57a696f
SHA512

56f1c7a297e4303250c9799cbad822f4228e38abd615974cc4e0ddb2ce129e61f27de8eaf7396d74c648572a4160a0a9d618bbcdbec9527a6e7268d5461af28b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000003f2a132a85f660db71572ceca9b0387fc9480aa49f251daaa25823442e903b33000000000e800000000200002000000048d59057f4a26255dd6d4427a253a4d7d63cd0c29188505dc001a5c73d42fc2420000000adcf0a92a54ccdd0d297f1808151c92f2ef8b3812b9c81373ed9cd3aae37f47c40000000908863416e8de60966ced539aee0a6d9909d95c7290ddbbe3af09084b9e95ec835c90803586f9e72e894993217b2f9a46adf22f3745fba5cc0417ad83fc7ea4a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000091cc5f67e3aeb875cd826c19b9081638feb2076328226620e47fea3f4304a936000000000e80000000020000200000004d3d15f01bfc89f4daba2050c7396c27d7958afaef4f22dc10bb8e2e30b8889c9000000052e322756b7ac76dcd5ff1a9020a77932bbeb3eb907fccfff7d07ca6561ed701b6907ef3fae5ec60ec9f0de0b3c66c73b606555464188b1b09ccd00a25c1315778076ef31deb8c64205bfd3989966a6a647aaa0e298431298e18339edbaaed35fe4641bbcd36055924778fa3f54f6b782e50c52876c423d1dc8f81f28324ba70fb179db47a93e67ec03255fc820342264000000035b1bfda54798e83c6a623eeac9baba43d52d869c33a938de6632f87973182d7134ad2277f7002a66cbbfd8fa516440c08f41bfcdcdc0bf503a5a2044e3bb2eb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e40a79b100db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A48A92A1-6CA4-11EF-B17F-465533733A50} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431825854"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2052	2764	iexplore.exe	30
PID 2764 wrote to memory of 2052	2764	iexplore.exe	30
PID 2764 wrote to memory of 2052	2764	iexplore.exe	30
PID 2764 wrote to memory of 2052	2764	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d09dbf5b7f53cbe6b7110aa4f31d8247_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60dd5ca392c358fae24c54a8172ff2a5

SHA1
4fdf024f016894afac92b948bc82360c972a4700

SHA256
ccfc8e904a2122c95187f2dc6e50c64253036a0ba2516beda1b5d6f7087419bd

SHA512
7b33883b406d8a9f74c9975b89ba163c4819c6c8fd1410f9850113642b583a140348553e43c27197ff851d58e0553a9ef67f0325b7d75c59a0b109cc9a968041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6317845a0fe9e108eb0fbde1d738ce50

SHA1
8541a37139c9a685ca8b072128170c22e34062a8

SHA256
55bb72c674abbce89f641af218d6694b8ad12fb06e2fe1e8480d523f05523da2

SHA512
32c3067afbcac66340c4fcdd4e57935c20325ccab7b71c454b164f3581b02d6de793203f28f931d7e00a1f75b7fda9e90e7991e4a27d4b299b0949c317370627

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04d516c8ace51cbfbff708b5d97c0712

SHA1
471d2ec86e577a24e2edde52df0e9f2b7d02c41a

SHA256
96a59348b2eca4452f5abc693146e940a300f0c343704fb80a2569d26fad13ff

SHA512
a05a28dc621d64809839e0572b612280eb849e4d2b5d5d702f982d13b2108e46205ce8cefa8cfe197f3f5dcf9532c4cf84056978bc2de2a9bc0542606cd0ee1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
291876588a0f8dc95cc0e62f703ea157

SHA1
84fdf04e3c22f2b9c16a578c8a53898734338264

SHA256
b0b39338ddc2f9da5097856aa88b0c06daad26413bf7baa0f2eea1112d09449c

SHA512
17dbb6573ed5206c99235759fd66bd021097c3e2f75a396baaf63316571486792a10fd97be1fe324295a1d3b4c70be48c36b61d5a9f7bd159e38b21561f73428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53019a45faf9dc89e56567ee1eec37b5

SHA1
122d1a6f4ba27cd2e7b400c1bb7dcd2913c81b53

SHA256
beca80e81f224882e072f4c0e90bc1e6c74cb161939c8c66acb11357023772fe

SHA512
2ca0585ba6a5578bb4d7ca7f55e13674195207d56a47c106b2b204a67da3e1af9a4f76d478bc91eb04217784357bff70a81a04b6b1072630b97381cf21335830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e460790073edf8436e7d8eecec99499e

SHA1
5dbdfa87d3961d7371f81ad2733a94741c1adca7

SHA256
bcb9a43c18f22bfbb6e6178d3d024d0b79daca1cc82a6542ae8e15157af4c0e1

SHA512
42a6351b38fcd9da240f2f871d3e325398463012bd4d3ebe6e3b03bb7380a406d4e2f9154886fd85b808a9a1d373bdee6accc03fe3a422c54762ad15dcd51bff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b38d398a1225742a51ac6111a996bcb3

SHA1
9ce7257013592eaccfc5a7b1005fe4cbc986eb60

SHA256
16a290b8416805786a162caa52c13a4b3b9265534ab660ecff9493f6f5236faf

SHA512
c49cfd915a2aecb960169227f924fa53090e62fd1edb643ca2bc1fd18d76044ddffe6a491e1cde18a561ff346597f15bca98abf963bfc5524f98c0480a9616f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
710e2c95e09bdb0a328d3558bd24f7ea

SHA1
274533ae55f6f21470d6bb1cc6a1217be6dfc05d

SHA256
428e9d0b28dff56450dad6bcca362152e422339580da0ef92263905053e2aeb8

SHA512
bb9d90afb715399b22c5ace6d6854fda668acd21bbd61ad713cb59262e225308c0102bae053dc40055375b1ccaa336002b50773ae763d7daad1c528508c55dfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bebef5cb111ce169c0aab2d129e9dc07

SHA1
1327c09f0f9797df036d8697f8dcb594da7f3e57

SHA256
8ae50172d1047a4548b6dece71a012d2f66f4ad7bfc7cd25c758136fdc2c4946

SHA512
913fd510d569392afdf0fa0abfa1b88e3c37a7c419ccc7c020f5caa1925926fc667661df25be63bde57c0ada905d87f2076c079c9e0a649803ca6b10ab5eeba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dba7142e9a93cd6778cd3101ddb3a68f

SHA1
7172c02d13bbbd9c689142ae1c08bfd728541aa7

SHA256
74ed69b6bc0ce0f73179e2af7fbba6a70ad760e4a753a76d0f56a4347570773f

SHA512
084ea057382ffec86868c5918ff1a4ef0e2215cf801fc63f461aa57da1aad2bb408b57246ac0529067f51011ab0bac9e6641266f9ce9654a8c2001879fb75d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e311487358f16259153deead08b1d1eb

SHA1
3462cff31dc27589136105801249d88fe1a92edb

SHA256
2c269c78e0e76def5f6697764e5f1cd857896eb0e6fe268116e950b0efd19efe

SHA512
87ee509f6be2dc99145e9aabfb4b1b500cb369049cb42a4ed5518a05b7f4c0acd97f49108f1772c623032f27af1f0db44e096df1416d7949a6160844ad07d72b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bec9721a70a7680ecb147558fe7518cf

SHA1
a6fe2ef529e53835a8929712a3c33778e0f0f3a8

SHA256
a5a5d06794c87b7d48d467bfcaa9eee7dfb733578dbed3bb4b08742546bbc9a1

SHA512
ea026da0ddd2592b39cceec6d511b7353a7176b3dd5a511e726e2efe0aebc9252f798f5189a988398b32e747d4bf4c1921277dc21d80c4119c7834afad5db504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b9a28b038d49ca31ad91b9312bd3331

SHA1
641a59bfd13c377a1e7bcc0d643411912f52541d

SHA256
1cd0f947c39777be4f5842b037c63c64d175ce8a9d66f4648211c8f5919534c4

SHA512
b1bee155f5d85fdfb5d807684cf2d345e60c7895006fde5a0bd5212599b3551d23ac4c838267ce67a2535004518f5348972d01c24f4270ffeaa6bf1301e122e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab737E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73EE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit