01af754527a9ea955a09275b5ef948e0ae6b725bedeb741a119dbc5e1d53d457

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2e4067c8be55ab65bb7f1ac8305413d_JaffaCakes118.html
Size

4KB
MD5

d2e4067c8be55ab65bb7f1ac8305413d
SHA1

db2a44539e581d20e9041a3c8658712879ff2466
SHA256

01af754527a9ea955a09275b5ef948e0ae6b725bedeb741a119dbc5e1d53d457
SHA512

b6d342fa7ff7e2cc2ec1c73946f7b2a45bffa60d439458ba52a02e6f15897f2d1651d6c5b0786aaf4540893251b46e52d45773f46d3ae70f01cc65cb90bc6d5c
SSDEEP

96:Gf/KMJwtGjSwhc96txywJzYn8EHhZinkd3tKf0WMa3B3:C56cSwG96XywS86Inkdtcv3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000d57a2dde4924a4a828387dc5cc9bf6777a368b97c590439e33791aa9d2bd0ecf000000000e8000000002000020000000314c03c5cc39e5cecd6c02945e20253ff0bba8288dc249d597e5b27a199a0775200000002a079fad783365fc560663ee8aece9cbb8aaa335b3210123d75b62efed0e65cf40000000b42dd6faa06c3680e3beb3558f11136f82ebdceb62fffb2b12e6dc593e421148428ac16dc9cf538a082f1e6a3c60b3c174dd25936c78fe7b9da6dfdbda2e7dbb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431907034"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A72EF331-6D61-11EF-B578-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000a6d1970aba932938c3bbceada41bab1106147c995043e72eb2e531464b635c40000000000e8000000002000020000000d54ad864670dcce501eb22acf4c108601f4ec0089981b01732081cf5ddd954f5900000007c5978ad935bf13170b09f1827dc50ffc6c2ab6278370746306b94e6b054c4ec27b89a5e632615da5adc4a570140fc9275f1f440843b81992bb018569c756861ab543e68206a98278139811d08f12f9da765c0f78f92a64947514741189bc3174815d3c98cb4bdfb9e5435fe4ed5d5c68c2c038f7ef71abb1949b2aaade08db0d43d183bc3e02244f9cc9a89d1e39a7740000000d584c24a6163c2116eab82efae637f71a1940a448fd3690391c85e85c01e76448b48ce2e2da563e5eecb43f4db884cb122f49235fa34282ca9f423618a6b5afd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3052547d6e01db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1932	2104	iexplore.exe	30
PID 2104 wrote to memory of 1932	2104	iexplore.exe	30
PID 2104 wrote to memory of 1932	2104	iexplore.exe	30
PID 2104 wrote to memory of 1932	2104	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2e4067c8be55ab65bb7f1ac8305413d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9abe15fa116d44c992b1a41de809f9fd

SHA1
3c8e157e469dcf769c46d936c9ad56b2cef47f2d

SHA256
1c5abc292219cde8800342df9d39cb8109ebf3a544be9ac1f875d07bc02b07b7

SHA512
d628a357a3ce160da2d66b3782601385bac0e23ee8aa5e5940ef3c3f085d8eb4983b5bfdba67e9123fd34d09e4f64aeafc4044efec430307623cf865b482d638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15c50979d47d56e25ba3e2162161a58d

SHA1
954a8883115a0ac7a246c54b5fb3011228c6c440

SHA256
df86af1c6b9023592f54e774468dbf2bd8ef6873171c18cb1dcfa22ce3ebee68

SHA512
22a9a8c41d9efaf5018e70abffc1842b05d40bb94be03e1f0c8bfbb08cae763a57507545e99bb5335e3c8cf700b47204bba9b901e2e38ac0afc55b8e9d7bf88c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
908875d62ffff645e9786b8b1db098d4

SHA1
bff76eed18f0e2f48b73a4d6a5b9c6b77eb4fedc

SHA256
eb8a6db3aa31fadf2a987a478ba733919d9a9d7780b61a3abb902bbbf8181989

SHA512
7a46eb8bb26c630dc496e141954fdc8d98c29dd912911443bfe15cb945a377472cc5c57f58b619c7f086ac6be02f44387ecf5710024f50bc8e82839d1c18ee8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8551dabc3cc64ef7160c0186f3902404

SHA1
9ff6220dcf87b7011160a3957fe2708d9feb7eec

SHA256
66078082514dd5cc40015b60f5d4c80f5732bdbaf1fa26099b85540ab244837b

SHA512
a3fc641dda8a7b30143bb82bd59ea43f210d2f451944317c47ba055cec003d385dd9fcd24cb9c153be30ac401b0f40ff161387983625ee02f0b885b86bbdf128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6a56ca9d3718855db2854d575d602b8

SHA1
bc39adbeadba075b592bee14d3e8d6070af294eb

SHA256
93fe20ee76c7a5bee5ff238552a232290e0b166ddec3b8ff055944186145df7d

SHA512
471abf0e7ec7ee277b8b33a07005a7606b8433296addbb9262e7e1c3517908ac0d727c29ad90702e6afe515622d5fb221774694c9c0d54f437ecc902dd6a7a01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8296ce0bec94d0e858cb0e95fa121e23

SHA1
1ac616ff6680be1d517f0626800eba8d0f744bab

SHA256
b57dd5ff64179cb22cf85083b037af826fbece8de690ab6e8743a0b5557c34e8

SHA512
21de84fda55286d90c93671fb2bb51a785581fa807826f28a824cdaa98391be711d4ae48c4961fc9ffae18af0d077b3da488e2de5b9e577c9bd0775cc2eda26f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e16ae59a30bb63045200ff29c86cc5dc

SHA1
4a610cac9ecfa297370dd4152618e8434d5f96f7

SHA256
7e0484dcbaa3546e7b3ca4bd0a3b082304fe8289b787cf78f34950f8f81bf085

SHA512
04d85ea2097b5d020eb387c3f9ba54547b4df960853999f8eb844df393cd7523b367356a96311af06f382f3ac33bfa04286533e82a1ed793934a4128dea5dc3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f828d59c7a2abe30931e5c86281548d

SHA1
a061a1990feea7467324ca47c302457782e474b8

SHA256
66db93c5d9df4adb937ce65416e231cce2f18fee397ec1daba6bb0868f8ad8a0

SHA512
6ea4749586f503997979ba3afbd934c9d52f337b9b7656c95f8a3cbbb70233d67a972d4edabb907997e6298f5441aa74ede66dd03c5871df5e774252c4048b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
341ee342431fb221bdd84678b14b6f4d

SHA1
2b1a1ee63c73da241a2038314e0acd7ea61c694c

SHA256
f7fa7bd70d6601aeb3c2ea90a4f1228dbae0fe0a78b87264e7d0515ea6752902

SHA512
2cd84cb382a52a9b194af78f40424d52a4db87165ff29ad0edb9390fd1ce4b5fa6d80ae55becb94f07c1ac02b81f502e0289e2fbeb579fe4229d2d13951ba689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2d71040908b23ce8042b7b909417fcf

SHA1
402cdec8f23352d9f72755266eabd074d662ae67

SHA256
3b8691f3b59f2de396e774df3ccbbb23ba4910c337934e7c66f95ee6b7deae75

SHA512
d70cdeff9d82df5a3301a0555f282e6e56e2e8ec549090d529260ccb57a3ce46cdb27c6ef656ff85c8acdd1e76c1ecb7b5ec101f8ebe373d2d25c62900843db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a7cac950f3064f69ab05a04b34af9a8

SHA1
851119937d0e2202b35722dffdb8d8f36e20654d

SHA256
a62c5c0277c34bf89292b7ddbb135462a1ec2dd6a51e76262e4ce48f33fff947

SHA512
e2657ca1c5a8fab8ce2da5abd36946df5cc63944a02e740e45afd9cc9d333cf2a26a85890890dd4282dce78a4f6f426359a314a80a616ed0957de72784f86864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66ce14924e68076c3911c94fe567f25e

SHA1
d8b658cdbceeb9e678885eee998594b65b522422

SHA256
13374f76b9a6f34255395c6646ab4eac18a8d080d4cd8ba6c7f43639f58deb25

SHA512
56a85c09f79e1b601c0ad8d70f033c8218519bb9dc840c5a90e711adbe275cc232cee1a7b1b1f72d85f701f375bf977c61aa3bbd043bfa8fe16a43df6dde74f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF23.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF676.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit