9484f287ea10d88fa8c621aaae3099678a74a840fee911bf2d98c3cb3d84c7a7

Analysis

max time kernel
137s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1dc16b92ab293f87c311163e5bd9ff9_JaffaCakes118.html
Size

62KB
MD5

d1dc16b92ab293f87c311163e5bd9ff9
SHA1

16d4c8ff431451a3e66a6285e1288743e16bb627
SHA256

9484f287ea10d88fa8c621aaae3099678a74a840fee911bf2d98c3cb3d84c7a7
SHA512

9c2353c8e03dfaf70cd3fba011826b9aa10a329fd9147cf8ca7f64d9bd599dd11a5d0ae4577b37525ab7f05ba5a3cb8e540c4a34108a587bb25a8d0a7ba2af3e
SSDEEP

1536:0NpjU7gtNv6UFFT//QwuLZVhSDVE/owkwhukn7HyxE:qkgPv/Qwu6kn7Hyu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431871529"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFA9B8F1-6D0E-11EF-AA6F-523A95B0E536} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1168	iexplore.exe
1168	iexplore.exe
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2196	1168	iexplore.exe	31
PID 1168 wrote to memory of 2196	1168	iexplore.exe	31
PID 1168 wrote to memory of 2196	1168	iexplore.exe	31
PID 1168 wrote to memory of 2196	1168	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d1dc16b92ab293f87c311163e5bd9ff9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1168 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daad876c9286a831b18cdcc5bfaa2d4d

SHA1
1b1a0b23f699b3961ac4c2c2adbe24b445c859cb

SHA256
d34549ebfd12ff9e9781d7c2179868621fff9c9aaa35460c51c7d2b1456db6f1

SHA512
07289cf0332ee505e45df3d4e82cb8ff6ef5f506ad560abdbd1fcb530941fa22e9ac16af34164cbd50fa4ef6a36f3e88218e0afdaa6f5ad0a20763dd5f2886eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e998508988ade92352f09b69edc0cf7d

SHA1
b8be491d7663f57cfdbdc7aec7391a9b916e24ba

SHA256
072c350c1f1c078309e65d601397aa719be8eb1b6b56d826d19eb36646af8df7

SHA512
585791eee2f1db914f04269a9a2bc1b03c5e94743bf54951fa171c66ffcf64b31c288358641647c0a4577d20553b8f8b999e2c46bbe94193870945c047a1cdcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a8d629697b519bd56647db070434a46

SHA1
5b26392a1a3f5eade365f64fb7ab05a95e39c384

SHA256
d0f4b3c37edf5ae1ea9980085494b8500c9e08da274c3c811a9a15cac0dce602

SHA512
25b349bd77493bbff6cff498e526542ecce07f4b1e69f2d6574c294809c11a31cd6bcf146ffeeb88689aa6d509dff774ec68ff6be48b126dcb6c1119c0150a50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2448738225e84024d61da2acd2e47a56

SHA1
d4d701243852705a56830b3a9eb2f7f73254d107

SHA256
a2e9415e8f922728b1fea1228bff9eca17c40952c3c89766e83fe867c9bdeb60

SHA512
4c183b0c2e9cf67ade59a8003ef417c4fa74e35c1d6c2c977739dcd9b713a6282c1b21c4475ea1bd8ad0909862ff756f2e5ffeacf595cdbc77b375cf4a8c62de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a40709283834af8a5a82f59554d254b3

SHA1
5bb3847ec24eaddb6f0edd594e3d269e169c309d

SHA256
6538cd213b5d60978b41d6b3d6f45a7b7e69913e761376fa514f9a4da6cc0f49

SHA512
4beb024cf9d3d32ed460e0d63f3dcdfa41f141d9e09f14d31a3863b3fd903360600f8a4878b1ff3e08a9f99e1257210b6b1afafb9b43cff3ab1284ec57fe7400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5229234a32b15356a48f6cad8ceae6f4

SHA1
4c053d07d0c4f241ee43576a76b3d53899d2cc86

SHA256
2c162c4a1aa63243894a9dfe3b30d684ef1331767244689005d34d42aa103bb3

SHA512
ff944f0917f3b19f6b8001d0855d48d27afab8ad45aba670ac4a6959823ed161856933b736a035ea50e1f4adf23ca819221a4280fbe2acca6741b1ae1bad6a72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c28c74601669c0d1b302ea59ad0342e

SHA1
d0b15f53e4155e9f38aca1a674e42ccc1ea36906

SHA256
98e98a50f9784791e6a4bccad7fd42f63c9a255b7e01ee5d6d85593a33b82b37

SHA512
4241f7f5b4409277222d708a60caf55ca42dae6d61ae541e87e08bae8479fd2074bfae62c746d65d388d75315b42dc34aacfccbb86b15948cc5580231fbc867e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2335488a37bb84af7da846159cf922da

SHA1
5cbef9e2a06bdd26c498ce0d705c724a76395913

SHA256
6563ddda49ea480847274ec3ad8ca20329ac72fea0fb2adae5de8d52a2b63a22

SHA512
7edeab924e76c124c6c8dd2240cef29c21af98104f439f0c2e99c1d3430ff9288e40d04a5968ebca01889a8220e64f6a4cbd9da8c095f3f94ac734d220e348e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a02a9adaaf4ceb86cd473f2dfdad27a

SHA1
649c0fa6643fb21237b75b2dee9e5dcd629e5d9b

SHA256
09af12d992cb2cba029dda29c505dc110354d073fb85fe0e3daa355af5cc8822

SHA512
e169b747394996e510cae66613c2fab1ad4fcb08a144e6bbe6224bc000f6c1dd56c7462c894288bd91aa815b83c5b5661dadf3e3546d9d2e8d2199ff18e1b505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25e127929fd852db6c0f6a28b973ba69

SHA1
27c4210cc4f6ddb811453286d08a2501d8a93055

SHA256
c7818d62c2d6b47e96ec64b5899640dcd47d9a894e1cf340645965ef963d8463

SHA512
ef3cb5cc194da54884ad96f7a482907ab08fbcb71103bcef44443b9cc129c9876e4e060d5c7e1c1f67b52c4297191238cc37b9044026b897a5c4ca892b58f2b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
009735047b0afd088961fbcfadccded1

SHA1
cb3263985dd44344d1928c334d932aae9282990f

SHA256
692e6459b311f37f8d36af237796462f8159788229ff6008a0ebf5482dcb34b4

SHA512
f6b91817239663b9ceb4a6cc1a9844b7d77cd94153c7109502cd78eb9e5d4e83c656e0c981bb42bdd987755e9fea8e6c648cf016532f7795be9515cf9e0e469b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76c4ca918e355cd63aab82a1d5a8fdf1

SHA1
6698286ea9793bc55df905ded44935bf990d4c21

SHA256
e621dad863883ea2ef3fd5833cb338d2128bdcfca8ef759f00bbb66262310ffc

SHA512
3b385bda8597a2b2340b06e4d432fb7f13cd6eaa870ace077925c59abbe9c7314c408fcf5381581c63aa0269a878a0a009f358597e17926e66f59436a2a36587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
427da3628283d2eddd1dc71e5ea3d559

SHA1
aefee6b6e529608d350bbfac5f702f3d8b351d7d

SHA256
8308ca4d9f98f1364fd6e311cf2b494d955b5b9f8ac47b08a5a2043f2db4ab27

SHA512
f5051327a5970cc11685abe83fea5c83ad2301e1b7d97d91dd81367ab7acc17313cf11226cc056e2f90c4e9ede460c34d71e0a703f76e0c4c8d2a1d6c069f2a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF421.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF462.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit