e7d7554ac75fe77c322ee5e8945b295f1b29db1fc3f9506d974fdf5b577f1dc3

Analysis

max time kernel
84s
max time network
140s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d19f2383e0bb1fc0ce3370789159845b_JaffaCakes118.html
Size

27KB
MD5

d19f2383e0bb1fc0ce3370789159845b
SHA1

de6992ab6d7cb31ac566c2e5a641f68d392f2770
SHA256

e7d7554ac75fe77c322ee5e8945b295f1b29db1fc3f9506d974fdf5b577f1dc3
SHA512

2b69522f8b0cd0b78cb9cf176ea9c5b77595c6207176e47cb27e0527ba92196c5528668d32ca6d4cd8fc5a6a89d094d5b31131409299eddcca73e52385603208
SSDEEP

192:uwnEb5nH2nQjxn5Q/mnQieFNnQnQOkEntqgnQTbnBnQ9eZlm6l3TFQl7MBlqnYni:6Q/CQ/VTESnK3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08697f00801db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B9FBAD1-6CFC-11EF-9DFD-D67B43388B6B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431863432"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000f6febf60626f1fd9edf85a1ac33fb0bb4b41a54982b3770a8f2787c8793980c8000000000e8000000002000020000000198b6f168ef7828b64c0b4a235c6590141e4fbb3bd50acd18810ce735bd6b80820000000c121d796110bad4b7e846e6e1efd9cc1cbb1f34ec61866b78ba53b4cecb76e8b4000000090fe45bbd8bd0b4b9554c53e53e4bbaa43c86c8ac4c749792446d59d707470acb0033a498951fef3b91a994e0103bd7fa89ae1ac8d1b1e6375e5c5627238a87f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000002b03f9c5f9515f997eb5ab0d37a2a65fcdfc6f7fd7ae9a66c33e81cc9bbfb780000000000e8000000002000020000000e21c275fd82aa389728a79d9d89d87913cc633ee1615d8814a6e28881d10dca9900000007e5d06ae6f638a2612d58bddb34c0a3fce41ea2f4d08fcb4dc9e7a54b5159605e06f9077acaa6169d3d7f11ce1542710a7a156b2c649d78d1469d0514560f4bf021e9610a82a057714c387371cc66a6814d14d3adcbd8cf28fc44c46988a782c965d82090e04833251db2184e4dbd68b0aa23d6a4c9e27275497619b0f7296f49183f5ffd50243d7cf6f53774f9fd4ed40000000f0dbaf3ce81c62800ffcc65d0f32da5393266d6d235e0decf8adc5bd61078e5c9fa89b0055b75f4d51e0110f021638de538e2f0e1e60f220c829607c9ef2d640	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2596	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2596	2320	iexplore.exe	29
PID 2320 wrote to memory of 2596	2320	iexplore.exe	29
PID 2320 wrote to memory of 2596	2320	iexplore.exe	29
PID 2320 wrote to memory of 2596	2320	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d19f2383e0bb1fc0ce3370789159845b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d57d4bbb6d2f434c8be2fa3f2a8b8773

SHA1
28d809ae0f3e49bb9272fe047660ff1b0cf6c1d7

SHA256
f51466e76ee79767b141b63a68ca1fd295789be6f16df6cb17dc45b567a62c2a

SHA512
f2043b07006f0837cbe1b20bc3c84b1f711e3c872cea0bcbec86e5a2a6aa3ac73642fb3746a108d0188af2fb447b1289040f3ac17d0b236186184ce243387aa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99e9f05b72ca04948b7b995afd2f352d

SHA1
0bce246b41fabb588fa8a91898d8e20f4379a9b8

SHA256
4108ac0af189510b2abd47369aa8578b519e533abfc985d74f21c34427bbef62

SHA512
5f3d06d0b4ce5dbb1537c83cc9fcc42704edd907b35b9c2c1e81bda8ef8dea85f37dea2d4634bb7f7108c6fd72e4bac0fcc9d528b86803274e90ad4d3c02dc23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19ec7209e81f5f20c21702a0e09c9575

SHA1
96ebe439192d7ffb01db6a13ebe54460ad9d19a4

SHA256
d2a88bb5ff498a7e22a9a70b31c812f110daccf27eed31bb6d6a3a465c15de60

SHA512
40b53d269ed5b6d810ef4b06bafd5bbc203c71d50ac2812c153700df048ecd7f62e03b8f7f4c724b492e74c2447158ec99c2d9f29d97146e0280ce8ef5d2c3f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37a94de421a12bface42f7359640a7f6

SHA1
0fc258e0f8d0d47d8a8c2540fffd0effcf598dc2

SHA256
2e96c469e112d1ae1bcebbc5a222f63b0e3b240340294621df4a7c4d9bf2514a

SHA512
429bbacaeff2ae3e7158cdf04cc14eda25ca7b3b9d10b4d35d9fc6871859a51905839d25fe38fbfa39726299935e7b563eae9a0e9a203e9dde605a7ca22d6176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8b85734c134d032df698e13f2a5cf23

SHA1
839c160cbac589d3515f2bc420fa5d81b95fa4b4

SHA256
b6b6cd447bd25a4b754fb44bcc368d4eb2a5b0565ce2cb129b5fa0f269322a31

SHA512
b3e5d16eeca32776004f81d15ee8f726f130d40291f74efbb79b277f8a4b96a8b82d19e661b195989692a5b00a2f9e033bf6f1baf5aec6518bafc9783bd5c7b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e5b95a810818446a45c9e6b27fa5f4e

SHA1
90c0706a20ba37b52bb805962e2b03e4ea83b671

SHA256
3215c352c7fdd8692961218b715a110fd3d5a0370fc66a08fa5110b0d374c883

SHA512
df7135dc35012fed7aaf9149800052c4f67a7b6798fc5cb29f68df19d0f5600c9df8fce534ebe49fe4f4f4c9f61a8e055badf5675b0d364c185bb82fbeb893b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d204dd164fdc214cce08e033db84914

SHA1
70bee6ca41ceba174fd74cb18b646c310e0f7977

SHA256
e3941804f246baa0c46b5deb42bb9d2bb91932c65fba1ebb3a807a172ad0bec9

SHA512
ff79b587dee3dca7512989c81ca56b68e78e11e43788da625a342ab84ae2c04eec37ffce16ac8977274d34aca95bf7f5c9685fe64a76386ca074e938355f3c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a79922bc532651d2911cbd135cf2b5a

SHA1
fa6a0bd11eec08ac8cd054b8ab0d6e06b562409f

SHA256
459835cdfaef565a40a563ca7082a32d219f23eafbd9ee6305dd086492996085

SHA512
0f0c36f69fd4b1447c008cf26b162c5c8e91ac4a341080d333362f7516edc7a5744801d33f0f9104373a0257892bc6403688d317d683cdaf3d4740239b18aa85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bf2c6121a7838d1d4c58140c04a326c

SHA1
2fbd86729eb8071c01a20bfb1e386c34cafd7e0c

SHA256
6322d0e808d325f91a1cfa09afe2a6cf6b7a86b419544d9aa4e64b4223c5b1ba

SHA512
eb86b151fa1932e1ebfc303969b3269ba324328226bee60a7f15dab7503d14307c00673b5dcb2a33458cc1454cb8b526cc90c503d69d9f6d5e5863a3f380b758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce459181036491305cc5ee3a0c3d39eb

SHA1
11382bfd744b42d8c4801144f4aa770a320d2a94

SHA256
8b9314e2ab4973aa0ed58093c08578aec0e8b6f9452c41f178c24839827ed8e3

SHA512
8d81aba6e00a3a68cfd27556fecdabca5aa26c90892eaa26a717cc924d42ef9753a417e08c9d2a70dd2f778eec69a308e9792b2a6b918c8b25b195cf66927839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9605e1cae3eb09b1845581d1620a1dfb

SHA1
8641b983fca763dbea7857e5cf63cd8bf8f5c751

SHA256
a166f7cd8553e05f29d64413f2029c0fbf9bc800e9bffa983294c1650f6f81be

SHA512
00ec0e20d9ade0bafe6c3e8d438f1a66be3c89c02cf08b36403c41ba86ac27a1c85b4aaca06ee710bae3bc9652b79bd3bd6e088b93517e5aa6ef1328d48fcf68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8adf37173709f2c65e76f9d1ce55b6a5

SHA1
049b330ef309c441bcfb7d8e153cd3f50867e97f

SHA256
8b7994fb971bca1c7eb0f57e9543c16d178d79ba4fd7fe37d6461175146246ce

SHA512
40e50b2938fdf5b563757589acdcc1c54686c7ef695d8dc25356d4b754d8338589941acb6770da57ad82373449751f38e91d52471dc53aa6dc9cb3aa78cf81aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93c1cba5fb7d7eacd8e29d7115001dc7

SHA1
9d8cbca89bafdf4d308b1b549589cad23186c7d3

SHA256
61dfe58a0e7a45ce08ba16ca8b895a4a96d4205b7078618e9045ea7bd50419bb

SHA512
4de423080d0eb1af27bc8f55b140d4e05cca3c4fed32d65e0755e430d793f9638fbe897698b6c9255165705854b489089840561817362434da0e214451249121

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F27.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F99.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit