cff63c121923a85e209a8e4cf9ad31a6569a659bdbc50d1091395b2f4fe88997

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d11013b59f9dd6f7734d747ebfc10adc_JaffaCakes118.html
Size

461KB
MD5

d11013b59f9dd6f7734d747ebfc10adc
SHA1

39e6d44b24007664b7406123aa6fa4b625229a16
SHA256

cff63c121923a85e209a8e4cf9ad31a6569a659bdbc50d1091395b2f4fe88997
SHA512

1569bb6b5c091011afd8979f3b3eb3ee68b26baa1e1d8d86157699b1c6b0ad2357ca12838b65c2f13e8659fbc8a85f0415ed47cadca6a255657ae6b1787cc3eb
SSDEEP

6144:SgsMYod+X3oI+YzLuQysMYod+X3oI+YIXsMYod+X3oI+YLsMYod+X3oI+YQ:95d+X3BLW5d+X3Q5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e3db71dd00db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000005e8969e87a7b6fa7f7a1089decfd376fefa26b7bff20809a4c5adc5e4a38e452000000000e8000000002000020000000cb8fa5c409a38e1ff49b0a3f00423d255895c65094460041b45479e7ee287bb7200000009299be13ad97449b04b3d6b67b58e20f1f5c35ead616a121b26017a0c598736d40000000e9289174d5b13406ad1d2f789d113e96be3410333f02a94473805e89a1123603f1e023365a12e4c958be2dc9ecdeeb0ce1f2fb09c780aa2fd6e46b02af4fd8f8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000004bf6c38d060ee0fc1f9e77db701979828a939f29c1e404d1ec5d7e526eed289a000000000e80000000020000200000003f8faf50c638b06fd64b8ea8a8cacee53d7e96064ebe9a38be7d72f79731930c90000000a633a9f099674b78f6e87f30901b9722467f42091e36632ffd32339796fb67c517afb298e21bc2ce2ba7bac21277036ba7e143e1127cb8e31ce614435cf99da484e6af295d54c18ac2d08d9e42797ef6e26b8c453802270ec0f0a00801b9b3eda23766ea3cc8ab8984932000ad1106596de7ee0c2ed9e0f8afc665ff2865f3f0bccbc3544b450aa52ea4a5857d05172a400000001ed4ad6fcef09efba2f0da3b7f9805c815d62031ac08d0457d77a90ac538349550f005064fbd6f4220e28be7257a9d0cd0c5d4a62081440fdf4e4673d6761aed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{994DB9E1-6CD0-11EF-BE3F-EA7747D117E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431844734"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2876	2640	iexplore.exe	30
PID 2640 wrote to memory of 2876	2640	iexplore.exe	30
PID 2640 wrote to memory of 2876	2640	iexplore.exe	30
PID 2640 wrote to memory of 2876	2640	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d11013b59f9dd6f7734d747ebfc10adc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26819d13676291d6cb345bfd6e859d65

SHA1
c71933a1a0b51bf2d221d9c1878ff7247d598d3c

SHA256
918cf01959f898927dd20a0259707c9209d8c54087f7d1bf333c95a48bd25614

SHA512
94b0c598221558eefba47f7e6814df3e1ce9c75c7f524961699ace5115b8fe5a7ee72a22a752e004f1165b7cb5bc4a07cfd357269f8ceff3dfbf2d5dcf8f79d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
200c64c33c32a28a47d0efd46c525f6b

SHA1
c09dd9312dbde64617b786a13f35df7f8fc8cfec

SHA256
d44f7666a5f8a0d1afd283dbdb205c172ddaf261e3bbbc40fb90dc13c84ad4b6

SHA512
8350a38037f9ddac6071feedaab68c573b14947bd3ac37798f321ff0c2056d717ee6ca4e874323925239355352fcc79e5d8d199ee9237f3f015c9bae6813e663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ba994961662236a8727061f987651d4

SHA1
ebe71c3930539d7f2acac951703453d1b123f449

SHA256
7c0f86f1f645f2884b8f8053817baccd592f9779e10450bcf67a75c1489cb920

SHA512
ec5276e1c9b97cdab7d71227d0e6921753efae27d36b319160661c44f9770879f2d802957950ca2d44cbaa49c014ffa106ec6945ba0e5d78c0c4d32023fa99a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c5ca372e00967907ffeb2ee9bd3ed44

SHA1
8b9716d167ad5da0b791db0d695e81759d7a70eb

SHA256
52b594de50ef2f842fcdb88eb7dd7856f6fd7194a228001204a59bb6fe4d197b

SHA512
9e2df2de1bff36ab672830ef579832a521feced4630271bc637ad35f32e5eb50312bec058cc7ae0813082a222e7526e4a4110d49fa053a0ccd0c74008959a700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd439acca21598e559250e5e7cec6408

SHA1
4ffd8df97f51d0015a2b30d4b4d28bf878ca30fb

SHA256
c247e266c56734d958c63aa05088c02039ed252f7526c1d718974be2b408c333

SHA512
67e1aa0172ffbd8d8fc4803911303230628b3478848552baba0d40bfd4c13845d9d404f47e49fe0af08e8b7d79bd456cb10dadbe8f16156004684de11ff82e22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97e8f81502effa1dd413f161b64ece1b

SHA1
40a98eb2ae4b21a83e364bd00f00e021d7faea6c

SHA256
1f97bee16a34e3d076ce3d6144f648716c39edbab5c755a4abafe47ac5e645aa

SHA512
814b07fadcb9f68e267d8c88b6ece5cb29ac256200cdb503a7d5b9c0d0924d1662f2102f0195a6acbf81f5811ac4f228c0f49a3924f982cdffe4468e9a4e0900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d76f846b683ffd03307539e59a9a77ef

SHA1
d4f6e7a0a67556915a0811301fa2c6e084ed2096

SHA256
80d02b130907929c5dd510ed74b638ee80dfd0ebe86971fbe9c89312adeebab7

SHA512
84d1978c009bb7f1a87576ab5385935e3705b4bb41a9eee4b959055ab520af4a8ea5fb5bd20a446f0b4e4c2aa45070cfbd02b751a505f882a4ad7cab5b501aa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b47e5c374205cb702556813f403bfbea

SHA1
ab960cd9abf00e5e740091e0ea7b21903de5a368

SHA256
660ab61c7190b99d1a794014c434d27ce06a039dcb6f354ce3738374bbb02b45

SHA512
e57273e4c7b20bec6582ffa02c8654c313477b1503fc5133236061eeea335407895192dba41b3baaa387b919139b5199f5a218c6f2d492eccee9a6ec0b2849c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e6b727bb70819b4ea0b8e3965bdad6b

SHA1
005557bfb426210af108c3fac518b651f562784f

SHA256
bde00851d7ef9792d2eb26777c4a2284dc40a4500d14f34e5886e88f3b3bb758

SHA512
c6cd7468155ea0acf48e1a1bd7140246c61e5aa9179d8898d912cb0a4b2dea4783683c3166aff810e11b0183aecf09dd08aba8cc77947f33570adf3f9a18aa98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cedf1fbea71b1c48788fccfb5aa137c8

SHA1
bd9eec3e0fa361c642f67ad4bb3c1c12b9fc488c

SHA256
a4b4f7d771bbe6cdf43a75daf06a32b32c94926afc628cbf1d57b9fcc331eb80

SHA512
1ea05f0972d15dc40ecd975a43d4a5d133e793b6d5167531c77d89b19cba0b9b26ec855989b98feaa3d27c8b513eab8b60880b87d94a43b07b198f62fa752cdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC95A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC95D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit