ab21772a4285c0fb99410042c6b68c7d3704da07eb6cc2cada4b62043b0c16ea

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d27553ad6702ba09f2c9f0f4a7b69176_JaffaCakes118.html
Size

461KB
MD5

d27553ad6702ba09f2c9f0f4a7b69176
SHA1

1c0cf6b5ab66c90870d21cf5accfddbe2d4ee167
SHA256

ab21772a4285c0fb99410042c6b68c7d3704da07eb6cc2cada4b62043b0c16ea
SHA512

3699afaf52bc959f4ea62f491efe5ac73e9e87a8ef150a7ba7cfe3bbc5863186a603f8cf6034499cb38adba6744235a00a9d7bf70739ae1b04c17d27cec2a94d
SSDEEP

6144:SgsMYod+X3oI+YzLJsMYod+X3oI+Y6sMYod+X3oI+YLsMYod+X3oI+YQ:95d+X3BLV5d+X3C5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000048185ea36d5e6d822a01646bb69491b91863d56b5c2fc21a2db9b51599f3b962000000000e80000000020000200000005542a1269d7480c7c4d5d44e78be0c86e22a65fc2df3cbd1bcd57128ba6791982000000049b4a9a33b2e6bfe28c38d69e4304064c79c56ef1c8f9350e034c916ba0d1dcf40000000e0e9871cdb1530b2f46877874e1e731847c9a4153e3c26a35e35437ad74e9742c621d6e7537e8e5860d097e845259276e4f52dbd8a6859a7cabd0db2b785dadc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{103E0A61-6D3E-11EF-9218-EAF933E40231} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431891749"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0261be94a01db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000001ede2da777b4e2ff10c5626b0550547555b98edb9aa7283a98772251ed6da0b1000000000e80000000020000200000000a2aafab37b9ab66859c717f2893072801f133d5e3b96de0b3f651be0ba5954f900000007794213a76ccfe0e18c42d4b0e9d64c7f14d22d660e577b1fd2a7d9b49c9d220abb6b9c747b8cff299b1e990998c19fb935d94274ee26e5a5462dcc7ea6f65ead52c3cb515ba935103895ecefedb77bacf3a542586d3b4d27c2412ab611bc2686476b03b3243647abe385b09508ed8175a036d1cb6fe1927db641f2bc20e146f7b3585651f635df0dcc8b1f2c91f61fa40000000d16a369e97c53f75cc69566e5130cb4b49593843126acf45c9f10db645fa0270b10d121e3c32036e8992b87e5cb7237c2e4c48279d1948670f6c34a9175ccc62	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
488	iexplore.exe
488	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 2744	488	iexplore.exe	29
PID 488 wrote to memory of 2744	488	iexplore.exe	29
PID 488 wrote to memory of 2744	488	iexplore.exe	29
PID 488 wrote to memory of 2744	488	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d27553ad6702ba09f2c9f0f4a7b69176_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0defb9be707b26d1c05de9c5564ddb9

SHA1
d641a96adb8efa7e2ebb484046161bfed4d97a4b

SHA256
3556e38c499aa2de4d7bd4b67eec3cdfd73a864be9945b82c1a9c518bc6a0d7e

SHA512
e6e5a398f59ba3d7b54da90dbfd16c2e0a1ddd18a9f3d7d0276ef0cf2509ce20a912376746d115ac284e090a9b39d1ac7a080c8252028a9edba5700bd2b9afa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b546079b8f757ed34703923ae8d9d85

SHA1
c8f39e5837140694fffcc292b633ea778a5768ed

SHA256
7e78fc7c70b0d3d6d4d9839f6ef9c41c5f4d73cc22439646edb1ecfc6ae2def6

SHA512
43855c69f5675547dda83de896e76cf9e0292e19e329796e4cef16bcba7534dcd9557978f676112687ebce728056e66388c32d3e2ca360c86da6c4b9c37abfaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01a90c21c5cfefc16c655251c263da01

SHA1
c9eabcf6b455bf7ad4e9319c716792e1bae370cd

SHA256
0f246cd8b8be7715e81e3357c890489068b72c28bb67ed482e3c4b92928159bc

SHA512
9130e915b5e061cd19582ec0ca38a59cb7ae9841a0cf42551e95d8f01030460ddfb29fc3dd467ccddb37b4c772151e0a7257b5a4f06dba4123cd797f9c605d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39a5404372c76f4070bc7cda7aac4cdc

SHA1
450e9ae54dbbed15d053aac26136c3521ec772e6

SHA256
b10c9249ff8fe7d404ffe3d183f4304042b3e824b68563f3cd637385f53a4229

SHA512
e2d21aedc061542823435e6a2b3eb2d3a623e5a0405204d16873f6f0a2d2b17c6ac9d0c75acbb8078267309c5d01621df1b7125c3511249409cf3c47848073fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f7aa117356b9d0ef1b75152de65d392

SHA1
e81f1696190d006291f03af2137986ce258a7401

SHA256
e752c2923b7bcb83c4803a035dd079238441a0e17aa58c2691819753fda36920

SHA512
05b70107f7073d84d8b39ad25a373144e949130c484b7b099dec8ae54a4ca79a67631a2853869594b9d131dd7b1b147c1c0182e2a045cff72b52797d09884bc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aeebfc74f2104489f05fc823f8ff7b63

SHA1
4178503b1386056303f789a368d49c7c14a570b6

SHA256
410bdcd7d4d76916fa3e36bd831e5e9acf3d60dc18a53f2c65dcf8175943b2bc

SHA512
268ef611916c88b8003d5d68470dd1a07f22a1f3e15522a601c1c71ef89a72c4151339dc904383d2d0ad1b81d36dd2d5babee478f3f1bfc60a274f1c285aca99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f5e8ec168cf465adea8ddeffd2217c9

SHA1
50111c3bdf024add45189a617cc60478bf73bfc4

SHA256
1da4f68c3c61f1f19f8def8bbbbae2651377e5532918822c3a420d93384de00f

SHA512
f748e730a4f19ec3f42f852420dd2a587e5058f30ce829134e646fb99310d82e634976fc8d9ac2ab60c89b87bb075986eb3d04fccee8226b8d1c00c2d5ae2889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afdc3bb7bfa55b0992a50b115736c321

SHA1
2f76811a85eb36c9fa44e10ef1298a715c707da2

SHA256
69dcd9ce38be40aa8987ae3f2147b8b9d8cca93cf4b9ac00ac92d4b683a45701

SHA512
214ac136234c6802b51ddea4b7708f4cb382c796150be924b4cd5b5e8a64ce3b9e80797cebcef9022d88eeed6c4bc9e051df2f2882a3ec412396fa2f39ee277d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d5c0feae3529d5bc2db983c3a9386d3

SHA1
6b9ba62a2ccd73e74d4890bcda5860d92f2f75c3

SHA256
e6e0549d4218e63214e92c9c4d58fddb012e18cf28280718f40249345bc7df09

SHA512
d2fca410ff72d3bc7f0eae07eea2bbb2fe3b7005899155f6add23ebfa5f0aa103b833dcd86f7ff3aa8074616866126a5eed362604f30693a8f235c973a9af69b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb0147b9e6e147613262b83942ee8b9f

SHA1
114552c882d8174bdf7b0a5feaae321f72dfaf15

SHA256
30139cf4690af234403d7875dd47cd084afed1022472ef48beb691382346e6f1

SHA512
ebd48171c1e896e3324b3922479d5ca68f56749e73d3ac3d203056363b36b19c01baae4aa1e8df4b4f110f962ea8e6f009a0cf76a3d0fc969f249c902c5bfd75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b136a2cb3d76fc93f2c0a01b384a2503

SHA1
33167cf1738e9723557ac8e9cc2604b256c24d72

SHA256
f411d3c2081ff92c77ac8116731b25423a2084359146eab9e4eb8b532620f3a2

SHA512
a947846f3cf865239ed88125adaa5fb5815a83fa11f4053f23ac02a503c195f4840f823e891b23fcccebbdda953a9a81982dd994247d7cddc8ed566557ce2f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fed6cff5600731faf3e874e2918d720c

SHA1
0bfbe6e9330011d6a049bbd5c97ecbff0bfa9985

SHA256
50e347a4fc4803f9cf84c5bf0100ebe08d8c00f626717e29ea1c269ad0078d53

SHA512
6ebf0d97d47ea05d2f8b27f60dafdf819399b5307b6fddf1873502aafc83de80d7333020ba9f082d058824145421cfd16042f22f21f6e8d95a829ec3de74a8c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A5E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D3E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit