d8e8ffec73f3b028a86badf2597129334948dd9a85291e3370369d276ddf02d2

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d11e9a57390f68d4fd2f7a08dc4b2848_JaffaCakes118.html
Size

34KB
MD5

d11e9a57390f68d4fd2f7a08dc4b2848
SHA1

8dc70df564f5bf91028303de824e509b4de55581
SHA256

d8e8ffec73f3b028a86badf2597129334948dd9a85291e3370369d276ddf02d2
SHA512

e054ee2d586cd74679475aa82ae6fb98674d59317f025da33d2fed0062159c915b080201f558c1f60b893767bd79345051c97f4811a6150721c79708351439e7
SSDEEP

192:uwvbb5nlinQjxn5Q/QnQiebNn3nQOkEntc6nQTbntnQOg6cwqYfcwqYLcwqYQHp3:TQ/kan95Hp5QhPoOavxZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000ff8e6ca4c439fa9b35acf6db2c6097bd18d6c3f2513e05e86eb9cb5112c6e4da000000000e80000000020000200000007c48f405f779af39c9b39a86a46f56ad49f10c1916373036feae228282f3ee58900000001857eddc24a6707f17b200c80ffde036d051e1bb8add781888e24ba90d0d26ba1a8da9ff8d8071bba5b5305b65537703d5c203e472cd624ac8d6d57de6cbd13538d476e60a04547a95d4e30f85645b76da6e248b6112e5eaefe4b517aca11f4b7b356abeac143ebc429e39a3c9b3adc369891b36118828fe71f5d9e5f39c3e2d10fb05391100320180fd4eaa32afc41640000000a95ad215e6b04cf1cb4dcd9af188d168e401498483021e49bc38cd39ea4ec8ba7642e55dcd9371e65d1408aabec7ddfeb922445f63f8e8c61b1eb334851f33d1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431846691"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000fe65b2edc345849a50190d6e560591519e9296fac1413e4ac85935a414a7d368000000000e800000000200002000000029f4689630ea359819f1c0ce5d6b394e4dfd69bf87bdf57f105f7d312e6ba2fa200000002fbb1c95d4aa68e87fd07fa0e4c5a23e08937278a0f7196775cd8f70de78d16540000000acb838897dfdaa723850e17a44b1abf0849ca58bf61ae16b9e5af088e878498177faaadb61ec7ced065cabe9e8c144860ddb9d60ac1496a5937ddb18e66a3e2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27936E31-6CD5-11EF-BF4D-465533733A50} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801c73fee100db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE
1408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1408	2540	iexplore.exe	30
PID 2540 wrote to memory of 1408	2540	iexplore.exe	30
PID 2540 wrote to memory of 1408	2540	iexplore.exe	30
PID 2540 wrote to memory of 1408	2540	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d11e9a57390f68d4fd2f7a08dc4b2848_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5255c8285612176a70a286eb1522825f

SHA1
3db4af517f012881f2cee38df48167ace68314d5

SHA256
0322951ab3a997147e9ad8c2e2d21f03cbe6b1cda8ac8f2e7b5f2d5b6e58db73

SHA512
d6d8adc269a1b84c85140624b0a4d8e2e1b2c421cbeaa65afa3109e2d2327add93911ae45f123e3f7ff4f85d6ec5c65ebbe62bbc4f54d5c9ffeb1cc8c7c4e7a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20583ff57d4810539881b78155458d42

SHA1
70d2d4d8668d9496dfb43e107a7818f1fbb7e287

SHA256
328ce45056395afcf94a46ebea2ce9d0f721ddcf287c27155594b3c250305c7f

SHA512
ad95244513eefc234c92c924db206bc8ae8de26d409728176a39cd645cfcbdcb184637ce6640ba95664490b82ce07b74c592023f098ef337e58d07a861367cc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfeab81f830872e55c7b37b0c95e4f1e

SHA1
91b0ad4076d44177daf96bcabe7172e8eb63d46c

SHA256
4d49991bdfd9d6ec92f4579c50a1b00856da9f204dd16ae74fc55e58a7427391

SHA512
13862e10c53914def336af6ec757418add941ac9c91c6281ac61ff0ed8fa2132998ac4346469246583291a1aa33151cef16db791aa673600e962c66f67f7f17c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88be4fe1f6b6f3a6b22a2af75ce067fd

SHA1
ec33826f57cdd81067421a90ad0b1808d45904c8

SHA256
7b407324d312fa369c319a18d34a0f688ea80929dae75cb31d1e50c8b1d76112

SHA512
dcc65864e8d50e7de825e75f09626686b9f484d5fece38cff008073f4fcb2c0ed6eee0fcf568a248a268528c83e7f8b3b19967b599e3d5dd8652afe5a5722a7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ebbb7c7f5de07b40dc2e165dcfcaba7

SHA1
f58efcb1a18330ff15afb933476cf7f11a354e96

SHA256
d7c986a4b1061e1e60b92f464274dc6b424c82e9b085f19c546f258b4f746796

SHA512
761bc4557ebd16ccb78fdc995ed4803ea239657caddc88ade8da5c49b1de4441134d9841d629dec9a0ae7d15450ecaa6bf75b921a00061a23362062fdb0f6e68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaa56d52f52cec33a17833cbd5388f35

SHA1
12558ec5618ea1d47a20f0f8457d57f43734a3a4

SHA256
52596853a043a644f6972277988f430c2a768936d433326680ea690de6d6ef66

SHA512
5b5b4d06d5cd15fa594a160377c172b79df629c2e5820d21b035908f7d6ae8d4b13431a3d271a447082b3a9e006079bd3eab4370d931186f3ad9a721221c0add

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3aed1e2edbda6a03ba928f3bfd29c3e4

SHA1
39671f4018b3b2f10c9a1c6e34c83205f2b8c62d

SHA256
2d988c839ac397b730a5be6bdf479a90e81d54a0ebae75979c89fe3707fb0356

SHA512
9730e80a6895bdad490ec4366eded93c3c3f30839a003fa1b924e34164b76a8e7fc3e8c3d7c8b83273f4bd4d0749d89c42284a1e69306f610a42c137b7d853e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f44509511aa8d8d2fc6ec965fa21e96c

SHA1
2f2ba6f200958b49d7114b0a841757546d1ec8fe

SHA256
ca0eeef392040ace2d96b88bd030f1a70fafb67652182ec35c2c80308b17f40d

SHA512
9c4adb8f8cb536f70fd6c301c285e8a2a926962eea5fc042a1d8b1b913e5a03b78a3b9007361710ce64b601294e717b7146f4f014a66294a074f875e4db74681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9e0e379f8e448f9f446e0183c390557

SHA1
8f82036ba7b80b6b7b6f24a102c0da03e877599e

SHA256
06bd30e2ea7723cf1fb1b7076a7d6f96f0aa90d0c9cb1f4e541b7985759dcda5

SHA512
b336131319ceab0f93e7bd5fa1b0316c786a9a4c438a6c5ea3d267b9128825766efc4d80554755957a036171d50aa5a6ad9464e1a98e610af1bd71afa47c2732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58e8b3d6cb02606cc4836e94d5d1f5c6

SHA1
03d5ac8f1ab2330556e659c60bcdccda79c8830d

SHA256
feac700efd353e25c59b9ef30cd090ad6710dfa0ee166882130a7528ba0f3bd5

SHA512
4090b51eb3d6c1d252a57db022d435bc290a1e76c7208c97167ce77ce2f9e036add96c1ae19ae70b5068dcfcb22eff4c0c092115e511afb0d4aa2fb68f1a047e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f939dce84ff33d3f91c53057dc4f37c6

SHA1
98455113dc0d09f24fb69b61037dd5b06fb736cf

SHA256
df0bb2401dc32e81ac96f4f2d8efd4d65470fa311d0c0776bdf50a4b76637b54

SHA512
0712c51dda486fd4430c8f95d5522027cf55d2724c8b93f7bf193256d70385f49307a31868dea7b6223d162444c991caacfc71dbb5c87ef28edce8bd6f7cffc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42c54f4aebb38596ecd9aa0d62002af5

SHA1
dc3d3f11068abbd2bbaa6e836dc042a63b784eca

SHA256
39b568a427364779df3158c94587921b2a4c4a8a6f7874737b507b38da175db6

SHA512
3b95a12b83190f1f84bc1a45547ac41ab9f9c523b10dcfd9ec91f9d32458dde69c41084a7a12c4659a52003342cb4ca172a0070826ed7cbe3b048d14619ab33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8df49c1a9e6893111d4465b4b45ad9f

SHA1
ee1186904a13fed5680a4a272a8abbfeded6e24f

SHA256
178ca0e22cb3356cd6c586f81458572192fe399a5e8af071184d106e67b8c207

SHA512
db5e553db182a74e65cea7ba8da6de39321516f13e1ac97a589a6d5f62259a09c5a887f27ee0d14ec240836c5ee75469c66793068c2c2615f6e56c0fa5978662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
993bb8e49d6bef0ce09ac38b9ef31f7e

SHA1
ea6aab291ad42df2919f27270d4fc655e865f55c

SHA256
b9314223317988b3f69dcc09269f61242d5198d4dd7672c5b8d7fbfed6289522

SHA512
572b83671995b952b2f487856a0f2f366a542cfbe28d271bdfe5cbca8cbe5995ce7423c93bda627fe77cef5f6298ef06379e93e61cbd9dea49fddea92c0973bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2458f70bd162f11ca7f573eae4625dff

SHA1
c9d7f9ae63dea6623b372d932c9a86c7ea810dc4

SHA256
8beb0a0c4aa267ddaaf246f74c1b0156a7067b903e592646fad4c1d00b5eecf9

SHA512
aa7246a0efa6b115ef08bd922153d085da1e7dc8f520ee515c4ca6fe5f6c0196c24641b573f300457927b6d18e272a4c71e2bc2af14008ba477da5f6f95d33e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE571.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE65F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit