fdaa93db4b62937e60e0631fbca2e5f2b4b9fa1b48cf4bd9cb156bab1f6d517c

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2735ee590c96e9d60a0e4edd10d2acc_JaffaCakes118.html
Size

9KB
MD5

d2735ee590c96e9d60a0e4edd10d2acc
SHA1

0d5cd7d7ef075e5efca691915a4f6be7d4c39e63
SHA256

fdaa93db4b62937e60e0631fbca2e5f2b4b9fa1b48cf4bd9cb156bab1f6d517c
SHA512

bef5491f838f2bd30612080cad21723f496e0d458c0cbaa11b108c35b1f7e5f909e1da9ec66614025d55a49047ac087cd5d685d5ceae077935c1032c8344c1a7
SSDEEP

192:MYBBVjdILPgneX6ue+T+De6uegPUQ0ynhKhKhKhKhKhOSbW8XE:dlmLPm52

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000002f762be5b209084138d69cff0bcb8347d6cca0fc0776fc05be7cf31d9edfd52000000000e8000000002000020000000b93a71e36fa03a25fd1232e5c712d94dfad00e7cc62b471a1fcd182a5c6d7a7290000000510a1a9b4ab3306e1e5b923f161254233aa9ae21e2761c1a2a2849aa5aa45766e8904ef8677e3cc2492c5a3e5d8894a209fde543058c0795a78af1aa7de727be1f793e4720704f3d51413e8fbc70a1a45f25927086e238cb0cfa9b82e9fd9899e4b075f08b8832780b07f171e9c668e0f21b2544b9e6d1d28f775035e92273bcb80e93786bf60af9dc2000cd152db3b84000000006725cde6ca68c27c9db89ba1aec6680bb2f25de282bcbbdc565cc0f45b590715db0830e809c2d5e509e4012478b1837e693109409b245ce4305442dcd9b8d6a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403ca43e4a01db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431891490"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A282841-6D3D-11EF-AC29-D6FE44FD4752} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000f1413e256adc9876b6113e240d70dc98ece169a49c6aecbee90b7c9ffc9d1aaa000000000e8000000002000020000000a4e13191e43be8f907306818be9b53e392a1acdb2089627c8352838250964e6b20000000f9919b4a80cbe766c723be58b8b091399c6e998c871f0c16e71810dea639875040000000f6b8f67482f98e241504f804a163a21f90433740b8b24ce299df543e94a969e2c769e7ce52131329ff17372a5b3389c5771c1fac8bc2a752677cb8f8a7eb9583	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2680	2172	iexplore.exe	30
PID 2172 wrote to memory of 2680	2172	iexplore.exe	30
PID 2172 wrote to memory of 2680	2172	iexplore.exe	30
PID 2172 wrote to memory of 2680	2172	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2735ee590c96e9d60a0e4edd10d2acc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c872c3fa5c054835bbafb7c109a898ae

SHA1
c62a4bd3b228433096c3be836590618a2abd71b4

SHA256
02bec776cc96db2336991ded095b3df285c04a1c100575e6ca7797cc08935736

SHA512
213a269e2b75a802fe1465cb267be07fa1bef235fdf7a9e72ac9bd35122b9aa71a6487fe4726b3c2367b489bd94d0c599bb44531ff599ddf7b5541a496c989d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e3c53dc388768b2d066b6017dd46152

SHA1
541fc90152ea027ed31a7acd6efd0750a849d6cf

SHA256
a528b49e96439bb5aa380a34b177586cde2640097526c6782bacd670b619ff4b

SHA512
fd8ae69b4d71f88c88e29fad4b7350ef71611fdac8c88ef6f39a0c7fd7f96d40626f8732e6e02c140a4ceff9dfce2180bb3e150b1e0a4cb9723aa09aead712a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f396117ac30a1481ec845b36a8e1c93

SHA1
06966dfcc1e2e865447ddf6f69cd3e138ce9e6e7

SHA256
1145d4eaf3b21724eb8d1fe47222d0542c27eef4a92c0486d1dead7b9b9a29ff

SHA512
004cc250cb962eb103eaf8287719c1ad8fd090722e90a9d9f799a7d18c30889a7785b240f5a9510643215d8f66d74a5c4cc0f54bd5fe28782d2af1aa6799cae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4dc80bfbdb953c26ef3023f7a21f833

SHA1
ae2761795366d28f685b5dc90c60a6d9a4b716b1

SHA256
b0895c4031be6cfa422c482e9fde28113e90064a226eb547eed99fe549ddd68c

SHA512
ce69673d5292c9db21a28fd1667b05ab14c6e6dd1746676992258bc9698a21e72806cf3472f73eba90aaab6c14b11993d6ca0062f671c5d798550798fc9758be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c301adcc015c009b75a1da97eb08a582

SHA1
243fab80cb43a99c8a504d9a0272dd74e52a30d1

SHA256
0f3caf8f92895a0eb408b47156eedf6d3d454ab927d88dd15587253af5845cfd

SHA512
056dd1d6535294baf9b6e9c8ddf06b91062bcae26a66b94ef91aa3a83dd83154492d9ae07d987a7c09c9be4ed7aa94a0faa6e944d6774457423135a9846bce9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6c4f4fc9b3c8daf0099d66024c1acb2

SHA1
f6fdf6a838c2514bcb6e444b272d4a55e11f39ff

SHA256
cd872029fe1475e9f397d282ee981159167c822edab63fe63ea99b8e254a7c1f

SHA512
599a299905a8d20f8e00ab3d9c00cb8b535674229d3f93ff5e8b8467e27f6eef54231e8fff9ef84c1d2cc9e907021f3776e9ca143817013d17126e41eb9dca9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44cc7a655248064cbe947e8c52e6b244

SHA1
76345e10b7931bfc4309aa9d08a9827a4cdcb444

SHA256
89c3d7c958445f77a6eb9b085682310a067435922edb15ffe135e7b2781bc094

SHA512
4ff911b4100a7046aaa693e2cbf1c25edfbd7451ca7434be06cf2a9cf5d9500eb20dba94d70dcc5683c91c97617892896ae1d98bad8e6884affa7c444ecb31d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fa571696735efc692f04f20fc218a23

SHA1
3ff1b8a13c8329e8966dda01e5cc151dce1f86df

SHA256
ec13040d08cc63327966b601dc29b5ca5c25b86cc21c4bd5affd2ca2f416af5f

SHA512
79406cf35cce8aa5136c1aba050ad9d1ab2a07911c05e81fce89e4ac2dbbbb749f5fb96d5a2783657e3b2b94d2d2a94de695879180b772ad79324d40ef2b3831

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f82c9c5cb6bd4b40ae9e45b17ce4be5

SHA1
3e5999cb80096c00aa504d5e18fa892c00b00b18

SHA256
5b2fd9f0085f234a31f4d9c4cd753200f67d9bd9daac790a93aebd813adce193

SHA512
46c0460677fca99c5057f865de143afc37c1323c40ea54a950bb245b12ab6e0c4967704163606f11cf8d86208ac6fa2b6f7a1757e09729463b639e366473b1c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc146df392e8c861c000d7924a53d778

SHA1
862186aa8fedbb4571c3381573fb4b7025308b07

SHA256
14a6401e9b3202b8b03e4d2efa1482b7edb79540640a171cdf32b6bd6911fe09

SHA512
77fbf9469fc0dd0cca09b370abc134597b07f930bf83fad1dea723109d300f4a96d6a11b8ae1f524b0cebafe654e993ae637fd336060d77da374b19f110d7e16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f470e9950c46fb3eb3540eb964c2d77

SHA1
81a3eb80e15a1041dcc2c07d3ec8dcb621a787ec

SHA256
f450daf61c0b03a5d1e700530117afae4b28850a99fe68afff72e9858a928089

SHA512
44b17ae1b516f8d94a7eb917fe722104117744df6a8a6ec5d5dbfb3e4f9aa1525f6d584a999aed0ceee615e779a90fd8d24b5e775032dc0f4337fee377179c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22fd3264d2dedefd74127469e16ff686

SHA1
3f55a9d7f3772c5e076d47db0c92e3153f868a98

SHA256
39761f525198fd35bd1f496600e95f754f6b91fd3502aa9d414ae1e38cd11621

SHA512
64fca139f73de89de1af60843704ead50834a3ef025f787222d4cbde94b5716afec2025f509e8cef268d8f6b9e9e6e47b67c5eac4f030597861a50ffd11e541f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19febb6fa1adf032bbfbcd194de76ce3

SHA1
667c233e469ddff9e7e0d7ec79c5478231bb9b9f

SHA256
d65af485addeb79cd276dd76c1f9064f71f2cc6c775c391aca4bd2376ab1b547

SHA512
685d0853c69e417e082ee616617be7dd0992f4831b4cb315b97e293670a01fc0fe9eb18b8fcfb64c5396cd3eedd4cb9bbacba2ff20bdc7dd7cec8278e4735d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B19.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FDD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit