0545329567b1f396f4561ff4b7092b4a7497e798c1975b71be0c26b439bcac84

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d281f7cce7e1707a36c0dffa08c36017_JaffaCakes118.html
Size

19KB
MD5

d281f7cce7e1707a36c0dffa08c36017
SHA1

3be6f23d8e98a06a5d7a0f161d9e273114cb4f7c
SHA256

0545329567b1f396f4561ff4b7092b4a7497e798c1975b71be0c26b439bcac84
SHA512

239a86d3cda1d1a22d3ad8698e8caaa99fbdb9d6404acea8f054d6b65b0cc5da4f2d585f034950c0d29b8e4a6ffd42ae05b4372b8fdfb07388b87d12d6307e4d
SSDEEP

384:zi3KhgESyVBD8cSQ3RoFkVgdEUNemLEXucfIk9xhefELzVc9l3:ziUSygc13aMHmFOIk9esHql3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000002637263bda5daf7e934c02ca472981bf8ee5b12c7f7e5862089a3d5df7ea63fb000000000e80000000020000200000006359815c15324e20ba841fbfb2ab3f69b82b11b065442def30c2457532a54f549000000048e2b0b4449de866113f26dbfa7ebdc9b527c28f7c5c6e9da3e177267392cabb85ff689a1de2ecfdaf52d26d61dd9e16037e1c6013a2194ea0481fe5a7077d3d88304046123136bce7b54c7669fc76e6185e46f28b1ac57e6499841235fdab96f41baae1444617c0db846921b1e4526b87a6bd2a689b67ef583a91c13349f2f8fc61f78c438b5e791f98c39cca19dc714000000021281f0fb6a52e403e6f63d083a45c4422046a750bb4205d72beacee29fba6faa78a714d26486c4f4d340cfffb963854091f6a694927d16551ff4cf54524888f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7056015c4e01db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85906F81-6D41-11EF-A6F8-EAF933E40231} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431893247"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000034fe887d203e0022d8975dcb5b72dd62a52afe5db0637ad167b13b53f0375dc2000000000e800000000200002000000063a9bd096fae9d450dce557ec0c4cb7178db9dcf117fb2e57e5802bdb1221b6d2000000071e6aba294999c0346b64a3efda6d2906b33cc0c8dc0276d1f22ca95bc48cee64000000092db8cd517628b6532a8e2d72de127c9a691d9937dcf41eec92c2c03f7be0325736eb09fe16b9d669358977a05f01ad9aef7b4cb8bd11ff282e61bc42fa68ebc	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1544	2012	iexplore.exe	31
PID 2012 wrote to memory of 1544	2012	iexplore.exe	31
PID 2012 wrote to memory of 1544	2012	iexplore.exe	31
PID 2012 wrote to memory of 1544	2012	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d281f7cce7e1707a36c0dffa08c36017_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2afe22a0d7aaa22b87625ff4ca4b9a83

SHA1
39c4e520e26590c802950663d088b5ec89404953

SHA256
b0b27c21b7d2fe15e07a176fbfb2458b8bdf42d98677e640de78138fd0877f36

SHA512
3d8be5857d9f403a49a571a12124bde34b5ec470b37d03d9a5b03bc4bc87ecfbe9efade43380680c2ee10e74566a6a9d87dbab885f1508320cf5b18b98d677c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09e5f8e9ee945586db9c5cc9916f9396

SHA1
3d874121dbccfeff3eecbed7b789d79ffa96945b

SHA256
9cb546287265c8e2fbe11685ae38c7856e284d2c6effb93263fc7ab0602cbad4

SHA512
b188acab14a026801d60c9c3d4107fa1167f7e42e934a2d20883da25fff88d6a6777974c9ec777f3de1c4bc30e97cc2291b0a92fb6f1586936aa8b8f5dad8f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f3344db9781c7a5f4dc97e9cd9900ca

SHA1
1002d7367e8ba116f2ce5b70df596d516fbf4fd7

SHA256
0d3d042e2a87cedde1b64eb83dab7295c513ffb9bada1055d6f241e2eb44671b

SHA512
85c7b47579d12260367a919ae70406e0034ef9a7a9e7d31ec8d60d1c2bdeb2e7ad8b992f72d9833332e55cf10d989c0b6fa4e531e3d429b6016ccc82cc9c40b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5de78f0c103dca911b405127933320f

SHA1
fc36d5e77eadd177903d6072720f9f5e2a372659

SHA256
d002bf0b206fb7a2e306c4145886c95be77ae2af565adec4e134f43013d892ae

SHA512
5ecf6747a03ebd33b0d3df5cb8e14a5011643e1c00d1e4bb2473890fe4f50c863de99338b627b4cade89800762daed23ad79c87bd291a16949356c470bda293c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fd3ecf2136b63b34b84990c99f06b3e

SHA1
8dc148ccc2e0dadc83a2df39b021ceef610d8980

SHA256
78e5d50fb93245e6bf82aaf72a7c30f6e48c0db8fb93af51003ec763a0a0230d

SHA512
28f937cd11beb5df2cdd25239b16491a9b289df611250f84621c622eb793abd185b15665f9a778291e24032dd669f14cd0d96f1a387a5f5117d5df7702ccfec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
566ee5dbcb8ed067c0ee1edc6c3cb4fd

SHA1
18b1e774007afc2e04c9dd1ff791242565ab48cb

SHA256
d00c8c8d0bee3b1def0b4d3b1244c902f925602b6fa7109692fa0342a5f04b91

SHA512
7cd7eee56e67e70a9bdd6da27aef71404b8fef8eb1df5c30b7457f2f016316d3ab049ac3abb4c7e3272f01c3153b7fa4b026bf52de7d64765bc9cf6b2cb07824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
327ffbcb7f9cc5b6a09d772ba36759e8

SHA1
0b99ea21d32b5294e193e59969bfa948a56ddccd

SHA256
1753c8ba4589263cee8fd6171f70aaebcf344d453ef0a146bd5fa3c3dce78637

SHA512
1ba1c6ddd44e020981de8574791c8e691cf91aee31d1ed35e44ac195f16214e22760dde20a63975b424153a9de16bb0d7989a774c6abd6c0bc622e91035b8c32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bb7b3483bb187e26102a8a2f6fc5627

SHA1
998c2cff8571e8e116d4d2405470214ed682944d

SHA256
2a279d9153c261a22efd2863c3dfada5cd0a82dee49a2b6161712795aee304c9

SHA512
a82f16c5a30e2993c0f64f11d864f5dc065a58dbbf5a3fe080c7243e4409d90a8b8891030910a0c8f14068c3f73cf5719c39c67ea1fbcacad31d0bbe0af135e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf3b1951d6aabb35d07a3396d9637af1

SHA1
7c4eebb5a1f57e19db58464ad8ea3f688dd3325f

SHA256
a502c947d8f9909c9f1833aa35f57ef9c0dd1059fd8465a29faa6cf232b9d308

SHA512
570cf1a8cd7851c0eaf43441c654105a115d03c04dd140847169cc205c6c8a9b5192301028da75813733a5cd099e83ac7d23ae07bbd20fe209ef3563099b80f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8c253bc7195f4cd38ff0719b90dcf1f

SHA1
93637473e7c63100db2dc29a214a816ee88d19b9

SHA256
aaa3a151c8ff77e79a32ad45840c69a250467e599d8ceab5c3153c33a6dd0ece

SHA512
264de4ba9e31274a6a616ab5352d2f5e536a97949853ed3bfd576db172d5e050eb94952ae4080922545dd59f15f298f0ca51664789b36ba74a236fec5651ecc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2796674aa0188aac0df65e01186aa659

SHA1
58bbb24b9e3fce7d61c687b0349f846e6461713a

SHA256
1af63efae29e9414ef875a23667f7d8d1f446f5765c179bd19acee5c62e3c78e

SHA512
51c5b572309cd73f35afa7959fb863b0fd54a462291c701683db12f906832d43da87881f5467736ababa152bd805b1a59bef34b00de02f446abbaf2d65ea6121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14f422a8ebde085c12ecdf2789d35517

SHA1
88b254a4588d772315b99002b7c67a5dc39f0174

SHA256
9f40dfe0e43d83b48a90fddb782342bc5cf75f3a24d4090e1795fe978271153a

SHA512
d2b2e299fa1959fac716425e8c9b800ca92e892e8ac69dd182f148e51390892534b06ea8653a93cb0ed4746c236c55797c98962d3618fca45aced874da710a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e2f91041befa4c311c1708129c5869e

SHA1
022c36623c151acebb2d19a301a8064e7d22ffc7

SHA256
8fe59da5569b7b446dfde89d9b8beb332ead73542c5530c9d82b91d98008ddca

SHA512
6d9c7498a76a6ba6b1a603b9d41182c354dbf84a5fdf9174cce7627daf7eb43cb8b3e26b764d7faca8e6b81e82e5ad18c7064a0bf28a78db72483ac1e1183584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0048fccd583ea005c6ea54ad3026830c

SHA1
4303c759e381f6e80068451a157a43cd0b944b84

SHA256
2d87eeae210b69430fe95f5cc0545cfc98ae07eea0d3d178484ce3292d0d5d31

SHA512
511b6f90bf874f32cf66efd262733ca79b94e6dbff84bf4d0654a573bb688caeb1218b7bffa644591a7df8fb01933264ba1604862815fd090be79c468285f3a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c30a2e2191bb180b2a5c3c5e04fee2d4

SHA1
31406e89f5e22268f6c1f78844db8f1388fab2dd

SHA256
34589bebd54b35bb7175fd6c5e216b9d7781461122f99f9b6dcc9e5bc8d51714

SHA512
005ece8a2fe110abc1c2c35d4cb0f494d54797027c9f102ea35030f6d2eeb79cf19f3619a9ba5904bff32d00fff6b2ac47f1be065e1a1df9fbb9e013fd669219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc27c95b5d25defed4a946da0ecb2827

SHA1
f2c2f991e77deb3ba7ea9b6ce5ff59f66730b63f

SHA256
980c6739b486151849403615fdcc87296258cdf9385cf14aa3fa4522e408a5f0

SHA512
6858b5da917d2fe0b52a3d74f8ec8ec04f591a1f09c285fa5c9199f02313b9acb74cad39adf491ad787af70745919764e8a537fa2a538c0c008ad36853e8ac73

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF9EC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFC5F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit