f4cd2dab3dda99b34ab864291cd8d57ba45677ae5d92515235e66589be382bb3

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1611ad1c1cafa97b9b2222e778d0a23_JaffaCakes118.html
Size

203KB
MD5

d1611ad1c1cafa97b9b2222e778d0a23
SHA1

795cfd2462e69473674380666706919b29c8d65d
SHA256

f4cd2dab3dda99b34ab864291cd8d57ba45677ae5d92515235e66589be382bb3
SHA512

e8b252ce97c638acc30542c602984d5727735795980dead1a2601258085dbc4fef2653879f14a3dcb388a850d2cde9199e08bebf11543855d11bcc64351420ed
SSDEEP

6144:S+3BEyDvCCEgBdPW7nn1q1le0HkjJ61/s:fEyDvCCEgBdPW7nn1q1le0HkjJ6W

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000083365454a2646cba44bc36ef0e5fa4079a60dd1eb39efc712e62c157125f8c8d000000000e80000000020000200000002445453c72efd57bd16cdbc04322ea6d91a1ddb460d217db1d240a0042442e6620000000871a578452378d79822eb00f18cfcfc2a0004ebf372b71029584e50bc3e599f140000000bc2996e320cd7721bd8afb0617f85852a07d1b91524ec982fac6a40f4bd068d38798a45fcd1061ba694837b19e12eb33378aae40fc17fda8d1db1120cd17d2a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00d53b7f600db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000009f7e7a883608ec842aef8e4771e776b9828f39a4e6baa6bb4627fde2d75ca3b000000000e8000000002000020000000f2a2aedcb6dd8d7931ee08f852f8595ebabd84ec570c9aec1f835c5f018852ca90000000e751ac9a073d0adfe4e2370d14eea6e4027c6e704e717bdff773af65e79fa988177da35d6749b154cf65114a5c8e5f185695e63caa310df119831e8d437269f44f75b04d768102b869b400c575d98ff86fc95c1222f330b0ea47e864217efd2334cdb95605c6b6b9935f97b230c65f16444354c37e071b86c7ebbf9213cb8313664c268d52c7bf34aec780859b09771a4000000064cff97e810623d925e72c98c32de0f3aae6802f453b30575a88c3c78c3012c01fbe676f0e40b6fdd015ffba8126031df6f362c7ce63b09c71df4f6f164c65f0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431855572"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC4A06F1-6CE9-11EF-8632-EAF933E40231} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2728	iexplore.exe
2728	iexplore.exe
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE
2608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2608	2728	iexplore.exe	30
PID 2728 wrote to memory of 2608	2728	iexplore.exe	30
PID 2728 wrote to memory of 2608	2728	iexplore.exe	30
PID 2728 wrote to memory of 2608	2728	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d1611ad1c1cafa97b9b2222e778d0a23_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E39EC26C9674650589C7927EB524F7A5

Filesize
1KB

MD5
af1c77aecc8d77e9aacb0c475840c392

SHA1
00abefd055f9a9c784ffdeabd1dcdd8fed741436

SHA256
9d7c3f1aa6ad2b2ec0d5cf1e246f8d9ae6cbc9fd0755ad37bb974b1f2fb603f3

SHA512
c5d1dd8b4ee8a17a351bb0fa40cc020e9b3364c59d9006badecc61bd5ca0c2b9729eab50da166633e4b0360ab914c42aa74cca861640e0abe5514430bb0daeaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3982fab9153030e243a4ff4922f24507

SHA1
7bd2353c7038942cda5511a02becfa1d11887a57

SHA256
286373b213db7b8d9e32643d822824cfe69bf0fefc3ff551f48296cbdd51e129

SHA512
3b1ac8d4ff111d16860f130252f28684c946f3395cce586213ecb3b731c3b9e544347377d4e5583d13bc0a8fba58c4dc69fac337980347c64161a023b24cd32d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf9c2ef0ddd6d2bab553c4ab55d9ce7d

SHA1
8522d6d1ae8f996f58c037b49919bfe1315e9837

SHA256
4c6b9e8682a9e555353c37565ade2ac2b28b9655e6e28b014bad02f68d32ea38

SHA512
22beb7d22884bdfb1ddee9e153e208408c658d9e8f3ceab2445f24883893ddafeae5382efb1af89602bfa83e733ea99f400d7afe432d0344ddd50b00a2fb210f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0047e859efa1bfa686d38234fe1d7bc

SHA1
32521eda0215d32f6561e0ddc9c635f4fa15c23f

SHA256
5ddeca043878517750b89ea3b0027401a00231f46faa27b2e4b1a994c84887dc

SHA512
79a356c625040a55d31bc060f2a7eb617ce587d1b52f58a3a61fef31868b35dba70b6be061ef31b786f037975a5b76eddcc9bf5e13f46dc2dc3d8e6c52977f87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef87932b6e1b38692d68fbc32f4a310b

SHA1
40fc5e76c61366a265694cb7751f26af9ba18266

SHA256
6487da6e239891e0406eb250ee448e960a25c019c07358416a05d5e89293a216

SHA512
cf04dbe36674b3f1d4d4fb7e22d350650360b131653d281dc89fec9121648afc860b65540d0b353b0a9d0a133dd39b2ffc467847cddab5f4314b78c80dfa8d76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5288341ac3f5c5b71cfbdf6f6deccb2a

SHA1
c5ab9e64712f5a1c52d0442ec34a90b534b2bf67

SHA256
f69a7d8290bc04888240a7d277e92fd5787181484e74fb5ff87dca3e4fd53037

SHA512
c89b1e5b601a813ca70fdfd8009aad6bbedd320326ea7119c85e03ec426f742a255d52a46a860b5dee0b6607f7020382908aee40e1573cd9e24c20bea12b0de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f93417b0d512c567ef9e8a467f17cb1e

SHA1
57e688f747baedcafbdef7c6d6d74655e38a1b4c

SHA256
c777d561e8fb0f7616495072b8fdcfe707c0bf069d1ca6d3a3f8c9f205e1f607

SHA512
d4239b6e2f39d779a441e82fa8ecdbac81ea1b19727584e9ff50bca92c10a7a7715bb090e9cd681098c286160439392617e46d129cf5040e820f4d6d8e567cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51a3fd33cf1a2df4a1a5b9ff7b255580

SHA1
1928c12a3df9084d8c0d3aafe3a63d118b2c82d3

SHA256
22afbb678efad3edff3ca33ad7a81edf4d5d477bdf4e727ea8c2f4d15761dca3

SHA512
6ef7608e67ae6223218a423e622d8018141c0ca90701515abf765b98e85f6f5f9a7247a39a36d2640a1ea7b6a001266da24cfa6e70b29d62697f6483f662615a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00aaf508ab4e2d6aee52d77a0d158b6e

SHA1
aa92a76b39238e9a9f27be4a60e2de94a7c69ef6

SHA256
c074edc005f0f1f91ae3bb5eb38fe55a0cf57095c59e8b008a6ecca89ebccc41

SHA512
ec33394d4cf658f2e70761de10502f6157d989fb53aa0a1d73d008230fd4410bddc74943cb0261cf67023a37bbe4310f6b21e7cfcf33ff30f2c900ebfcd4210f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab85D5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E12.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit