d81429fcc2c41c9ee4313f0236dc92b4d6ad0e7fa33cf8905a4a5db82525431f

Analysis

max time kernel
131s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d00ad4f8090637a0c527a0d2bb853f0e_JaffaCakes118.html
Size

116KB
MD5

d00ad4f8090637a0c527a0d2bb853f0e
SHA1

1fb34c6482057c8186d37fd32cc6e54e691c5df5
SHA256

d81429fcc2c41c9ee4313f0236dc92b4d6ad0e7fa33cf8905a4a5db82525431f
SHA512

307f7038a6d1e9ea2037eab3d982bcd34d66a33a4d8744e824beac0969d307e2fd104462c2e9f86d2c01a178a7b12baa0934a7db061ab404eccd220b7040ce49
SSDEEP

3072:UklcWklcaklc7uG/bI+3SkcXklcPEijZeqhREijZeqLLexb2mdiAch7kAch7Vevg:UklcWklcaklc7uG/bI+3SkcXklcPEija

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431804552"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B973B11-6C73-11EF-9E7F-EE9D5ADBD8E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1852	iexplore.exe
1852	iexplore.exe
880	IEXPLORE.EXE
880	IEXPLORE.EXE
880	IEXPLORE.EXE
880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 880	1852	iexplore.exe	31
PID 1852 wrote to memory of 880	1852	iexplore.exe	31
PID 1852 wrote to memory of 880	1852	iexplore.exe	31
PID 1852 wrote to memory of 880	1852	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d00ad4f8090637a0c527a0d2bb853f0e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
5977193ddae3e0e34663c6d496b93054

SHA1
bb77784cfab81c8663255d69bc84e45d07bea2bb

SHA256
6a4848dcddf06df423a80f501d8dc4d37028dae352624cc687342126961921ef

SHA512
6a95f17349bd5c67a0c86f149e3eb8863686cf58cd20608a15bc9e79c419c3caa47488c52d37ce7a21a6a0e3239eab653e3b48ac1d8dce38bff29524f345febe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_F968CA97A68F4E6D5C104EC7FE3DFDEA

Filesize
471B

MD5
0833b6439bb9eaa839a5f7ae01a9494d

SHA1
5e88401b1df31dd2c70b00e4c1cfc9f3d3886244

SHA256
8237a475d5665559237bbb3e0d705330c0659b30e15f0d63f78d314be8e29eea

SHA512
1952c3c3497ae91a6713e3d92e9c256e0d3f8a41290dd8d913600d4b406518558e00c35ee1211b75c16ae0094e02ca198769bdd6d66db2e2abea2e085ff5d0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
d9fc60773066f4af3e3455710b2d1701

SHA1
f74b12304210520ba0581e98b3fc4222c4bdf1d5

SHA256
53d7ce6cb47fa619084460ad7d1f437342d529d195c9e5173b4213bd00cc5a37

SHA512
d31983485af6ec30074b730d4a975dffd51b8700943545a47ea9df78c1cc8b9de519c957b643969f369a1cd497c4244698941fe62de98ae585441aedfefcef5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
e53dba1b8edec62aaa7d6b279bd3d3cb

SHA1
044f14cdc711327729bea5621e1d3d277e6bc44c

SHA256
0fcc1b95ddcb6148e986b57a1771090a946fca79f21b2f5f563703dbe124c958

SHA512
aa18cbd09dc7d678d2f48646a37d0d703c96bd6209d61cc4b16df6b1ccac8dac01ce21624c2e5ce22cdbc003234b62994342ae442c4553aabaccfd982437760f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
603b3d761703dfcbf6fda1176239a3a8

SHA1
7ad188f441fe03d2363c639e4284cbe45b704bfb

SHA256
5209680f52863bf022ff194f806b5a61d55b4d51f048a04937e80c19daae8338

SHA512
723838889e614cec8c87e88c06dd9c116c82cd5cec578ba9b418d568ae951872a884200fda5d39a78ca92f61d9b2d57c5166fb1ea6f096d0a0047b0694d114e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7f27ce4f92a2f2bb0b04897d73b7874

SHA1
21e2b69b9b7199df001f2d17493275ee1ddba875

SHA256
a1895ab2e529af0a29771acd2d0dc3c0d32ac9a100cced92d2cffac670a787e7

SHA512
f7476ef322dce499574507e8aa667aacce792b6ce62d740e6b3ee37e5bec5a78b0656f78c4df260be8f1cc38f61eb6f77a769b66968cebdd22664b7bc4ff3fe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2ec1341a3954c350238874527f08ea1

SHA1
28bbd9e202c2ce3a1be9dafae72f3ff38560cbe2

SHA256
cd8646e5f577c449fbe7773a57e8bf3602bfd8a488069e05208cf148b25bf7a4

SHA512
0a8f07f09750b091b2fc40b30faa1067e12c9a0313b0af38420fc4cbf7a5de0b7136a7a757619bbf76cc95e357733140ebb057badb1f90c4c48ecdc7c1372c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9805bd70d2c8187f51bb3ad9e5d18702

SHA1
327bb6069623f1d033b956da0405e69b8e8d9bdc

SHA256
b46b9a651e783d84ffed90f25c57b9f116502aeed6e8d88297a9f1f4ceb8fb46

SHA512
192f4a0ade08eb10401c408e30783e3787b2a93328fe0cf8cb388de416551b85f4db5b2806b7b893589cf99c46d9a4cab7be6a9b7d39ced21ba9c3207dc3e9ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66b7ca3a633e4ec9961c9c56e1c7017c

SHA1
808fc31e878c5fe7b8e26ca99f1481304737335b

SHA256
6ddd2baa0886b71bfcf6ec3305cb500f8ecff3c4638529a9d81808584f83a575

SHA512
385f3fc5413c68a3b8ae16690ee67c4c7703f356473844ccf606824f4877c988a435ef34869c32fd0adb31fbc82a73ff98db411303375e3155c3b7a46043473d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fcdcf9b7e3eee0bbd83a091863b2ea8

SHA1
21c96ac9ffb82409f850c9c0e458ab9d1df78b73

SHA256
a67cca749d66eb0f03c261c0563d579bb6981fac5666b0a87e4273a63ff43f3c

SHA512
95fa913208726e677401a5aada8f055363f5599c48b764c45350bafe6aee06eb522d71c6c458bc59f84813a63a5b280c0a5a3e5c478b543042bd5fb63dbfa461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b767b7ea6e81a05892bb3cb9fa0b13a2

SHA1
95a3f512a5b30d2a7c44044c1f63600159864d33

SHA256
29ae1ba0794a379f46e5e1b5067945742068c84136a6b09939cdcc1092b0a4cd

SHA512
38ad197553b0a5ed050b6c36f9e9cd8bb22b2a58a67d517fb646a65fe310f4f249784f60ff9d3be4be8ec7e789ade6277691506f2ccecc24e816714ebe5deefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a2b7dd1d76299b326fbbc0a7b89806a

SHA1
cc51b67bfa09a4e573277ba9e2900ff2ee7422af

SHA256
5d085b7fd45ba739ac032b183529575ef9eacbd7a0fd28fbf1c24c4a7a3feaaf

SHA512
070a0e7042a21933357bf3a16f5b7c2683f16e2ff755c93f8f48b60c86b9d2e95326d27d47c01d26a61c32e19f5ca03536e8c9f804661dc1888b98a4438ddf1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdee7402a92bfbc194a5af4406148dd6

SHA1
1e7899b1dbd984e8ff5e06b2323da387326d80fa

SHA256
f48cc393715f17cff956c0a821ce369cc43fba7158b8a5a7a80bc4f5a71937c0

SHA512
8423bd65b30d4fe896a30e8a2a1b861b5f6b5bd717b101ee405611eaf20c6391738a086f341290cee4f809d10e194a2ae961b820044e2230e1fc688803a340c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_F968CA97A68F4E6D5C104EC7FE3DFDEA

Filesize
402B

MD5
e3cb65aa1ecba5719edc53c6582be97d

SHA1
96fbf2aeb6c1df9971e2a5a497fe9bff3cbd3753

SHA256
94d1d9672e0dc1981a50747c709d92ef864db8f07275b8490a3c296156549f94

SHA512
f9f7f162795ebe1b87ca54a12046dbc0d5627d5ea0cd3d584af607d0355d51eea0a7bb835c8f153a7262e6bfc4f66e2aeebac2e0a01b2a5a0c558ee5b49a7513

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE235.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE237.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit