330d3f4a7591dead6d549fe34ad11d550f2dccfd606fa9f9e06a7e66081402b1

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 13:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1fee02bcf07a93b2dbd81adc46e1b17_JaffaCakes118.html
Size

461KB
MD5

d1fee02bcf07a93b2dbd81adc46e1b17
SHA1

17c69219277efe6c6b1efe124d31dd5a5ae26a04
SHA256

330d3f4a7591dead6d549fe34ad11d550f2dccfd606fa9f9e06a7e66081402b1
SHA512

31fce6c68e6d21eca1f18fa1781ecc812365e98e051b509d5423bb7fe0c968e0325fed1855a915bc3252490cab1071485a7e317eb6e4b0824d07a706da6f7304
SSDEEP

6144:SSsMYod+X3oI+YxsMYod+X3oI+YbsMYod+X3oI+YLsMYod+X3oI+YQ:H5d+X3X5d+X3V5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80aa315c2801db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E429CB1-6D1B-11EF-8EF2-FE6EB537C9A6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000023625609939963a2aa7f6d2edb4185eb58721c9b86e68abd15b283627e766391000000000e80000000020000200000009288fb77b0ec6949c7a883cf833da4adb223e6b3d65ba2c64a59b0a287f581b620000000b6abf699d801fd3df830e921741ab52c3fbe375a04331dad040b4666366cefc2400000004e7c65b471f7e2edfb7fa3c61c28038abc81bc4d739e75d6a340d9344a75ec813d77d577b64c9d388f4c92154e2f533b0c956ee13ee0ce9545e3f1c8364f390b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000fb89b7e7114f074b63f998fd18e4732c4489f3eb24341af9bec01ee06480b121000000000e80000000020000200000009aeee98935d4c86e02e7ba96a83118eeebac2b4ef89d252cc508c118c02686f09000000091582014380bf77afe4224e8c8e32d72b39b069b0d79eb0d86c85f848b1a7e865b7de586b92cc964e70db4c5401a7fa79bfe7383c609bf9864238a69a7d74679de7b8b8331e13c7a830bbbe0627c9669f37eb0b7aeb3112c971928c7176ce9ecb1e92b84824c591846ad7a2a767371c3e00cc2c8a7cc8035edff1e8237ed25802774b7a25fd34e322611a8d0f9fd9cee400000006dffb91b937f57fa2f995bc9a7991d68b77a6700944d731b36b9747c05082ce7119f501967b6ba2cc1acc034bb65140fb55e00568634228b167459d2d3e2e9b1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431876924"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2664	2964	iexplore.exe	30
PID 2964 wrote to memory of 2664	2964	iexplore.exe	30
PID 2964 wrote to memory of 2664	2964	iexplore.exe	30
PID 2964 wrote to memory of 2664	2964	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d1fee02bcf07a93b2dbd81adc46e1b17_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
099910c5294b98041c673dbf4261510e

SHA1
05c7ed1154fcbfd765a8d860620242830d7da67c

SHA256
b1d869662aedaaa84de7d45b2c5e4a395682f85372de3448887f641d7d09d1f0

SHA512
965f33b6e4964d26da89b0375e43743261047a757aa70dba4fdc79bae4d25c1f97e9e6615bc7b8738e41b0a71f07c0163015f34a8f53cd5e981b2db53b2abff2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e369997363ad3a8543bc6dfc07a70d15

SHA1
5cdba89f74daab620e071a4e81ca46e9f3ee152f

SHA256
319e3060c3cf2a009248ec8abbb96659ad83f5fa9bd0dd2de429544a7054a044

SHA512
2ac03c754e96d28b9aa00cdc81bf40461351f2dbb9dd947014524c09110fc10942eaf9baa1501508cd1ccefc0e2551b9b22e14f8c93d61e2e90e80b103331d73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afce390b8a61c2f61056991dc348edf9

SHA1
952f4dc30933be6f9004e25883dbef13884e994b

SHA256
481e7875bd1d187fd69fbfe657a376852d8a9c0fcd678812275a371ad402cf1b

SHA512
fad1015c2adc82829972c3c5ab440bd38848aa3be93f5761a4bfec463145127967266da04f0d4b4de1079cb6c58b48d87cefe2d2a614806eb8dc9355ea00146a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4730dd32e464d6713c2e483b5f39c67d

SHA1
f1d3bf36fe7061829921ca86c4520b09150fa861

SHA256
b82d2880459f57fd3c288c9505b63350140bb9a17fdae1d4b5fe0b52bf195ff6

SHA512
91aab42f4735a050fdf0c96e06d52683a730172f5362990cb94636f42e35a95fd9db931a83725c3b2a6c12eb2cf2eb0008f8f33be3b563f868bcb46c7a9d5623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9863e135e659a775a6e039acde742eda

SHA1
a8591b63df9a99bf20c023ad93cc164aaf3b7c7d

SHA256
22d17839fd189bb9a4f81c717097c51dd27a18df56bff36a38fbbcc49f2b3262

SHA512
613e5d533d15dbdd3bfca3145faf36ced816c1ccf3a20c7c954087bfe3876c575c7bd3b67950161a22cec912cecd3441af6b1dad2d69f24266905ced0189402d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40bbe08154cf4e3457ef47364f9cc681

SHA1
dbe0a87d7a937caa724cf48340a8022b04dc2630

SHA256
436935a5e94b68e26036eeb708bdaf139f64590cd15ce4aad85d92277c089208

SHA512
83785bf5406f36708a84fc9cddeb766eb32e8b9076a7addb945ba73c08b1ba1c751336897ea2a523679e88bbf3ca6f91e9504ea3a96a8a3ea68a5312e1d4c412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
030e0b92425a86b558e601e5b2e7c470

SHA1
b1ed49e1a9adf2d5664c4d4429b698884bca42fa

SHA256
14c11f9e39cbc761ada3cdcdff65f9bf52ac8dfe1c2273205cd0b0f9d94fe58b

SHA512
9c955c99b33a0134200adf3188bfb147a2ed56363ef3e4e8ddf212601f470e6e48fd4c2b1197f3cb9a3e126db346291dc352deabc537021890c89010f640bba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42da8afae48adda48dfb12151b0809d1

SHA1
8a222a7c938d98749337c8d6ce5c0313e35c1e76

SHA256
f4284ef77716a67332e2593d5faf2a73d3ece16486225947375df74107e69c32

SHA512
e2eb568fb5a94691a4185a1b123637628565f2fddf7b11b17d97c6d2e245cf9ddfbbb3510c8bcb52fe9f3bd70f07de8f6bbb0f3d52c24e0f7410f5030a0853bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73aed76ab7d2ef8b6c3e8f300d233c0b

SHA1
8fb304470814e0b62664d012226b557692ad29fd

SHA256
28cd2dccd6c82f23991a8c805a244a43be668c45a68381df7e03cce88d0aa1c4

SHA512
ffd4fc38c6cd7fbaf3f8e7a82021b378afd428c85538bde3eed959546f2c1ee795ddd4973e2c333c906210cc1f9eca601bb194ed048c8e94a5cb3aa5d00f3e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86f9bee77ca44fd2c330bd723cd1e080

SHA1
61a20c528b929b7db52728b77c7b64ed264f1327

SHA256
1161f822b7f4bf925e9878cdd3b18459b7f91bb0f6faf28b94abcf03e27dbd69

SHA512
76fe0e5cf9661c27b9f973916c7b76715a670866ed3ab91f3ad5b6ed6e3cb2b0bfd6496ee4f34915117b2475407228d238c56dfb4252cf7f02cfb37e17bf055a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0aa43b441c8c066f3c21ddf13604932

SHA1
e50bed9657325b08a318aac407de0750469c0926

SHA256
118919a6db1645304bac97195fe6a95c584998f1e65c29ce0b7f16bab7c13dc7

SHA512
11b7b9d754ddb0b5a27f2a3050bd07ae7b1732932cea93bd16fda15090c998aacea35ecbfa388e36e102955c77469550eebc445699e0430e322de1651bf6fc77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3af817874115f9d73d1708ca2b05b736

SHA1
ff726fdc1cbac5c3f807b599e0bffa519b6229d6

SHA256
d99d5494cdf33380e2f1d3a4a53f123d5884bd3e8f4d7360ff937513b96533f2

SHA512
33364b7ae1639f0d6a264173c506316ec1addbb7e07d63783d086753d1b57d6fd24905f65d8281928b29c57a1c054533eaa297d59e843837164dd39b5dad0e14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a87a74f3dc12717d89ed5a655be77845

SHA1
a95aeb73d7c29bbe6686b89ed9e0afa3b917f370

SHA256
b96d50becefae491541ac5e60eabde2be6d993b52672ab4138399e1e9fdf2ce7

SHA512
1b7410ac5b1698f9502ef57c8fa7952f1f9826ee189eb88eeed92993ab6346a4c99f397be59c772d214aa81e08776c1fa6ef70ab1e3d2c7a70c56aafab14c423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
120256617fd9673bd9f79eb143b6f92d

SHA1
6ac12276fe369b9b0d415c665cae267cc522d526

SHA256
246937fc7e83ef7ec9631104a024fb171b2865191a5f650f8063436adbaba8ec

SHA512
c9f98bfbf4ae353cc2fc115fb52c2c3919674e4a059c099302817d460ac650bafa7a7d08645383f7fc1ecfbc126962a12893e8a4f396b88f12f4dbe62c1fbf08

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA20B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA2BB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit