830f382831ece3b57bd3dc6aa52d607a3f7673ee19c59dd193aa903841309da3

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d22110b99dfb062ee8153805706f85b5_JaffaCakes118.html
Size

30KB
MD5

d22110b99dfb062ee8153805706f85b5
SHA1

eeed98bac74a9aefdb589d56406490983ce4b6ac
SHA256

830f382831ece3b57bd3dc6aa52d607a3f7673ee19c59dd193aa903841309da3
SHA512

cfd280ef85e947958645cfe7484915a5794e9dc2dceef65a9c165b1eac25c9bd8fa88785b936889c58e70981d8ae18bcca4daf17ef28c7d45b77047dff41dafd
SSDEEP

192:uWDMb5n9bnQjxn5Q/EnQienNnjnQOkEntMmnQTbnVnQQMCf5AIDn253gbiYxYJ/L:lQ/ep52Q9xYpyQ3ZbDlOC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000a4bb9ac572f1c63dd1be7ead3bec019832d9f366c6e9d71a4e5adbcf46c146dc000000000e8000000002000020000000926b186778229941173f25332cea81266a02bae73b76573b15260011213bc4a12000000069f552ef46026aa30be9e1f70ae7ab403e9612d1995eda6df54a6b85890ccd7d40000000ba5c01e0185e06c1527f83b96a0def490d75dcd7dfdae372940e116ea7353b39da474d350ef5320edd0c36cefcdb8fb300923b7df1b30d5622f9df69bc55a167	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000003e078b23597740c335877e2faddbe743e0d19ea1910ca985079719bdf2205c9d000000000e80000000020000200000008b2fb283e711c575b5c0db46a76ed7c7eaf6b5181c2eaf092d28ac9116f720d290000000f3fbc86bb6e43c3fd300068f40215735940a18b39e99b51291b353a829e6df5f44d769bc30d4479d007e2f00ee529e1bc48a7cd7a8a63d0c8f9db3813c0ed69e5ee7c8c766410175a76eb516ff910dbf1e34818b39e009bcc9ce647b6f8c5b5d742248883a0bc872045f125f1c051a3cd0cfa904be567b069b39eebc3d2f9c32bce5ff41d8e27c52fb653c1719c80b4040000000779411418abd1d9455d72f064b6a86ee5fd11cc5df6f82c2df2c109b59905e35d5999f6d5bd1916bdca968156fc187cd048e83245670bd2df6abbf89b19c5b4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431880485"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fe81ac3001db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5FB5CF1-6D23-11EF-8320-E61828AB23DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2112	2376	iexplore.exe	30
PID 2376 wrote to memory of 2112	2376	iexplore.exe	30
PID 2376 wrote to memory of 2112	2376	iexplore.exe	30
PID 2376 wrote to memory of 2112	2376	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d22110b99dfb062ee8153805706f85b5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
674cd5985be61fc7b89d0b92b1fb9851

SHA1
673a297562408f0414e5638b4bac5c1586c21a83

SHA256
6b6746a45e32e99f8a701981e54a85ad2c5d61ce7b62445ffdeff5d594787911

SHA512
4d32d36c6f734d096fe0a88427b226d2dd95ff2ea513c80dbf0c2da46772f84dc80b6ad383c3cff78012291b5a081b6bc33aa9f06a100d6c12f85be6f1b4e3e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53ca3c2c7ef233e0396a0df4a9b8807c

SHA1
b8de1b8a08e89e8b67d93018a41530743baf70ff

SHA256
fcf0e4ed2d46e7253968d6feb98c09b1e0003096528f1378f1940f9d2a849c90

SHA512
e9b218953c8fab6e12638c09d9c17b9dfd194d28e5bde6e6a5ff0e13f845721b318e3eea656ddd6f4ff83e2c7798d04b3ee73a25373ff313f519f0ffb855bcd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56ddf1ff5c721f4e1fba428364dfddde

SHA1
f708a4aabe0c66d2ac70979231d8355a43004dd4

SHA256
8026f56cc0834f773368a3571ffdfa7f23379202fa93b009c39725aefe73966e

SHA512
6e49300d2b21f26f8bb779e6904b8916741561fdc0b82badabd6e713d52a3991cbcdc0c8ab5bcadc38db43c4edb01e60cf7157a7b3c8b6be1084e76b1615d23d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7718e8a06af3227f1341d58d30a0808

SHA1
ebc0fe50a44af96d81292125624d7cc7b266e418

SHA256
c63865e24fe6df04bdfd04d5e1937f2616f69894f74e5905cac9783742d8b0d4

SHA512
f6f5ca7d10ef238b8b43d71fb04642c690bad83c549558c43b3c9bcacd094af6b223f980d965b100dd8140097cfcc66ceafc1ac28e560ef2b19197334c080a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
652733cb38a0eca717ec0d790aec1817

SHA1
014a4b187163060e8fd6d8f55bccfb267e765284

SHA256
3a04abe4311294deaa8106be0baba2d4a03a593d9bde8ef232cd4d2dbb95752b

SHA512
74ba8f69f715d649a9922bf3ffcba86fc8087b0b036cb431b12ad8f49031cb37cfde3aadec762ec61047aea37896838cf69c0320996f8a3b3f0526ae04674f69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b444d34a81652f31556ed696e1ddd1de

SHA1
274033574fc2990482e76f7b6f1584b5ac4730b3

SHA256
104ff264e1eccd1a29b562e97e40c36db70bfa53d18810a8dec8d5e52236574b

SHA512
fe2ee2113fed7b35fd80126cf7504636cf3712c1e82663ab4e7318ff4df0579226ef5df30a15a31404322fe6628badb3f26f717635fbc469aeeda6429b55fd1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
093f7b047a9f711a3e5f3250d7a47407

SHA1
1425038a6e192e0fc6c5e46b837f4a8103f863f7

SHA256
473256c7e7e32e1158df0a58f6003b35ff19d504db7e82486478a80b7bcac588

SHA512
1e0a317d7ceeba431e26e08afa0a6f9fbffd769f9e26a3688216890fc5fa4ae76686fe18010637bd8647bf666e387c41cece9b90d10a111f120c98c0f5670fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5053f0f90bfb6071d0a051439d0b136

SHA1
c5d5a3ae125dcbd265d521ae82d36dc2faa32590

SHA256
b33909d8249e3987d8420486e2c46d6358009adebb3f76a9d7695df07f8eb576

SHA512
aacf609c405b556c172be70c952ca53345f5b81923a0920b535193bb25b834d61dfb54a8d4e4faa74f7082b2ed68a6380ca9f4bf08cf98600aeaed22ebbbd3a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e2dfd50bb9bcb21c2104d85340001e5

SHA1
a67cd3948e2f0c2728e6702af934b777884dcfec

SHA256
3a368927d592e9936e6246bd57c709005284f3a53dde73fdf1cb05628dfa4a77

SHA512
4b27fc1705a640ad8861cab5bea8d721d54573ed7b6398a7337c7477bbba4426fe3029a3554a858104f766922631198bd33bf20e3c284f2485271bdfc2d513f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e98e93115172caa5fce8395b992a6e38

SHA1
07a0b676a8a8042ab69b0997cdfd0e6c978e4910

SHA256
d66120f66ca274f31044244ee3340a69f45b8f3a5363da7cd9161a30f8f8d1fb

SHA512
71843d089ccffd1fd3509bec94e53d584c2e060298b3f4fe5d4f0db0c86c1619534d5c550487c0b4e6ff9315ae38feebb4cf965ce5a245b6d20316b8d1655ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD896.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD8D8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit