001872c74700338760c02ec8b2c630473535dc69a8ab34107f770478bae0351e

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1bcda9d9bb085a6981b8470ec73deb4_JaffaCakes118.html
Size

25KB
MD5

d1bcda9d9bb085a6981b8470ec73deb4
SHA1

64c1fdadb139b6f1fcd9c0c82404db2e477792d7
SHA256

001872c74700338760c02ec8b2c630473535dc69a8ab34107f770478bae0351e
SHA512

65081591fa002d486d79112b20588b207e1ca635b656e327364a113ee310ec5737c02d32d40eec821414ae06ccca3b132f0305e6b137c808a62e202e3ee3be3b
SSDEEP

384:3ek6UilIrvu30/exUsFCi3xYZzy1OIrSeljdGRtkGNl8:JE2rvg02usFbTOIrSehMRtkGNl8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DEA0E21-6D05-11EF-8287-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431867343"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000fabb2075239ab13c4a682cdb1bbe73594bff86f0a256f3fe8f5ac295fdd71b0b000000000e80000000020000200000005e6ff405385435378d344f072c228ccae00e47b81a9fe141d880086041b0bf682000000039739798d26223ec7023d8cede53bd4c5f8392c75649528abb3de4d9d382965940000000073c900db0c0604e9123b40462229932e848fd8637a1899e85ae3a533178ab39cfd5bad57ec98bf7a15c10b6cc52f6c08228a185be23bf617f201a2c0012c331	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000eb7d60c11ca5a0cdb3ca989196ca126840af004fe2c48afc0ab0e8186653953f000000000e8000000002000020000000af2e96a560400b38415b9ae41089c21ca8c2518f4e793af68457304e0c7bab0490000000cde7db0efbec00e9cdd20425c09c4889392921b9e285e2c8a9c73c3086292cd9a99d60515fb0af1523c8abc495c5530864e0c7c83c80cc8aab37e9737bb3be22e050836b5615dce484653fdf2c823bddf3c5a35cc7d43ac1e14da990302087270d935496c72d0fe30eb0c6ebabf95f4b0628a47f08b07e3e92b9cd105caacc5e409bc5b59e189f91b48c63badc87c596400000004ed04590dce543aa20d5a0d94053002464c5320a242401671cd1f0a18d7d828fc881f89cd946c1fe36e3607ed5d8d6c2e09cbde61b3985467ddb641a9f175134	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5057941a1201db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2252	2388	iexplore.exe	31
PID 2388 wrote to memory of 2252	2388	iexplore.exe	31
PID 2388 wrote to memory of 2252	2388	iexplore.exe	31
PID 2388 wrote to memory of 2252	2388	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d1bcda9d9bb085a6981b8470ec73deb4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
801965b685be0e09ed4bdbb2ab5934fe

SHA1
39733ec88bcfda3034a278e1bb6c1371967356e5

SHA256
58b778a4c5db38304585a7c4a8a30056e1bc8ed63207ddd58e3b5de6e40a547b

SHA512
6d4e5578465b9e40f36d8781645bd13c482b256caa4690a621017aa8319cdd36d37aa3bea0eac7812ec18f455c43bb9d76f1abd1c79018189e9ab3598a84951d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc0099629e21276d6187b536a1588b27

SHA1
fe239426bde0a2e4e7f79f572affb54a6bcbc10c

SHA256
baba6ea122628f8e4f1594836bc9a1435f563ae552c9655ff41bb98c1a664a3d

SHA512
b76e0d4cee234f58436d889429a646851769baf5dff4a008456474f32592dd6f1360d7249f58f1e67a2c65d44661fec1c1f7a28a1b8c91a9a5d3a11d4a519d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61f27fdfcaf4d1587a2a1e3500ca4215

SHA1
31d65a3e24bc4a9dd22f30eb0d0bdfb22775380d

SHA256
a02d0c77d7051a8d25f8b747e9373e332a429ac4939e63583cc370aeb461d4e3

SHA512
b84a3112535f6f6220467354823e30171186774a0585e490a7fd0eb520bfc33f711a23b406f0078ffcfc5aaf8e27b7f7de11fb95bb2a3c35f06922b70226b155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e1136eb188979921b80b4ac1a2bcd94

SHA1
939d99955bf60928784394dc6277efbae51f67ef

SHA256
dd5b1520b602febb02c607ac08fe57468bfccf3c31f9e338c79dba97ede656e3

SHA512
adf28ae50f37c3e97f51597ec5752157c48a7ba7b8c0efbb9ec7c11af2cba25855896d3104efefdb4792602b8267282d4e750c66de2d1d50fd24c13b03e79a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d697d759b82e1bde440ca1a796b2cbf8

SHA1
cb982835a7eb3cee5e63b1374d6e40d9f4c790e9

SHA256
4aea17cc31521b2a54eaa1e64906e941aebfcdbe42c8b2af63fec3316c5dc31a

SHA512
a82fa351053b0f637afa612f6e9afbf32a80c7d917c408171d334b3f949c85de009ad235629954553aceb7f084218bef4ec36725e29697586120afa8b383c7f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f1735323dcfefdfaac9d1747ca150fb

SHA1
38e621503ccccebd2a9e13fba8b4820a8602be3d

SHA256
a3450ce9ae7346ff8a4057a6c2111e3b4a29aaec1e3e52bc3114acfadede0972

SHA512
aa7a3069fd3036e854fedbb11dadb4940320af7346cce2a8c8a607d431028cbb7ef4d933d0b58182b8881c7c308f1bfdb3c3b09d666c49738078c2dc96cbe841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fb6fe00265845cd23559aea469c47ec

SHA1
399f3de4322b8a0bedfd847bd7183d95cb649ae6

SHA256
5cf3872a9607ffca2d3472d1f122a67fbe642969626bc32e32b6e6ebcc7b2d24

SHA512
6a34dd13b8ab7c58d106b99ff06e27740aaffe57970f8bb325dd63b056f1710a29cf23d8a1fd232cca0d332dc53015d3cf7ee4b4980919fcb7e4a0b482f59f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bcd916ec46bdfa3f9109a8f14ca062a

SHA1
c07e99fb72f05f6d4ab677ec885064f2329089b8

SHA256
9032ca31beb3cfa892538be8459841c5e43eb7c8e4a7041c23db5856a210e144

SHA512
a807cab8bfcdf941caa2953033e942317ca97b5baefe9c0ae167d58db3f08cf38a1481d25963bcfc1baa8dc253cc7d78f9b8e11d572e3f7c5b7b3125a1a93da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
584b30382c6a3c6ad11a650c477735c0

SHA1
a1b758938cf7daacb7eb3f3747f6485347e3f461

SHA256
bcb366eb3b363d9d094431bd7d99c8d69d07b22ecd15a6cfe7cacfedb301bcec

SHA512
b324605070cef25af599fb0cabc24460c00b17cfed407c7f61eec51715d9149d7aecf43bfa3a203a6108f3caa13c5ee216ed296f33b66c6c562c25d59109d55c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
697415a40046e6bab6ffb291e649a362

SHA1
1ea33343a0462224827920997b0cf789fdfc3de4

SHA256
cfabd9ef6eb3e643fff93751cc79b69701230b3a879fcdc895d55ab9fe5ca31e

SHA512
9ca60a09a7b94d9e70b4900031410d1a451a4edfea2a6fa88d4984422548b5b37f0c86ffd150902ecc9f2424db7998a343a373584cf9a937b9bf75ab8852b227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78e9f521c44bf6d6a894564d53f07ed0

SHA1
0ee1e33f546983633dfd82586d8e387bbf54d7f0

SHA256
566ccfda9721ba9202e7b944fc77b577677ffb9df5feb4b14cc251d34ad4b0a7

SHA512
a0e4d630f6d26a78107f15fdcbbd0dbd8a7e1fedf9b46c04dd643ea9a26e394befe5778aafa5ba077c511891335a23797b2ca080cbaf70d792e7221aa9feea85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1DEE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DEF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit