f4cee6c1e3e8c2b19eab8086ab6a3a8eadfdf5c6d444eda7fbf62fd0035a8bf9

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0b0dadfe1dec8870749c6be7c3cf992_JaffaCakes118.html
Size

204B
MD5

d0b0dadfe1dec8870749c6be7c3cf992
SHA1

e51981995cd83539b1a2c0785a04d4e2014d3082
SHA256

f4cee6c1e3e8c2b19eab8086ab6a3a8eadfdf5c6d444eda7fbf62fd0035a8bf9
SHA512

eea07a68cafab0b6770cf950682c2f202ed34928404a77057d519ce08a8489897172812181bd3f74e81003249da990bdc4720a8eb19a43ca3145d34c85de5158

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503cf78ab900db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000009cbea96499bf24bc78564da160d18af1e72f07e26afbd88e2bc4f8dfd36587a5000000000e8000000002000020000000d660ed1955d3224cb47f751f02a5e7baddb5e4c17c1b1edb72cd2764a4b168d820000000a7698d8e0781052c66d57397fc5b7ccd5eea6845ec5aa519ca68056a501c78fd400000006b1a4e9e65ef46eaa7ef1d54b6d9af6126e4adf854d81ce5acc61fc5023958e2d5e75fc433389d91b0c0d95f414b7629ef0a4d85cebc843620dd4f45bfef9cb9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6740C01-6CAC-11EF-969B-D60C98DC526F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000009e24433bb77462baae6a130602c9eb78f44302e12c65df7abe9a9d733cea057f000000000e8000000002000020000000c4127297972d80681f4d4b7980003491db832f0d2a47cd8dda5ff4ea91cf2e8f9000000009738a49f9693497b8edb6e4f89228fe4339c0a37225a383331ae1cedb1bdf5ab5f60a8c81bf9cba369f93be482073fb750df72779373a7b3034bd77b900300a3680cdb60ae6ee9af9b8c7a0b429576098d79f083ae45023562606d7563304f1d032e274a49e3df141344c403fed8d19ab0ba0ad1a6eb363fcaefbbf349819c4d4ca4a161b33efb041b3d3900a961a58400000001e9c057bd4e1fc15cbfa64d818fd6d195498942b1ce4e4005d39135da867af369a8b41e2c18be1326e89c7144700831c832074b316b203a5c630da883344b273	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431829324"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2816	2648	iexplore.exe	30
PID 2648 wrote to memory of 2816	2648	iexplore.exe	30
PID 2648 wrote to memory of 2816	2648	iexplore.exe	30
PID 2648 wrote to memory of 2816	2648	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d0b0dadfe1dec8870749c6be7c3cf992_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8c0b84042147ce9a29c1266d16b7b0e

SHA1
e7bb20e8b80ba6a6eddeb9f71359f53a21de527c

SHA256
d14ea66c487393940214029df6cc0dddbb72e86fe9eec281931b60f379b07020

SHA512
a35426aa005b2ff3d84dc1ba68d4b17384dbc08e7f4e6844436da66db16aec1a74a0e87a7056d0686acab4b66491310fd792876c92af4b91d1078796309d7a62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80de84754c1f33dd8913ee6bcc887a4c

SHA1
245970aa8cca0441a19104bc3f8843b2b6cbeeef

SHA256
fa2609a5b849690050f206185b91777beeaa45f37ef1cf6acc1da3cff9f15312

SHA512
56667b06f4304ed36c9cdaf8e80bc197d1668cb8a074a551bef4be5d27f99890cb722750b3bfd8c7fdafb4a775818378a47f1e919ae268bd7090c03e7a9a009c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e4dadb12871dd193a4204e2789f63f3

SHA1
b6add395d2e2e26a20702dbd79dece89bc868ac5

SHA256
8e9ca7d986971ce00e6b495df408be3d9e22110e6d42f8d2ddb1dcec195eeacb

SHA512
27d1d509fcfe4ce7b1120134b61ae288425b070145da5a28f94d1ff44a5acbe0b4c9f41c9b56de301cece173417dc71a1c4d512ba70e00cee7dec090730caa1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d817f6e2d58f6805506f2d340cbcda97

SHA1
21fbc5203cba6d2b54dc1e994381a18d6cc82762

SHA256
93b118563feb7750e26d7da4414ea934b48ebb07279b5e20f99c6fbdad7e8e8c

SHA512
1b6c0d2820f45beb0c0080df25c19f34f16adc52ed7ce99b5398259e3ea0a9386e1efc460c35e833b928813d5b881235afdb1880ffa392697f275cf791fec095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d4659423265a82563ae318ad5f0ffc8

SHA1
72688f36426bbd3e20dbb21de534684d3d85fa14

SHA256
316b9aaf7129cb2989cb2b1031982d0f9bc1b1fc6e6734716099a2e261c03de6

SHA512
f3efeb9db44db0b6a3b9b8cb8b4fc89141268b5b7c43891fe3f7ff6349183fab018c1bb3ac7aa154f9801c552d75b1435b2fb957367c61d643ece449a72058ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dad10dec4ee38d188af80f48ff755c07

SHA1
08d3cbbb74ef6d77f39e1914746eb188e06da961

SHA256
47fc9393c617ac3b659edddfd8173b6ebe536f06c3b1e4940810a02b203f1a9c

SHA512
bcc53867f25d4a8669f9972bb3b27a040216bef3ac60501621ee5f0d3a42909e6e1e61c6e4611fea79d03de0a1743e8599ea40a7b554e637a03593632288447d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
666dfc77502330f113e14f4226f1746a

SHA1
87c45e3569e9bb541c0069084746bbe8dbb44154

SHA256
a00d919ba3af867e172198bd7ca49fb75bbb062cd1be5660e94242ddc40d8be9

SHA512
1e11608dfb6d7a18b28a1e770287a8424d1aaaae05247cca4d47f2748fa6ae47ea5a0ca87452725b28cb7c8e16294b1a4cbd08b408ab859c1534343f5b824cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2f58223da02fcc2a8c24b19cc4afb87

SHA1
aebeda969a19762668252dd3c6300ec5f530bd79

SHA256
d3313c3bdc7d8d39ccbc2a54604940b43bacb479501ac7647cc7bf568e8295a2

SHA512
e5fd7e831d493051fd278924a850260382df77fcbf4729849d6f061242be527a18578bf22e019f9e67211650a7245fb29f7ea285fca51db52547301536ea2f23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2025b3c8a85ce8b65c7df348e901228d

SHA1
c8f203acbb8e16aa61469ee20804b3f8dda315b4

SHA256
3d1731542f7374a1bd885e2ed1e9f8b974bdc7e69bd44eadcdcac470df749021

SHA512
4a6cbdfbda05a27b579d26f73430ab384a3ebf4e53a041253e6a7040c5b055c6811853a5ab0c900bd7fb439a9d42f811f13b3d26abb85dc4d566980a9b86eb65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f90db7fda5469175ec483af614d5987f

SHA1
c711b167b1f3990afbaf04960e31cf3d00f3a86f

SHA256
4d9dd305390eff23ada6eb4c9e3a800c702c4a4736eb1c188fd2d3d741a692db

SHA512
64c49a90a583d3321026051d323ed2228111ab6fec27d2158b8dcb31003f092e68d2ca11e83fe96eb0472dff25712067685836df7bd90058caaf522e2e7f0b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05ef10b1ed798f1c4d5838e16efc3847

SHA1
79f3472f6a46b26937d811c26d37ad04d91fb5ee

SHA256
596643a751bb2e180ea802d0a63a1aa102f792f1b21a7a7691fb016c09aeb230

SHA512
02e836bec54de1b104493900fb1fadafdbcfb2c269c9ca5a01f70a6500a43ab22c8bb80bb083f86a14eaf9bb33cdc715b3787324a68e5fb8acfd935ec90ef576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a055fe3415a5dc652b28425c2f73cc13

SHA1
90378f2854626a3717eedd9a7f491291e1583474

SHA256
e49b8d94ff655a1883bdc4dd05fe3fd1bb64a72332eac33e07e2a17ae59c0325

SHA512
ff6e2f6c84be2bc5e3711cc34d4e1e0517d7e86a09e774ad05eb38f3702512aa21b008c5686d5ae40d71a8fb7d78529c935f3a1222777d3b60586d2d102d5804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c58d6282266929c9e04b636e8dd44db6

SHA1
22563ea810eca6c61f5852fc9f65a39796945733

SHA256
a5ccbeb362dda9ef872e3de56c43a753f913abbd2c261a6ee0a738f4ef475b32

SHA512
02c8a01ba13ad27165694fb40ba5bd593648befcb332d362c5efe24bea4cc9d6ccfc642c9e38b40576138153b110504862a6fa8bd00469f62a4a27cd7a9cab76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9176dc0741666def0f263bbb794a3aab

SHA1
f9406ed3c7925db58ce63d2266b46166b569bd38

SHA256
f34a2ff129448ad8fb1a83506e6807568f18ec58ca5fea87d971c6c33cf23ac5

SHA512
6f73ed833486335f8d9cd72528c22ac1c76dfbb95580eb3b27c021a835e7a04656c393314eb9c15ced6063690306fb540d5e31b241b63b8e47a13f1788ba00f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6676dfa4b5ad2608e9cd479bb2bb0e9d

SHA1
b6a5a60b2ad2dde1587b57590c751463cbf9bdc5

SHA256
a40f03559ccc092512461d70bc442d5afe1b411220eb6d395f5bd8a911c2053e

SHA512
8df65c5544370f5fc9ed659b93ffe0247e255860cab20507c7eae3ef90bb10cf8a8661a6ceec7f8e17763236256640d9ce8bb75147aa901275e49d384ef41e27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46178c25da16458101c82b142f2de9d4

SHA1
d01a87182ff7887cb487f63f61a30bea1573efda

SHA256
b5751ac93a35c538e6511f755896d335b43f3f254297c77965c1fa7fb9841498

SHA512
abfe004fcc61ab444ad03e008b8018700d40a600d451a1deb675baad2536c6bbfa670a4e4e4f3ade89905cb6695e0c7538ed0ef1d1cc7ed7fa39e1570eb90a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e3003f5bb0e15518b923a252b393db2

SHA1
49684b9630c5a471bb6e5b4e4108e6974f4943b6

SHA256
a5bc6ce1227baea8deb6d2448a8c498e40f8a1cdc8ace974a96df95b6edd9e43

SHA512
3e76ac35f6abd5ef734e7a1aaeae614435de1d8618e9cc9d81b0f4ee057425efad8d03375014273f7b478aedf2b4d57a62da06f99cf68a75f7d6aa00e1958c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab706.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar776.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit