490fa456d9e40ebcdcd6bdc8dd8278ee37648975e26198a135fdb9925118ea63

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2eead26baa73bd1c7062a549ad9d58e_JaffaCakes118.html
Size

6KB
MD5

d2eead26baa73bd1c7062a549ad9d58e
SHA1

c8de7940bb7fb345dc8b3988936a9af5abd1cf3e
SHA256

490fa456d9e40ebcdcd6bdc8dd8278ee37648975e26198a135fdb9925118ea63
SHA512

36bd1391939ef48243994d9c6253e919c6617456231f9c4d50c9d24888e07566449d78ef0a088c8e754a0a855d9200288f2cded8b6172f96815a4c7b81bd7b7c
SSDEEP

96:uzVs+ux7oDLLY1k9o84d12ef7CSTU5ecEZ7ru7f:csz7oDAYS/hb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000ba618b534dc6ddaa925ed7014f5ac2af840860726e1390eba60c7779ca313eeb000000000e80000000020000200000000264ec31cbb52c6b0fbbd8c6b2fd3a36c302241bf2ccdd384b7a102fb39c721a2000000061d05b80450b8691251b5ee0a2946e48258421ea9e65987d8ed19dbc563347c140000000db345c94c50869326668ce08161de6bd9d8256afbe356231e0b695894158cfdf1d4d32a2668368c8930a084c7b88a4474e894fb2f41fe1d10fe7a6b31f1767bc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58F61F01-6D65-11EF-A742-6E295C7D81A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431908620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d3182e7201db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000b779c6027fe6d7b0edcf58198af49fb6127ce9230ccb3fe2703e97b92e7db792000000000e8000000002000020000000a0d068251a0ada6b68fbcb6cdd7d93473bebafdb9d88c4747fd8063c545ee0b690000000de4747401be654d558a807c8287b46144491b003d8b44063336ff321d4fdb3970b4461e701af3746181f63c35dc3b4c1c4fb826df7ce2392676c6a06a14db995d16a63ceeb88c404883307b3a2d772d8ee9ac0c9f7ed91ea6a6e6188f9ed1f0a19827d823503ddcf511768b191214c1045849f0d4d2f4688c052d416365e5aa9bc2c17018cd7f0095ff72dca5e16fce0400000007784e641a959a3d5bd45bdedf87cac2ed5f7d2ab9021f364d893804e8959b69e038e1964e35047d7da6998dbfafedb120ac851242273da06f28f93264d5ce063	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2812	2112	iexplore.exe	30
PID 2112 wrote to memory of 2812	2112	iexplore.exe	30
PID 2112 wrote to memory of 2812	2112	iexplore.exe	30
PID 2112 wrote to memory of 2812	2112	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2eead26baa73bd1c7062a549ad9d58e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27d3d9a7b5cdd457caf4aa96bf07acab

SHA1
c5cfc5287f498f56dddd1f6c57f31c10d9bf4f22

SHA256
94a04aacd53ed5ed96e678a8a3516cd19dc5293cdee18cc30e3de776ff2271b2

SHA512
76a04ea6f1c01c3e434de57f79bade0f4439abb0a94a696a4974833e6598acc2112364cca7262e6e99276c019e85c65f4e6254799798ff1024159b62c5122d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34386127bc5010fce59a1882c05a8555

SHA1
b17d2dfb7e4e2f442993e25de63c18bad2cf7f98

SHA256
5378f617838d356537c2cc099e1fca4d0486f0bbf9f169f7bd5bda8175d9d25b

SHA512
d78ca6b6ba81bb01e532b4b012f4fa21fae1723318446d960ce0f8000257eb1a3c7c9460433d82e923f2a04cb4f2e6fdbcb4beb93b1d22fd0a92400bd40dae2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83c40a65cbcfadb348995e3312310eed

SHA1
696bfd11e9d4c2ace7fab1d76b7a800d46fc9545

SHA256
346eb96824836114e930fac2bb3addbc007fc79c4597d946277d2dd43f997766

SHA512
a3840f245377682c9e6f90de7878f1219ccbd5ddf9da68ce015f0b1e17bb16f80f31de9d39a7908a9f4cc38c3c4e2b56ddf6514c995bbfc3db29df683c32ddef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e8d4f6d25ae57fc85d48db47d908b04

SHA1
7d8c2923d3392266b6d6d9fbb1a05e3290fbdd46

SHA256
9bef8314ef1c4f226a210cc36fde561ae8495b29dbb0b313c81e9b4cdab37bb0

SHA512
c89931ec65be3b70fcb2b8eaadf71c6f10befd7198249b3a21d933d0044f441fac0ae24bd595026991d9346a30c33adf7c6d3731c6155742638c6bd339e088e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceb315f25571154665a8d5bd8851b250

SHA1
7c44d79854e1fa8b6245057161afe9a0033bc8f6

SHA256
57da7886211937d5f219132ba93e1792e12720db0b7aae599f734d133492bf06

SHA512
b13131a7a24ea11350b4be441ce84b28192f3140a465884c54dd22bb78b49f3181882186bf5789df2a82484d4d4b8a7a0817b10e30c1a56819fb70bdd8af8795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bac85add5438ac358e4157c19757d747

SHA1
675e7bed7499985799887724a51e85030f3478bd

SHA256
5ab05fc8b6fb276a3383b20550db47ed24711a9bd4a95a112698755ecbeab0a8

SHA512
0682a0a8c61bcac317e9dae1555ad3da67023cc748043ccafd999ec943493ec30e6330e0e621ff93bb0fa6d5a9f7ae28fdf4405a88a33c1272618984e40c7c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b505677f35fac015741ec1d0aafffcd5

SHA1
d50a7afecf6b6364dd63192afbc5c57a142dbb64

SHA256
6ea005c0b1923775214731f67bea7934ac036f8d54b93fb910cb01cec3541704

SHA512
2a584739d62576872b4c93cbeb21b559341fe0e730a335ee639a4deb4b2c1eabe99fd3f834727d8f501aafd7c7ae67f083f2f91ad43eccb7fb7ab69ac2b3124d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aacee7d08d17402a8272996c2cadb66

SHA1
b438cd0eca147f1ccfc33af74fdda6e63680b937

SHA256
5d9ede476745a1814103afa5697b71a0e5a3ddfa26f0a4dcc78bc80f784b8169

SHA512
752de8833d688f573ab303ffc361978beee33532a127196e35aaa5f77dd5cabc95205c1d779a998853f0cd6dd9ffff1792101fad9503a5ea0e5f17f32f49dfb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa50c8a2877f6976b6ab3c3aa2dd8176

SHA1
0488d8d7a2eb452f3e9bb890fee4a5bdb1e26bdb

SHA256
daf6b0d01e7ba0935b6683172c4454e2d27211c909eb1313cd755aee163a3197

SHA512
d81e58e320ee7c587296cb1fca2add432abaa63a897cd5abc6d818d0a8951e93dbbabc1e2d7548be07ec3e659497aefa07b372c926d9b3ea55ae4b604a3886ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d8ac46ab120213c6589ff85a0f1445a

SHA1
23762e9a7e205f21591b4e11d19036351957c5af

SHA256
ea42c4965f29069833bbf2575c6ba988238f252d88c0e8960ede50677b561427

SHA512
afa6bf699f9d6769c5109d0d6c518c2791766ca4623c2a2ba41eb1413df569eafc5cb4bd173a36a9e9fb50fb733cbd126ebdfdfc86704aedb6a834a0f4f9062d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c307981c32dfd9876b2e977412821a78

SHA1
dc8809436eb6a97f8658c26584444c235dad7fdb

SHA256
5c6fe9af94429ce92efc76a41a67c5d456e272dfa316e6c3b6bdce2671c5f2c0

SHA512
49752f603e2cbe618c6f902500916126a58450bff2c138b3dd8479a8219fe6dec88e85806bcc2918c5b6e04dc541cba762df43f35b758bc0252c3a001de117e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bcaeb7a6a3f3bb3556925773c6c943d

SHA1
9b218f85c63a1d31b1d009278f61d12a50b7818c

SHA256
9a4e69d46cab6f1356b4d8ab0fd45c52a93fb409d459080d833eeef292a5ed63

SHA512
7c191422551753b100b307c53a0be4f92f4b0f8a42d05733d80a267ba0198e67080261e57d7a379fda34c8b19c72941350b3fe3b209494d575115493226aa4b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f4bfa903ee417fea0d5d354c2c83846

SHA1
98c9cc60116aea4433d3b51b2ed1c8d00f8056ee

SHA256
0659e0bf7b161cb83609c2de4f22efc9deadb8d6a626e8963bb0a1dc2638d5d1

SHA512
1b14733aafb2d43276f831b0a0dd729f8f2b0692a2bce12761425e5f6d0efe81349568596251bb4a6789fa98e0268d3e37bd48497b0e658fdea10be8abfe8235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ff704d439c28ba8ef074b583c555139

SHA1
837d1348702934c73498964cacc921a83a789618

SHA256
9255f9a011e031a973786e289969f7ee0dd77a0edfd11afc9af8075da33aa59c

SHA512
ff8f024065d5ee925dc4e0f8dbafbf49b11484a89971f7cee5aa86deceb752fee639709cc0aba2aa2226064cfddbd2508cc74515fe7896d11a23e5e8af395835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c615639d1e6d5eb2d56a7ff192823aeb

SHA1
411567c33aac2193be625cedc2429618e5037454

SHA256
9a60737f1e5716c8c13774ea1831eeef05a14fdda269ad6cd65094b22f5197a8

SHA512
ad376c868363a99ae0908be94cd5b1e3ef865b9d972f5dc3c3af69f14240d715cce42d3e8c4b380962696342d53c9f85e4a5e4dfd00658057553c7d3d3133d03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
170068ccd701716f6067005f545910d5

SHA1
8a5a42340f0aa5e92ed73671759e11638739d66c

SHA256
006501b4ee922e74bf05f3cfed47011c5b8c603dd18a7437dd5039a23d71abd0

SHA512
65d2b2b0d5ea16fdfb71f33525fb388f4e9172f0cbb284206a834aa1e25248c0a6456faf3c6d6cc147fcac17a0580bb6d77b722072614f733c4c4a2a5045c463

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab145E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14DE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit