02c959486c854b0ac3730519f4952843cf77f2fbb59a39989671ee4d3e98a190

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0e0116cd60e0acdcd72d5b819ff1389_JaffaCakes118.html
Size

22KB
MD5

d0e0116cd60e0acdcd72d5b819ff1389
SHA1

476727baa6c3ceca1d4e8853d143537b2e7ffdf0
SHA256

02c959486c854b0ac3730519f4952843cf77f2fbb59a39989671ee4d3e98a190
SHA512

3fe7823593adcdebd3e2f55e36b645aa2feee3a4742d4917360fbd1388c6828c90f8e1d0e9c885b823c0eb82b6d779418cd312a1228bf1de0d03d6776086e8a3
SSDEEP

192:uwrwb5n12nQjxn5Q/wnQierNnunQOkEnt02nQTbnxnQ6v06J4RnQNjMBLqnYnQ7p:8Q/Tv06ktC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C47A4721-6CBF-11EF-9CBD-4625F4E6DDF6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c14499cc00db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000c8e96ade1b6b7d95470843c5e654a9822e0a8dd17bc3478d1f33b232f1904891000000000e8000000002000020000000516c5bd18c9c3ccfc3e78fbbf887f1d44da1d51ebbf5f980ed13f4a6dbe42edf20000000917c1d89466da2eecd8df3e48f3bfa9ca8781180df2c31c6222920c7b303129840000000f0648316304779ace4fa106914b97735003f2b98e58392bd19556d2b8cfafde4d37f0879f741242cf396d5dc46cdb97fd73cb2dff1640e7a5e19d100194055a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000beaaf5f5f437f50ee8029234560a8fda30e3cdb056725c7a9d863ad37e081e50000000000e8000000002000020000000bd5c1b5ebb3485465e05592ed0a2a1e8f6447eb9d6251c51070d9f6e2c7440c0900000004e769868f6ef3b505fcc7aefe13774bdafc82e26eea3d428d657cd9ead73dfebad16b8aef223a48dd92e1cd8c4fb92572030da736dd0a910e39697321c7778c1f4a660866ce66b768a377994d10a9d90164f077bf53f727c6a4428817de50c5ff61fe796c90b4303987f59c18d5a160835b1a9c3171ebb4765dfc8810272be633f7294357b6295082238e078ea09eb5740000000c216c0cdc4411a208f91d90e244bcfd2f28486e81228dba02bd7c4de1a4859e2cf024c2fd64ccd31b6396376573a427983ac3887eef7d345ac733d6e0a37c818	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431837504"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2564	1628	iexplore.exe	30
PID 1628 wrote to memory of 2564	1628	iexplore.exe	30
PID 1628 wrote to memory of 2564	1628	iexplore.exe	30
PID 1628 wrote to memory of 2564	1628	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d0e0116cd60e0acdcd72d5b819ff1389_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4e91815942186a323a41cdc2faf54e4

SHA1
07cc3d2addb8eba35e9753f3433435057783ae4d

SHA256
c3124ee35cdd8a84e36cf059ba1901d99006f90fc5136f961c0137bd4407b953

SHA512
b27be256e3c57f1042a12e5035fd50431cd1701ba96aae5470170ad284440fd2d55f60672b67bb3f5654b27e0d6f67b6294fc8ce57c36b2103b21d20de351515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db45971463618b6fccce166f7c193430

SHA1
9dc748b1c48c0ec2d47238d825ac375811f9949f

SHA256
6b1bcbb34bdbf52d60dbd7996013f02ee0eabfb986a3650f14fe366ae32380bb

SHA512
e40d41471e649483680b61469457999d9a908fc3e258bc661922ee8f4760ab2588b70c63f0d358e9b851c98be27a138c8f20ab4b2c406da46578053e6d274fa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f74984a7d50794fb602a3e7d25edd486

SHA1
762998854627c346ccf89d31627dd784654b40c4

SHA256
d2ae0f0fbf3c86f532ae0d1bc9dd34ae853049c74f78856e02acedb2dfba40b4

SHA512
6ca05f26e982fe7e157d5350dc9ce90e2e1653e31baa12a3877fe95e96d084f5098d3af4b687eb76b44ce2eb0c86b1f6278ec9814d31f4943956714cc6bedf7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd58ad5c89a95985ff48b683c98fe7b4

SHA1
52277695b12158955efafddf7a43b84142027f1d

SHA256
693d9d5f2ed8ff344cbe96de32da49f4245aa2950e7c1db4511c2c1693100664

SHA512
02fe93ca2431269b8ceab4d51d7ba84c4493f81062f31d19dc5952226b1b8af7dfa162bafed100c402c60079405e2bfadca05524354f348dfd12278dc157087f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ec5016707e3f373b9fe02a3a72f04e2

SHA1
cd2fd69a2cc97648d943f2d91e7f407edbe03e69

SHA256
ed6dfe531de6217bffda17d09ed9e7b4d7c13cfc34198dba971032f1b1c81afb

SHA512
8c8e413805df54942699d66875d472676421124f96d8fe3bdccf8e10f0f2bc414c7c4a6280d4912cc5995aac24180b43f71f29c499c9fc6003a18f53ff9c6ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61fb1ca015dfbcc7d2ec405553ff7574

SHA1
fb50aa5ebc9932f0eccb2195cfb71a727dcc698c

SHA256
686ac89a9dd2859d2d96a423cf506a2babb6ed904e1f13f9b061169974bb7692

SHA512
29a50bea7f21ff6b14ccbb2dc87e77fda68d267c8731860eb35bc2c633c37dfc10ad7251b52f278e423d42934d33ce4d3512c97f232f3f75917f4719c9c37397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d395ed15003efd72e43d25182a356345

SHA1
d9685d9c9b58f7c3a53510c05b03e05588ade528

SHA256
e5854ef738a0b4f830bbbac0b767b46d531082ebe07d79389cde8065d148bca5

SHA512
7c5299612cc0bb0d2e9b8739a32cf6e31e462a1df50ae85f07f030219df11770f94fa98f692f627d1c94036c3937708f015c40b4208f8f0acda030c855b89508

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f62a47ff5f04526b58bf23251248a345

SHA1
336213a5a43c7921c844f7cac6d56de9cb0b3323

SHA256
f185877c1ec3213a8de4e1512c8224b8a8d9408b5b766d129a2eeed7af331bb4

SHA512
83a514ade1c220190cdc31660878de1cd8272cb4f8e56a84fa1a517585aa9380253fdc5f0a4da8a1377dcad5053b5264dfb62447bea2be2d4d645fca03adae76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7e1a071ad8d74da0fc203384deb91eb

SHA1
1dae10c28d8c61bdae12b0d3bffdcc6a3bf9e958

SHA256
1a37d76672c7522cdab8d72146d1d0235adcb3755f2dc3a6f60cb86ab47fcf1a

SHA512
aff3ef862fbbbfef7e52020151d93f707ebdf954445b1fa10f8af2544be48aa825055a41be65741d3e1a8cf47ae0127aaaacf23f94b140d7773a43336b824821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
065c1057af0bc54a2129b171f137524c

SHA1
30181875b544eb34de91cddc1ef2dd540372da82

SHA256
6caaff66193d44e9f31fe584177b5c7f5bea7e4018872e7e0e79bd04c5686b45

SHA512
804853149a1ed0c026e0d3cc760d4c2197414fc7097ef3b1aa61dd189f13ab4155693fade929d92b451739cd8751b2d05bb29aaf668e12b05a6ca793c44d36ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2149.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar215C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit