a9440e276f4325c8ad6fb8ceced41a23bb4b3e27da0ec96ad6bcbc0a966c665d

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d168778ed96e7c8c133bd4a1da75ee28_JaffaCakes118.html
Size

68KB
MD5

d168778ed96e7c8c133bd4a1da75ee28
SHA1

2f3e13dff7de8873602019c9904f431f00f596dd
SHA256

a9440e276f4325c8ad6fb8ceced41a23bb4b3e27da0ec96ad6bcbc0a966c665d
SHA512

79e727ee1e537d169f70a502d2ace697d3a8f44693529b6958dbdca5bc217feda61777bc87536ba782584356f90669b3a296d266baca67ff56107838294e268c
SSDEEP

768:Ji3dgcMiR3sI2PDDnX0g6Uw+wIjCzoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:JemAlIjCMTcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEE1A3B1-6CEB-11EF-9D9B-465533733A50} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90fb0fc5f800db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000e11141c88fc2f44dbb85fc0680a4a36c252dc9cadd13aff2701948ce303c3a27000000000e80000000020000200000005a24b2f7632ae9485fada64bb1da1024b0d7f3bf62e60918c8b26e18b84574c5900000000243c21bc5c7c075db4d0ee8071db7ccf2637df6a7f7fbed2eeaa723724b4844b70dfe6b68681000e14071397ca84767b02fe224f14a23f338e6766dd9eb4151a160e6a780c155e9757e101ab5066c3760f864d6c5994f4318af47bcbade896ac54b62ff517c803a59b7154fddf6fa77e02b606d991e273481a3680c1b223ed158900d06412769b0b210b8e7bfce0e4640000000266d895ace399c4f9630c7e0e85ad6d7f05286de2435d8a7ae94548b3f8b848d1a5cdb3e42807d00af3f84293cd401f6e33ce1d19edb99b853364fc1f9903a17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000326f0e4428656680ca356114328b06092bc28db46ae5646f1124fdc6562dbadf000000000e800000000200002000000027d0cf8f9bc81bd1f9d050c6f42487d90dfcd707d27a22b561d68ba1cc80dae720000000c5417207cb0763d10d6157ea6499ee77667ca30e3c875142f17d2c5cdfb994e1400000006c2c1438bb109c574bc9d4bcc72175a7d6405cd8ba8bb7063148f1aaf4467fb4d8dd07a7fd0be06a0f601f9b47762d811471a733c5a06fd5a5d53be70fed4358	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431856488"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2528	3040	iexplore.exe	30
PID 3040 wrote to memory of 2528	3040	iexplore.exe	30
PID 3040 wrote to memory of 2528	3040	iexplore.exe	30
PID 3040 wrote to memory of 2528	3040	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d168778ed96e7c8c133bd4a1da75ee28_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7846d63fa7c0e07689dba6c372fbc86f

SHA1
7094f7ba6f62ab93321d56e549d4842f771840ad

SHA256
ecdf2329c83c29f7d1860ff56696a4cf398a17ec7c1b21f8480386f03c85fcb8

SHA512
b409a7a462d0abd6c49f6b2f14835e86183bbcd3ac4e3d67d350b30013da39be629ae06afc9d5740c4706d8a5d768cf3ff61dd77c31b918fbeece77aff36e4f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcdef5cdff3ae5ed8b34d60121b1dc3e

SHA1
f4860525a9fe60e07d256ab94fe64c0d9163a737

SHA256
f79461352513a1361d7a84a39d920c32f02c1ad446c275dd73e96b179adcd04b

SHA512
f0f15502f2400211f49849095d807e4c325173b882e7020d275400b1153cc5a246ae8367db03f1ddcf1f946124b2b523c3c9fee9bbdb680d1ed20e08bf10ecff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ced99d2142d84e0353087cd3e9e0c92c

SHA1
bc96e38ae9462345c64c14fa781394960689063a

SHA256
7306a622bd5bcb8f425b934c05d93611513032e6f16de90055f3259a9c52e1fc

SHA512
10166d816b98f660d46e2fde522cbf7d27339ced28199a5175d77fd2985e3c44a77634c479b0b3c79b690b1475a33eb1ca8f2bdf4e62e2762f98ac0d3dfc6625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94afe7548cb78c434f2aee1e1969b3ce

SHA1
4eb8dc34dbb87a045c65cacdbff7fd83d04ed482

SHA256
b88ca7d08bbf0322449f0e188fe4ec8b0fafbe65f74a5e9a893e0924f32685e8

SHA512
f14f1935c73c34317b6cae4c819c6ebbfa38adb4f8f5eaeddc95d26a1254f13747357ac36b926da70259acd035727bb261e15435313319bae4c6f1acd4c329ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67176d4a047fdee4ea6dd5c51e1240fb

SHA1
c1a50a31fb5a6c4a41538f3c9cf47a4f5463d51a

SHA256
b8952b43a66e672b8f5f22e22f071c7657706188d6535144406107cda2f1876c

SHA512
fbe13779546757ff0ce94e25330212526531e2732ebaac6f159eb3415156e6e69ef82d952b7bd9472721e5b499dbd02db3c554d05015efbcc29730be50df9f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
176c3929fdbabe1898814bf7efbed02c

SHA1
0e4087e9a40f91bd3e149208ebead3642fd8e439

SHA256
40e45644eebb87a5b75800a26ddbe6b10e61948b3e833703d24088214bff99e6

SHA512
d1c67e2f68fd2808f234324afeaf6fc3bfaff4b54b18e6c7e425da087584934b97e256532d273dfdc25097308188543ea6d0e30f9438bf9ed503a57a423ee7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b4543b37261bc58ba9f08970aa35c87

SHA1
8911f8c936d951f8d6deb9a4db57733cb673cd84

SHA256
a4596bdbb60ee615027f5c5cee8d1919ad299a277389dd48f2d4e841e44ebf55

SHA512
6bd3fe8dbdd82a37828f5dc102089a17e25d4ff996d6c84ae0403c55b2fa0f9835f63494deb66ddfa327b13222342eb7a9908668f0aeb277c0f65e02373ecc37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bf9d8d0e7c862239a3e88a7c97cecc6

SHA1
57cc605fc88f2f9ed5571e2e6997ae1514be10c2

SHA256
e8f8d9f5370dfb6902265a8101e0c2af3b65edf521dc2362ec137de4111a4a49

SHA512
5c446b7c337fa2377ad909949d122b027a604ed23b05c75ca608445843f2497c7f51313b3bbde11d3e450a7442ce60cfb1bfc114569c161d0798075f2e491928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a085c16321bc7b8bf331ded0d0229d69

SHA1
72962e13abd9befa53f2f357f658f017c9ff2894

SHA256
12e9eea6f900a2cab46ea5bf5beac2a418d170bd45a8f75653e7cdc054e84fd1

SHA512
65e2ec947956ee0152ecea30525502d75b8e6dd0de0196d31a774ac93915053a5de875b13285a0d9bee1e4de36420bed8fb636dcff5bc29f6af3be6b8ed96ede

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD77.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDE9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit