95e4fc1f3a6df482debd87f16dbe29a9faa6fbd37f0a0df98196982e3ac03229

Analysis

max time kernel
117s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d27020915e448a3da01889c5715b237c_JaffaCakes118.html
Size

11KB
MD5

d27020915e448a3da01889c5715b237c
SHA1

cd02def6e13866ffb0eeacb46df440b304f6890c
SHA256

95e4fc1f3a6df482debd87f16dbe29a9faa6fbd37f0a0df98196982e3ac03229
SHA512

76798b207c36ca7b90f7215385254c0ee0afdc93e25d1b72a4fdf181137ea07ca576a20757b8708af8f836394f74f911698efa71b6f18920a987c4191f5d6961
SSDEEP

192:SHE9aaRcpOfpbIt9SM9DvfueufFhkNwaED:SHE1RcpOitJjfueufFWN2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{647F5AE1-6D3C-11EF-9452-E2BC28E7E786} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000003dd25e7f05dd6463a7f4646347e6fc56dd785aa6116b87cf78a5418a7ab5828000000000e8000000002000020000000fe2ff9d4627ebd8e4ee41e85fee180d8ff785df49453fe6b7aad19aa0487629620000000b3e9173c41b7075403c0340c161fa15ef2423469cbf24fb906efbead4c6e5ace40000000f8ce7e16d1fd248a44f412594a0fe6beeffa69b8cf812c532590bf47eac668b40bb6f65a475b02b2e021897f4ddfe6a633b8c1bdcbddef8048b69037556ea761	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b1133e4901db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000007f3365a853fd3b9e07127922a687ae7cd2d1cc4750b4e5f848070ba5c7b6c8ff000000000e8000000002000020000000aa896a7d9eb56cac41823e18c79fbeb4c50dc2cfd7e97c28c8114265a35ee964900000004a69e6cb0290f9bf9e4fa87c8c95a90efe9bf7c3b8fe665a49557a187072039ed7aa2670dc2844bf7bf153581ec12fcaea55fcdf03ee4148a078defdd95df271b4641d2ccf69f6c27f3763e635499bc6f393817c1b18bd156dad74284aefa0ab9371021faa6bbe45a49673431b6628c274100475f11c953e209828a0533826560800a7c13bd2b67dbb0ccb6f5bd9cfa0400000009a26ab479911fc98d1bd011a0e1adee1684ea82e9b445e2c522d46d75068409219f287e9871d2da44379c6eed1e98b18ee9a08231b95581c83101820b44738d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431891046"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2484	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2484	iexplore.exe
2484	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2308	2484	iexplore.exe	30
PID 2484 wrote to memory of 2308	2484	iexplore.exe	30
PID 2484 wrote to memory of 2308	2484	iexplore.exe	30
PID 2484 wrote to memory of 2308	2484	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d27020915e448a3da01889c5715b237c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc93452f142bc5aa534409289155a607

SHA1
ccb79d85907c52b6ebf345e1d38fe93ba3fd9997

SHA256
195d0ec0b9c7fd6cbbc709c8cc537eb589904e6ad55075586aabaef68ca49e12

SHA512
7b3142e72dcef4b894158c283dd0d3cb48c2502a54f3fc66f14c728f7af538e709b4672796d9ff607eff5864d3a5541a6df5798303d328fb2e9a3735e8196bc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4254a31fad22e2e05e27cf4b732102d2

SHA1
1dc8ee8db796f51bd097d442d44ac2634758ae67

SHA256
43b0ba86edd309e8ab70ce125da94beeba642aae108b583a7be2c8beb8d799f1

SHA512
1d7f94a60be3ee47c0746dbbe3aee5462f589e088b7e9f89d60bf0530597b8be278b15d1f55276f6a7865e616c350741b693c85fc407edf6e54339c132c1a455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97d606848dd8f1952a9815981109e4eb

SHA1
8552fd4dd58101a85278b48ad73095edd548c152

SHA256
b7817da2e46d6bf50d2f170e147a7cdd21e1fa39fe6d2e63ee8e959e7796f75e

SHA512
2706feefc3b6f8f96130aeb6652e0256f4803c1ac249164951cf98a69053b0a3d7dbd867187db004b17df7daa07d31ba8a7e15de9f6dbc7b6eff077cc0e53661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97f725c79d60e93b5861b7f80090d083

SHA1
d9eea16cfaa3bee2d9d0969d3c9dc8f89b0ca689

SHA256
f89994a4def6d57af740c1f6b95ce934b25d0d9e1bb0036b55e40600a6401b81

SHA512
2b88b5825645c01cd06dd6b836de887fcd6e5371f63c1a93e88b5dbfcd9239c88a714e4f8d30ec1f3c5f8c2e9064c3087f5915aff101af458cf556c0d5a3eefb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d30dd9e505166d48fb476ac8b628095

SHA1
5b072ad0bb6bf43a3159fb2dcf6dc30cacda7f46

SHA256
2da831bc80c751ff783f43bd5bce6ad31db3b00d0eec39806311f08a75ff54c3

SHA512
3f0e865bc10a052b74c27e73f425cfff2db190d6a1db373fa8b6b33a17c4550abf8c4007ca37a0796f998523311810c901ad333fc624f919868485e8992b534b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1b65ee33878853a0c0d4150c0aa767f

SHA1
faa8204115dbd97a8158567c58bdad70caa93255

SHA256
b5e723647aef4f624717f46e09d1fd5c410023ebfa20a156000c3ad7804a209a

SHA512
f403e74c5cd294f8d91f0e380c5794681cbfd9baf4865df5a45aeb272c0e17c2f40b2c6f05213fdb044300618d6b62391c41fe09b116dc169ca564b58d6e6747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8475191a12e836bee577b35e29955c2d

SHA1
51099117c090c2941c9fa1eb8c67ea245221a6ef

SHA256
510e05c5338449a0ae20879626e23cdd81ebd0ac77d8f553d140c13359a1818b

SHA512
283f1d2f70469e50877a748e63e4a0813fe77c6a1c0c8b04133a39c344db03f76f47dbba86c54fb19132a6a9f6697e16c3867180bed9afbc1513ffdcad5337f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\validate[1].htm

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF116.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF1C4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit