665cbbdda039c3d07c2f74f910a41d2993d9759055a68f4a0284251ba061ae51

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d00cc8a2ce3d65a918dfd597a8d043b9_JaffaCakes118.html
Size

3KB
MD5

d00cc8a2ce3d65a918dfd597a8d043b9
SHA1

2088992a5c0771b6cda2bae7d753622ae534abf5
SHA256

665cbbdda039c3d07c2f74f910a41d2993d9759055a68f4a0284251ba061ae51
SHA512

56ec1b83652a42d684f95e1fd606e33d8492ccd9ed406e34d2646b64a24a44124c0328f338fc76cd05eab6b0f0fb7842390042eaa2f0048d02b2ab30585c4ba2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1DB5151-6C73-11EF-98DB-E29800E22076} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000bb7b22d5e522fc328fb7b19ac117bbc4fbf546b9b892b0e8795a94cdddbca69f000000000e800000000200002000000094e274357e9b36ea8d78d9dbd10966e9292c72303d41aaa1b5bc05f243a1c7ec9000000095c4e6bba73d3c3be1933ced0cd0cbd22d258a93ab91545a683532003658940bfc87374e0e19bc14bfb6882680e53e3828494599fe13c70babac72f301e503f1675f8291e48b4615e2bf84cda958195e20673e0d633a19c4834f72083345a514045dde7919fd408f92eb64942fdd3189d0efd4b6446d6887d02f3b3ff69208ae657492069f4144f42544bcb0e6777aa540000000cfe08be363ea30dcb0d45ce997c537b85cae2353ec80934472f39eddc644fc33253969b96f6436d0a3ce584f0690f52be818f61bec954276a64895960ee9f739	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431804835"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b6b23dff03cb1319bff5eb25b19783e345139048b72d369c018d61890988e9fa000000000e8000000002000020000000ab3adabc252749447a4b65c39a7a52f85e17864444c5e860ab3d58f94803fe8e200000008e58acfef867ee0d80827f68c5fd3e75bc4256b6c2e6946fbfc3657700c0749e4000000007a67edd6400c9fa3ac7332890eb3872595c9fa4e7db0d81ceb321c343bc7141571e7f145665970021fde2737f8014f190a7b782d467e91561267013585faec5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01872748000db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 3020	2032	iexplore.exe	30
PID 2032 wrote to memory of 3020	2032	iexplore.exe	30
PID 2032 wrote to memory of 3020	2032	iexplore.exe	30
PID 2032 wrote to memory of 3020	2032	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d00cc8a2ce3d65a918dfd597a8d043b9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c50f92b61417c547656cf9d90e902a07

SHA1
80fdf5c5ccdda980eb1b3e80bf39e4e86cf2170d

SHA256
eb5946dfdfc89e3b4394878544b6aac5a512d7fce4654df6fa89771745e91741

SHA512
1bfec38fc80c697631a34eea7497769209b658a7014a2b93bc6a8b96ecb088b25054e0a282de018f67aac6a4ea33abe4dcc1329de1d5be35bffda59d79c02152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c5fb93702c1bde6ad083bae31f0e8cc

SHA1
14657a30b919a99b5aeb39d02efd91d5783db480

SHA256
bced7bb9296afbd722815327f40ad30865ba8c28a12c633cb80d399ac8f61d82

SHA512
f2e9530b91774efac20e9e08bc1c57d75ebdba90f5dc2d9cb129bd7b7bbb8d5f39f29177afa1de737480fb69caba2e867d2a4f5ef55d2932f490a86ff2196eff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b471e3dc09057001d2c019c2324abbaa

SHA1
4efe7797d040f8ff4bc8f533a42fc408b92734cd

SHA256
4f69ab27a71b052053d089672907ceb9c50a22793a4ff35dc749e19ecea49053

SHA512
765558020dfea8ac4ec1a8f91a2e94a61dfaeebc797680461a7bf85f5263ca8bc6cca59ae3274fa860158e5803aa7145ce04b2c16fd4fb0eddca01c1922bb29b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6305810963f0c999ab26e2d237e96d3

SHA1
9ff73b169ac735b85f262bad9f2a982a2bf2e674

SHA256
f4dd3040c16758406e98a469ac5bf10ffe9c35ddfcc474ec9fa7cd66f85ac7b1

SHA512
bf7477452afe2362b8cc700b973b1c36e1d6e926496cc8244e2931807333cdb13c1f87a3a54f247dcea560d5f67097435a8aca27fc82378b808b8830a92c4104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdd77068d3a7e748a3f3534f7dd9f066

SHA1
727bcdcd725045692646df45d72017f168e43d3d

SHA256
69f7d4d28f7c82473216d6dd7d23f1e6c623e72e53e6437c9d6dfc395bffee3c

SHA512
10ecee0dd244d4443c5af1d16a60db22ce25008c221379982af26fa2b314cc022ca90b169f154bc4e57f7641e294ebbda0e511645c48252cbccc5c31c009b976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cac6a4aecc3d518c0d89914cae16605c

SHA1
14a187f2d675b3389ad78ed26a9d8c671b9c152a

SHA256
c752bd3e2b2057d313384406a85c7016f6b7a3dec1b35c8591c5137076976864

SHA512
8c8ec2c1a747cdc59b55eb9270c0798bb93f04cfaa7df309b95d4632f3bbae91f0f7c0583836ba85919c6a5c1f79e9adea000cd8cb8503a3d650c9c15e6c3837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27a37a24dbe2c1e28acf504a3e925b12

SHA1
f490ddd9c86055567fd91adca0d0180a38bb7142

SHA256
057990599a1399dc7ae0b9edc1ab53fa0de12ba6c36d1b77ba2b82f70b5300bf

SHA512
24214bd344e40bb13eeebc4ac6f91419990b3c8473dc585b0580a6811e37245835cfa65d45f2994cd21b207b6dde0357add838b1a9bc04c909a558be1e745528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbc1ef5b57efb7c99b28c93bf25a29c4

SHA1
4d4152611066468b2b30e5172554339080b383fe

SHA256
467f10b3997978e1c652642d0feb5d1352fccce8cfc66be82f2e7ecb365ce18e

SHA512
b7aa4f7509ecb20c5e39007ac20fa347f78e9053b5027ada3dd902fd49ab2a375a771fe5835f3d3a80fa426f1100745c50cc066b1e21874644897b04d99ca5a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7f33718ef7291945168b4fec2edc871

SHA1
3987e9901cddf5632deacc3eb01f2a225db58a36

SHA256
770681c7afbd9fdcf5c9324a0e3064228985928a08e64c4bff7b63e39a9fd886

SHA512
5d6aa31d670a3dcd3c4445037ffb4ecdf897aa872e491b7f3a8509aef6bb759a2279e0845fddea3aa569e2d775d310604baf6ff168822933a50cf97aa1156afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08bdca1c15e19db0977a47b3f2966ee0

SHA1
372b15047730d9de45810585f8836ec369430188

SHA256
67f299b68a75cd4741261162b824bd13132e85de663c42e83c791f51620ca7ef

SHA512
b0a9fc268481a79a1769cb52878c98f9bfa349b6b0f3195fab032fa8a1ea673d63c051bd5367090b1dc59f71f994fb337199b1694034298435a8ee3fb26ea3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ef3f9430d0814723ce4270f8e93a3fc

SHA1
f0812c7d13e08df5bd878a25d1ae36218da0101e

SHA256
d0f358d319ef62a923e1fdc618a2845ac781fe4479c727d2d668ad7382e5fff0

SHA512
57face8f4f963beed3d05f4a763bec767dd3eb80d654f36dfdf8e2eb2e470c418bdd28e815033b7ecafed6da640f61b1ae3eb3652e832237b22fd6b9cc4aa205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8366d923531a322061a63b4aa7ef365

SHA1
a953fe90c3e6e1f4c477b65cc8c8c639a5186500

SHA256
0f367f9043b82b784577a28146176b1d5cf93e089881dd7e73e031d240983649

SHA512
b6883b91c56b1a8734d85751fc4ae44f9ece4c37651c66d690df8582815ae7314294138dc4aac04b57e0c9d43b77366cc4e902dd7e8b79a55ea1892e7b2157ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc25e8811ae379516055dcf9fe7d477a

SHA1
e9025558beeee1dc74d3ea011fcba11d45b9af34

SHA256
877aed4f75c66acf435eed3ce414839855f9e601cafab61e5c53299999e2341c

SHA512
f24ccb838b50976aec2961acc40d39dd14383e1972ba2963786610abc824cbc2a9be2406f2c11fac963d1cfbc2c6deb5cdf5bce76b84113aaaa43c8810002d4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eea89f077d69f5d1d763840da46f1d6f

SHA1
11704451be228a4dac00dbff3379c0a71edb6a6a

SHA256
58753538d9a4d29ca68795adaa8c802111b871de3aae4bd86906e529d290869e

SHA512
ceb2912470b89a2c283f4f8b7ff0872ad94fce78b3cd6ec898ac5cd11075182cb267e457f1304d10d91ac2d8ddcd858b71ceca395dd0b18641b428b1168cc5f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aa02c5826571f8465df8a065ee51524

SHA1
f1e0136a35568b870638e60a3e7447dc3c4460ad

SHA256
e21943aa4fdbb06a132f1a25f9b4392688436bc2f654b746d738256db2a234c8

SHA512
7ec73740fe51237dc4d8c2a61799ffea61a2294328ab48900855dcfd4ed4805d796e7f2c91971de71ea5b6299d5d04db223513f771cad21b56f00a3b2049eb47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d5b16439a561556ebdeda89222b0cdd

SHA1
4f45783991ab69854728099c422b3c42a956f500

SHA256
db59578f101920ed7d5e77bb1032db508ecdb499e82686e76a7c4cf2db192273

SHA512
85e022c3d39ebf184dd6c91865db6701cd35317a9cbdad9a363635606f3fbbb40be2ff9b84db253b91020919f890e12c6d73868ed3fba955f5422e1a05a530b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7593e9bdca1955f5fe78b0164d64b22

SHA1
9120b1b09ce386421da1ca6e732facc7c523c5b5

SHA256
3cadfdbf9ac8cc85b211cecd076e43c129bd9b7bc7d3112bf6281616916afc7a

SHA512
eac5c507eb8cf1d0e725c6944bd88d1a99f6b317672a12465308697b8dc53a3f8c82a1e52bf7b8aeb3b1b2dc3d11921a23010d9d1f872cff18b89b6e62339b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF193.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF463.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit