8691d10c41817fabe989f44b07ed96e13c256e43cdc20165ee97e299255101a5

Analysis

max time kernel
139s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0d7dedf5f336d4086676d48f23dcdbf_JaffaCakes118.html
Size

213KB
MD5

d0d7dedf5f336d4086676d48f23dcdbf
SHA1

0f08c1a168a9ec54c62b5207ccd5894b487129d9
SHA256

8691d10c41817fabe989f44b07ed96e13c256e43cdc20165ee97e299255101a5
SHA512

0223f2aab2f0e6c3f894d08bb304f149c8666068c300ea029984f030b07b1111d78661138fd21a578fe840ca48519441dfd17cc98eabc4564f791a967f84014a
SSDEEP

3072:S1NI5BBBHquKyfkMY+BES09JXAnyrZalI+YQ:S1KbvsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431836191"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B23993C1-6CBC-11EF-9319-62CAC36041A9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
468	iexplore.exe
468	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 2708	468	iexplore.exe	30
PID 468 wrote to memory of 2708	468	iexplore.exe	30
PID 468 wrote to memory of 2708	468	iexplore.exe	30
PID 468 wrote to memory of 2708	468	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d0d7dedf5f336d4086676d48f23dcdbf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:468 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a028fffd425f186b77097e687cb3a821

SHA1
b42b87859e7e325113d1bf39668d21a578c92435

SHA256
0cc86f5ad20e1d0db5734584a8e82c9737fdd373f6621aed758e294a72422d74

SHA512
8bf91a9ff1891a9c6d65f07f00b6b95c588b199ff2ddcd1ee59ed4bb88e8c28c5da02880911c058be832a8832fda2038b23e8b1aa6143818aa57808676190bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ea9692eb1711c566d32dce1a9c2cf11

SHA1
178527f51948cbaa7d041935fa8e7767cbbfa00e

SHA256
cf77054f74be4103e65b560a7d9d678dcc9819b3212bd89f1954574f1d3907c1

SHA512
8ec5018993d9d9935f2a63d82d5ec3ac6e8fccab0bedf2823328683349cdd3b1b50bbc7dd88e258baad96f6bfa39b358d4f2c32fa7b846e9e7253d0bb72f14b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1868ec07688def455f90338bfe098a36

SHA1
ced02872e9dc8277620d0ef2323363bc2b426384

SHA256
0b00c6db4c673bee4c224eb3d234c61cb04c1a07738670e636ebd996f8fe5b16

SHA512
2f405f18ba04e8daf0dec5f6880f703f89ef3d23afdaeca9816d88d07c2c8e2f8419decfd0326acf6ed07f518ec1e645341c954e703be80706a09fbafa2f4841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99944d489fbbbe02532d9ef9c35fe7fe

SHA1
1df91ad49ae37ebe4949404004ef192097e2b06d

SHA256
aad55e8d2cdd88ab2d16efa3155e46b4d4e4870b2c67c5927f0d920b45440712

SHA512
b6a3569d7f3e451121b4d45bd28d2589ad9d96be467de3fc364e68de64a2cb454fb8eef7f74787bda6ce37be0e1a7863cfe35f79313587af37fa7c66841fab5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a6f7c3f78b1b88b064f603738089c4c

SHA1
54cc8e4f9b38df905ff749e204b296a03a66ecfb

SHA256
da467e6e4fca2999bc51ef8a1ee88fc52520800ea8cc75bc789742db72fd1115

SHA512
40a1a3e884bef838bfcbdc49b729830991176f3d8911f8bd4659273a29268d228d421f30d475aa122bcecfba47e597d47ce37554c1f9148b06da536fd764bd7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d076b691ec70f1ab74274c2b5a354c45

SHA1
b98011305013020b9cefc995dc0aee4218c73b50

SHA256
2192dc97a106fc98d85ab9dc7cb1f30b2aa0e357426c374e5cbac24874f0e07a

SHA512
47576c2143d6738cedcd3cd67cfd729ddd72425068ffe0c45be3b199263667c8c8e345a13999a1d5c2d987391bceda3089e65675ff9e29fc439bc8cc93389d36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38ed9e941c757e61f9e5c46dd36e6e29

SHA1
dce4a912109ca1486715e1dd5af098063cf12ea7

SHA256
42e8ab4b2d39fb6f48b88f02afe1529be44b81f3512dd3139f837eba40398eea

SHA512
72ad465a10010f61473a34eeac89fde7bd80f553281dbf25786ca559fd4dd7e467c84bc81042502a75456aba348a6343530b9a61294c54bf4757a14b564a2605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad542691c0d93a4dc1d920875d1a7e3b

SHA1
8f1695998369565ac3914a6d841ee8e6eb62c66a

SHA256
096b9dedd21e474032a91a840274d2ae16b1492498c66cd5d82041350f0b7414

SHA512
3dcadd066b67651a12c05c825e9330fcf73a7900a47afab193ed1ab4dab3d45e07d332df86f6f62099020298623ec3bb6989795e92f27843f38c9a2617813d8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3c56addf6cafc6e5b90b0e59205d759

SHA1
62a278dd3cb4c8dd73cf2d718d752d505b1c2842

SHA256
444568d038427c801acc0b88087ceeffb9214be5cdfe9b29670cb2e4bae6e2fc

SHA512
6a7f1471addf565568d0c3eb6d627297148959a53393d63f8106b813d2679c2e05eccf7afb3a4211c1cb7c3e316c6ee6d731ef4525cf9490de627344459a31c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6e16a393ace8c47db633d3b18d4034d

SHA1
50229eb2e0e76bbe5ad48bee900c8a4deda1d43f

SHA256
9b9345b1d4d60487f747d6763684f924e0759ed81b73f7af58ac465135012fa0

SHA512
6fba3692ab6b178420743949d420412dd77a242d91f47cfbf93232e422f04a2035dcfa8512bfe747ff4eaae74e472c0f81917c234077d6783e36700b0d57eee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4652018512806872081dfdd4b016c27b

SHA1
58a5a56e50f52580537f6e60a0b46f323cc8c2eb

SHA256
a74b19a68e41ce2b4c5e0f395e636219f71f247ecf8eecde282e56cb08decb05

SHA512
df8e46b140e9bb304ed57eeb2483294cdc648fd81e5784537c99ce71ed89ee18954109d7f71f2f74199a936f5c5933dc73121a6aaaef5ec701c6f299a616edc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98e15c6544b9ebdfb82cb24782713254

SHA1
38e0514dd91042d1871aa138a4ee1cedc006d5aa

SHA256
9ad5fe56b23f22ddcd69e557b3e851b82da035bc297a7f5d5f5bb3a697213cac

SHA512
847623061cb96845ea68357c3184ef0288137188b9f7e4c1e898ac4918d865ed44dc3161014ba22548526e23f8fd73f08629dfddb2a04e5e961d6822f959af5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f386cdec76988d3d997105fe0e50d60e

SHA1
b90b95c951e9509b4ff4b989d632634e207d992c

SHA256
968d621fb4fdd15aa44bc5e6478152d4100c9287613fe0f679116b9b1814f589

SHA512
4779277a7098226dfd2894069db9b0ba1d8f0072adf74ebffafb7d871ec981d8dbb7aa501271be56aadd41f82a109d499283a9f293de435fc51b64a541a82233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54fcf34a5b588d44ecc1ba00968995e4

SHA1
259aab4cfd4805d23d18d6b0d68f48729967a797

SHA256
be414d294b03f523739aac1b5bb063a5fc9cc438bbcb9406de7c927b2600ee89

SHA512
3ecc7cea0d44ebda91908e4c6f09ec7638523300db4a9671fb175b879c632e8473021ac83d41392565207e11d10d217ac274292858c04a8281136c6b880b68e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14cbff5571a18833f925809a1f1d6e01

SHA1
e028ee0a32250fb784748c9ee961368b6d2ac8b3

SHA256
fead1ca4c9840a0a7d58dd2e81d630604b6e176b2ea1a4a2ea7a0d767f45e41c

SHA512
61bd4cf4bf31465d8ade5267ab0be055f58f76d781c55dfa83a862f01521d461df3500999e3b9f19fa8bb4e385b7a37651dbea4cd13608c9fcc4c7dde34be43f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38bc2b5de2165f467b45abf00c32c573

SHA1
0c9d2b5fb581a4c30f6500b6edcd90babcf586e0

SHA256
a138355c8866fc18632473aaf7c460f638a1ebd497ed6d275b5d60f8b8db1a06

SHA512
bd3bf3816ca12f1a48cf6aa35be3965c860ed8cb4b95075bda3885e94f7f2ba233179317be49f0533fea76a7b3282a99de036c404e18187d118c55e5bd2d96c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
736c413947b91aee756b538dee194f9b

SHA1
b35ce56e327af37d8e6a56f2162a065fece5a860

SHA256
2416f937c8ed0cf87831b7e531ee89509a515f0224fde6500d4d6a35bb13c948

SHA512
0e7a16d024d7699e866a30b095578e172054a301e9104be947628edad14c378e8e583a5aa6db0e0edff09b5061acd2bc907a330078e87f2592db10b5c1bbda88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef32d10d4cd182a7f6026ed643fa479a

SHA1
0b32cab171504b27eb0e85c15931de66930b979e

SHA256
6c5c32b477d07ea3a79690e5d86dd484b5acba7222d701dbc0becd5195da2181

SHA512
62b51e478e2f42e9670c5ea7a47d419641abcfaad2263be1605843aaf74f94baaf25aee2cf78fa6ec559821becf505956cb48ff7e1d9f23175fcc7bd39427d61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8028.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar80F8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit