5f7ad4d5b26c939065f39d4fcdea457860de7fe8a4c0a0a6290824431cbb55d2

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html
Size

46KB
MD5

d2e2a1dacfd8688c31ebd561f544b063
SHA1

2a2d7ba42da0658c1d3f05ca95beb4b84c2dba4f
SHA256

5f7ad4d5b26c939065f39d4fcdea457860de7fe8a4c0a0a6290824431cbb55d2
SHA512

7923e2cb3f97b690bd32ac19180b33861d84cde9021f08f14567e82771f9a807277328dcbba4b51c591ce725b3146380c1d76148d7b6f31a3360686eb6d9375a
SSDEEP

768:PYruvWWl+WFGWXAIaAC1Nnh914eIaedgeP+4tReD2qHLlZ5z0i5ljeOK1fa7Yt9c:GuvWWlSWQIaAkNnhb4eIaedgePqv5ljZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000004c3c690a8820515c99d2fd5b9b82c90e1d8c51943e3ee6589f5318eccf4d7c62000000000e80000000020000200000001646270481adbe147c76b1e0f29c281ff807da6150d46d3af1af8dd2d488b7be90000000fcb69b96ab8d6c2b35d969e2526de8015c9954d1aed1472555ba91778918b65116ce2c985f2bb9218061575e4e22fa31b5a8a28ba4f891a6e3fd3ff0e2818f1513306c4d27e8e02d4b2662e686b8b88f9a1077831947dd199a2f8851c07e264cf63d7551154f5969c8b04aa42796b45bd010185aa1cce88463e325e117c69601662ce3837fa0d34295e5d21ae4d07a1b400000005429e3b75b2ec09d539206a3917ddfc55db3752c3284ad6a9b8c4393cc2bafbead73e0e0883979ba25705fcbe2e24425fc07fc2ee0790930957ce8b8e59baddf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6030631a6e01db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000286f491cb07ca866af84e70aed5df6b7801808dc21c0f68b3a711629677fbd0b000000000e8000000002000020000000b6c9dfbc37cba87cf0b5bb7885a5eb3a4b1c9c90645833174e963aa5b0ad9a9120000000d71fdc1cfe2a348375d294033e7cc004f280baf82027d47c876972ae8d686d4e40000000076d7af303864ac073d85211195d3bc679a268a78ffa45f300b1d56086852459db5b050341d55424ff5a62b476737688cdbf68a55f008981e3e656088dcbc5b5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B249051-6D61-11EF-B1BD-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431906863"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1788	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1788	iexplore.exe
1788	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2492	1788	iexplore.exe	30
PID 1788 wrote to memory of 2492	1788	iexplore.exe	30
PID 1788 wrote to memory of 2492	1788	iexplore.exe	30
PID 1788 wrote to memory of 2492	1788	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1788 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef89a4eaac675087ff320713c2f99874

SHA1
1a858c214e29e427476a8921fb619ce52adb47b8

SHA256
945434d6dccad99ec788016b46e93b84a3d1b248485ef3853a57c1f4e40698d5

SHA512
3c619ec4cc6198ec3125b495cea8413f5fcfef533d7f33fd0b57fc551eb5a5f69e3b2c2e13428f6923659a6e38875568d470701b242611cf310c9aaac2bbf718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
add3b196957c2027208416233d705ec2

SHA1
c1d1e0cf383abb4a47d306c463ee0284ab39a375

SHA256
12d7a8a6673e1bb9b5ec081af15f2c9817ef3d04096d2d12cdf3d99442b6c7b2

SHA512
5a980f587fa408e56ea01be25297e58ac0cc4cfdd16df8ec7b284b51c5f7c5c5014561bb76e4434b6985a395c9a18239bbff3ba4ba7adf152e5d31e411a92d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d8b2730bbd6fc9feda600af02981374

SHA1
54a4519443b509a665095fe728b35be62f1aa950

SHA256
d0f7f0ab2e928d143ea787879d294fd5904c4f220b59641f0037c373b4c58852

SHA512
60b84ba338289cdc2851de49268ed6ef475be189095626e1fdc99f4e0fd55162b679cf98dda883e895b815420a8b8b5d2b066a5159e07c6eadf06a51a060d294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb7c6275a451724a17251f950cf1e426

SHA1
0710fb83d15ad1671f5cd896d4ed92723c45b0a1

SHA256
f24a478b4591a80b839f6084ddd3b19e11bcc0898183ac86faa8ff30ee6b2331

SHA512
060dffae79979ac1e8541a883c4b7ea478674243d47051054a8520a7db63b0a7665d78fce17f191fa64486368482b7ce9d6fe0b89dbf50b1e681d1c939eadf65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4d3ded8545d8b189533522c6118ed3d

SHA1
9eb26dd9a6a9a51709fb748ec06fef826b0880e9

SHA256
ffe228bd81667952529e390b6fdb180a860130be63db86aba3579e886fa693c5

SHA512
f755bb5c6ce46a8f418983926fff9e5090d1828350a01273921aa03797d409991ea2d8affeda4e6fc415d39c1d7c961ac6de82c57f69e166a8c4f1ce878087c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d3df90e8bdc6051954777a6f8639bef

SHA1
8eb0965f3a3b42897e18fd6475498b98fcaabf7a

SHA256
5569ccf95006e92aef73c0800d99417c4077215845847abe83d67a4fec613e61

SHA512
8527a8998a543a6928f62f1d7d6a8086cadf1bc6b7a8c806c4d91407795765b83954d0cd44c627f858a66f2db86a6a10607cf3c531b0173bd19fe2daf621c5ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e10cb971d7cdb7e7d2a82b068cee0c8a

SHA1
5df19baa2850cae4e6c4cb4a14cd5a9fd11077e8

SHA256
af5948d073770c15e79fc5d4406efa832574a537f0be608ff66d8a05658eb736

SHA512
4a7b5313c2361a16a3ad1fea6c18957b973b84073355ced2c80e0197ff5b55dd27e3eaa2cbde5b36cde0e68b569b8fe129929e2d4ea8a95f0b133c5c901d2961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0229160b95048f3162441526d643f7ed

SHA1
5506f3d4b628901eaaec308c643ac4316a64386a

SHA256
fe008541bf449e3f7bc68a8413fee9f8dd027e8a825dfc409d7413af417a526b

SHA512
722d31a3ec0eb47f4e202a997a14d2ae7d8af19978d0036ee99a53f5b914fd0ba2b8cd1e49ad4650075a39aa35f82d8e48a2d95c975881a992885a585bda8136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c081349e0a3c276936d8fbf7cb3a9f9

SHA1
aa0c011b7cd51b64a7ce2270a0273a69706fd6e3

SHA256
2a1b6ce489fef827c7d251eb4a21d60a74bd35e0b033a6b03fb38447c385db31

SHA512
b17b61f0ca93a5b742df99eaca9ac9ad5962dba9c6d6aaa7d62d5045049deab55e714c075eef9f8d5136faffc028710a76502fb0bd7ef80b1af4f417f3371b45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a38d538a6e608452ec26f2b9b6051dc1

SHA1
14f5c162ac578d5a71ebc38f75ba6422407b24b6

SHA256
6a736f3d81059e9e985b9e5e739881732f8317dab97d465343fecd74d510b598

SHA512
9bd95bea87465caa471494dcdff28e0e58b4083d9b0f1be20677c9fa6af3167daaf6c2567e1987c278173978db20580af36439afbdf0a83fab4799ac0d3cf163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
deacd2480a0d280e7cc9f07f67910769

SHA1
59cae93358c9d74f5ed1dceb028438e89bb7d7f4

SHA256
f3063db4f51b06a56daebc4ea376dd1d03710fd320851d43d5141e4b3757fc44

SHA512
d2a0efba5d406440a9038591a07829ca8202651a5ad3d7e430212f36b946a0222d25e512ca33883ecd0c2f1166f6206fdf77f20e151a405e13753b17d4fda4db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8faf7bcac2bc1e5871b945deda2c9ed9

SHA1
2df6dd65e8c5364f914fa528cf32f5fedd45e829

SHA256
a2d8d03c195312ee48a2481dbe806fa9d5bd2cfb883c7d8f1f1bbbcd631c4b1b

SHA512
81eaed8f7ae4408b873bf0e4afbae1eddcd7a5fc0f0e08ee7eafec1e278052b30de6de4b0825bd5779e3da5913961ca437386e58c24eed18e4770eb771dcaeea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab734.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar736.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit