cdb1909b8383c7810655f61fccab88d04956ce857f81e94b29be2af13c19e218

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2faf0a21296ba38e4f99a6f2da8964c_JaffaCakes118.html
Size

68KB
MD5

d2faf0a21296ba38e4f99a6f2da8964c
SHA1

ae540849c14d6ce9e72005d20d6cd5a98d9f927a
SHA256

cdb1909b8383c7810655f61fccab88d04956ce857f81e94b29be2af13c19e218
SHA512

dae1ac1eddc1fa25427a661c3379a2a607970f6bad29a8fc62f8e32ecf9ec28cee16ad5b489cb95c5905358838fe2b39539922da0fb7a80f8fdf259f1ee6165d
SSDEEP

768:Jio1gcMiR3sI2PDDnX0g6DRZevXCJ7CTYoTyv1wCZkofyMdtbBnfBgN8/lboi2hX:JiM608TcNeD0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000346917b281a469cb735b90f2810bccaa45abbb16f109d9ccddf4f345735e0fff000000000e8000000002000020000000305aec5950851b271dcc03ed5f7cf25d3117c5c68264507d0c715ae8e43a907a9000000057661ae91706caf5b22d53b475ea7506b4fce0a4b7bd903d26dd03ea661c35bdc2ef54971a1510ddc58e65395b626865a63ea91713be5bbd8eeed2b305c91cb884aebf9a20e9b9094b740a580bd7326e4e9127869dbb5e390eb32a63143735b0c6b799545456b78759b007e12b012a081f89da9bf510abb640f737bbe3b23ec27c6807863130c26cc3fd9019ed5b7de74000000079686bf4261f1796f49be2eed0d19ab3f811c3fe85f2a0a0d0ae8759da10d76dae498320c341095cd2fc8bc176283584519f2a559e27ee30adc82b4b5bd42992	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{049E2A11-6D6A-11EF-8AE4-465533733A50} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402488dc7601db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000de0da8e2a1233ff1ce212694cfb47f912ed85d822b1b1f5e220d98a1b499ba6a000000000e8000000002000020000000c690990ec53b3aca1ffbeb98efed8f999cfd88d58dbb556dbb1aa4a04507d791200000007ad85d5437c8add8343aba6a4099170db60564175d6ac6147bf41ab1601698f540000000baabb42510431894f6169886cc77ce2fa97a874be1af44c3bc5a08ebed653f0944e3870ae31393ccd7cf1917c784e04599a5be2b553fbd50fbbb387c3575d9d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431910634"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 3060	1732	iexplore.exe	30
PID 1732 wrote to memory of 3060	1732	iexplore.exe	30
PID 1732 wrote to memory of 3060	1732	iexplore.exe	30
PID 1732 wrote to memory of 3060	1732	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2faf0a21296ba38e4f99a6f2da8964c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5934206b1add199a6715bf693763cbf9

SHA1
58a8c9634c385253bcd0ba5fd098c3ea03356d9a

SHA256
4837d548edd27d4fce45da984c47d377b8866b013c77e9aeee419121fdc88c8e

SHA512
8d7df9438b45fee641588c6931530996643c23fd9a34bab1baa9285fba182dcd6f6b7737dc6d56f43bca5d261e6442554aa178d32c2066ee2a4bd52a471ceffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0adc46341453495a82b4b15fbafa82fb

SHA1
442fbdd8deb054a9a9bbec847496391a4b39a52d

SHA256
dc7e821817156b1b36ee9bd3686f7046d12183d9b43d819f09a5cbfea38bda8f

SHA512
995934e4d70f3e4cce16ab00dba4396a97bd43609ffd35e006ca8aa42b036f8598b096a52fb8b566de49d5e1569f374b74c694a68c7a555fe2a7d075fba2ca41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
710ef448f51fc8bd8223344d08929766

SHA1
66170dad001400e992d40cb264b01b226d1b7ab2

SHA256
063b834c346eddc07f4c77a966f26421707ce988a5291de8cecd5ca145189058

SHA512
bcbc56570e7c03255f463674abeb6fc8175b0011dd993a16197340d38999da62970e3a93c6ae6b6c72c2042ea90fcebdcb282c09eb576b8888b84595aed2f237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8794481fc02749e6828884fff33da94

SHA1
7f7d5150ef083c539559501cf1b7950cb1933c4e

SHA256
fd5182547292e494a24129854c0f7e115681d7eeb925c78ea5273612a503e52f

SHA512
0065f84975fd1274e30e63fd9eafbaf6871a874528d14206df2fd6bcce30686234084aa26449e29ec822c30345f63db27c7cca886020a13a80f893b09f43f7ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ab88b06af9cf584da4a211cb618b557

SHA1
a6a905f9f159bb481f24206015a1f834e7305f5e

SHA256
257a6f6a1e33a1642fc2981b885aa13f75f20941df1ed7179b0875f8a8534476

SHA512
980e213d400d0fddaa15ff06c1f84779375bf63ed7e4f1f7d20075da74d2fb8cd7fd30463905e0f2699d06b6e97237a314bcf6bd99a355cde020dc0cf8a8ca5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69fcb69f0810ad5eb676020b7e4e8bcf

SHA1
9e58a44142abfd0978df1ffc7e74a24ab862f1ef

SHA256
a6c8bd798646666ac1885f8bdd64c18b2ded19b2bee95268847944635f9d8670

SHA512
dd46d93a9d803769061fbae6cf6938d337d712a994818e52f489503742ee9091e52e51432c5ed4f2d47e7fbd64da7460acc9410e033833c4b9898c2607494298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
034c37f1f1f6597a9d0d92051f437080

SHA1
c8b27626885ab05cb73fad070b70fc7f82cf14af

SHA256
670ffa61e455bf5c3ff8a46d517c79a7c72675a22f24370641b83f5734bd1b8a

SHA512
e6d446d58ac2f360ef75f44d4d8ac9a33a1969a0da46431413ec39b6856cc269aa96fabda822f2be864e6168473d235575f71a55c4ed8ff464619123d0593ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6439036610f5d9df4d73f9b3e6e81898

SHA1
95c669ac91142f8cf8c897ff66e6521c8eb3baba

SHA256
ddd31990119d964b9651f6781c5d2d238a220446f0bbe22486565a9584da1a9a

SHA512
be267d2438ab4154fdbcde6b533a4fd4896b20770d8e5b22d02378dd69d450bcd912f1165f55e5a9f916222cbf6557b209008c29bfac4fd32386b17cf2b9c1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45136bc9212fc60885ead389a27ac744

SHA1
db0ce808b1bad22f711259c8b8478ea2e8c12533

SHA256
64c3a502d0985902a0c73ca20a2f80a6c245946b210d8a6e41d42932ebb78fe6

SHA512
d2bfb9e54050af17a7fff808030a5c039f7f60be9715391883bbf3f6ea0e052470a9cf77ea7cba486dc63d173627a3282557dc9081ce2502266c8c02f9d606b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22a48f70270cdc848bc3973fc039564d

SHA1
80d6c61c693d737eaaaf652764c86e020d2c83a7

SHA256
00a43b625bc50af0beea1bd02e9a2489c12a695b44c80e5b8eb877c1794bd18e

SHA512
a67e1081125463944b89a8141c777fc212e0c3f285fb659ebe5f7706a2f06873bd4947edacdc2e89396484071d85f473d76076230323a6a3934ffea8789ad1ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCF04.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD1B8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit