62011dac49286666a10fdfa8afc81c69a9087471490267946adb817b8b5b33d3

Analysis

max time kernel
137s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5422b492638a488c11a7a4e2822a06e_JaffaCakes118.html
Size

121KB
MD5

d5422b492638a488c11a7a4e2822a06e
SHA1

8aa5ac3688d2d335934df4c24afe650dc21b8db6
SHA256

62011dac49286666a10fdfa8afc81c69a9087471490267946adb817b8b5b33d3
SHA512

323aa69765d75225880f6f35f9aa04ca17e61ec2e782a9d688731f0f4609b9be640f1f8fe37269754a0c820e5f8394fb3d28d5e1a0a132344c99f0b6dffb8058
SSDEEP

768:cxQaqgtT0/vXJTvIgtPt1QMgfmRZz6v4T3Da2r8Cv2XlBDJRQG26BSUa2YJ:cOfG6xTbLQM2mXIUzayRIBNKG2qad

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6246EA31-6E37-11EF-A1E2-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000007d299a19cd38f2af4fcf84e1a6cf0c5a685408a90d927ca00e41524001eb5f2b000000000e8000000002000020000000a767997f67821f592500d781ac433dde60631b394632406ad3d0c37ce5593901900000000f8ac877c88865a2059e2d347701214ca5200bf1e93aa6002d48c38b3edd7642bbf06ba7f38086cda943a2bdff21e1e7979a38997b9bca99ad98645c26817d921a456ba8d4d322e090b386da5a96289edd2d5f7b9f6288a04a42d05ec34596ee4c412daf139b87b979f902a7999b6a84153558c9a7c8105fa61082452043a02dccf30a9f7d7e67f7c9440ed5e409d80d4000000035dfa806115226fe7a848e3c980d224d8e78fff95414662689e4c9450f5670ef850d10d4e17c6d7753ecfea0d0c0234f30a7c63219f08ad2f0ad2dcf9c81447b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431998833"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e852554402db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000f50212ad963bf477d64d19bdbcfd4ccb45b9910ec05c45459e49c68bef89a7cc000000000e80000000020000200000009efbc65bda960e5791169146dc08b7b0f04ca2c188e9e4e19b9deaf96fbfd46420000000bae596b0f29dd20846e9e8896f21a164215a30fcdc7066e139f939b08b650b8b4000000097bf8abbadaeef21979af23a6a1d3b2f37197008287842099263fb803e8f89d81c3f4be790cb58f58865079248038a5cb5c2909ee80605128b9ce8509303f41b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2800	2068	iexplore.exe	30
PID 2068 wrote to memory of 2800	2068	iexplore.exe	30
PID 2068 wrote to memory of 2800	2068	iexplore.exe	30
PID 2068 wrote to memory of 2800	2068	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d5422b492638a488c11a7a4e2822a06e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
196211934eb7c2471dd4c482a48bd5a2

SHA1
b26eaf0901649d5405e6f2473a6fbdd3edb7a8d2

SHA256
3018c692becfab19c5e8977bc2b37e2eecea855725777c004de4284488fc57e3

SHA512
7ba18c57bdff70233319b085d89ab315fc5e8d65596a9cc4eace805b420f479b59a9113f4e3e5b378eb46454b542effd9e27d00c9f9823a1974973a056c4f1e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7902c15aab001b49597ac6cb3b381c40

SHA1
1e015f815b30cb3cfb422ba0a797f0578de64592

SHA256
8a5a2bf60a2b3b9c19361ddc36ca7a705a1ad69d70ef8ade7d12aac6dfda1b57

SHA512
e43f01a208ce036068ced0d6fa966f582a1c826c831881e469ba7b6cc75bdc800279ed35af52b5f53ede09a55a7c73648c9ceb8ab4f0a72d5cee9c72fa9f8dfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c7de5e1c6ba891437956f3647e433a0

SHA1
052188f0eb5467ee091d2023fabb4921637d439f

SHA256
1db2577af73419d183a3a54e81b4c11ba08a0ca8a64b834be5cb18e446fd9c24

SHA512
c60e462eed677742c4e61b2ccf6f901055ee87b91604abf6b162cc496741d551fda089919a0f07c1f93af50faf50dab80552e9c829fe04fec961aeef18210125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
500d8fcc516d3c70d3f7c58a4f5c8409

SHA1
0c6d42ea747f22551707106e2ef4adca79556715

SHA256
cc072ed74d9801827273b30b53e87f4d9731c4a54ba20ecb98d7221f08708d5a

SHA512
aea626c023775f933fa7c12e99d408ac4c261fc749d0a5b2821b5709b80583309b53e7b4b33e575a987bc87137c476de0239e2204450b6c9719aa43d4cb1c43e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2ac731fb633ea1e0d914a777ca533d1

SHA1
1ffa4fb4d8d8743c5012268a88aaaf5d65cb8564

SHA256
8f9a63590a7532ec9e1d2f68cd5da4ce52d21b9ffd687a6a1e1ee98e1d881c65

SHA512
b2b2dcd371c61ed9327637f0385f8394a526316236c9379070575573a012f8eef6294faee8b91ad669f175d9d86c2e63cadb5d7af013e4d72e82ae665fd74c30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9255e69f178a457acabc58287155b49

SHA1
3fc7b69a7c1f320e9541ca34b22d744fd41e7268

SHA256
8196c1e0eaf88206d843045bfe0dfc2f2da37dc963c8d9141b89e7f19e75105a

SHA512
c908a20bfd26913453a236f49f4b84a913ccdceeb2addaaeef78b091ab36733f5f1f202aecb657221086b8b36490b148c59901e1c6ab4b8747f683b540a48d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
242727070e7de5957941bf3616a7c830

SHA1
c659a14392d463bc5ea12bc3e19466aed1e95f1d

SHA256
7e2bb0c3a167c25189e73a8a8c5774746975034af56bc74f8b46e7bbf9d7a0cc

SHA512
86b254bf69917f189cbac51bd9c73029f731f21f37a512a5e714706ddeabdf7aef6c70c09dd4c86c8bbace1bd113f514873e212e5041984c2a4191357e409b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
592d0640150150b68582b0c9f64eac09

SHA1
36ca68b2f63064b5779d1c7a3535a1e1b5649a32

SHA256
50b53dad1c743c180fc919755ff59b6a364220a562b475ef427d8f2090231a86

SHA512
31ae607d89fa4ed0c8de66b7b486bef1f8058b320fdfdec30bfd477a1b1e7c5e97d3586ff5e3933262c17ba25cc350a4a92b8ec0820cdc005df00def0888833b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79829912ed0b96705a39b6a4d8d199b6

SHA1
b93fff603149dfa8a224c280799229ed036e1ca9

SHA256
7a5561cec2fac839bd05b395eef74a3ce819fc9e1df25b41341d866760f61569

SHA512
05c451793ca36bba5f399fd21ab3ef556fe4dfcc597d3ea130fef6c5cbdca6a3d18bbc42432f640b52577250c984e74ddb538171ae5083a132a52f39c433308f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4402eb2811c41084cff7909f05582f91

SHA1
720cae68fad5179c8c2b9990b1a2535f2af8da0c

SHA256
76ae2a2046a33638d08cb4a1a00731a506bf34847c60fe01e1f75c7f2c12d617

SHA512
49f564ac0748bd396ff6a93ca193175afb17d91ef7fcb4b049b2c0a945c72273a37aafcf9d102e6b09d151f77bc790a9d555fdc17621617303a1a6e8495a8c45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e2cfac9ae75b083809b5648c439f709

SHA1
c948820c6ce49b17f2e80edbb6f6bb9be3f732ea

SHA256
72950152515a3d85d8b5d77053cc9ebf1f73e8da570ed3d0c14ede6fcc7b5775

SHA512
d97b8a8679243edb2a93b20948127e23790fcb7354f78ccc4c6be8aab66f2f7ecb2a187b10e22822161c1b18891f05053fd4e51a39d3cc4b89867f7b94cda201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d35720a5c368a63320b3941383d12dca

SHA1
0ee7be2e74d8f3b46f2912ba863bce0174562d3f

SHA256
886ebb50138c2167142d6402e9f3d224e86a56ebb511e679202ce284d3920cc3

SHA512
55547a542709908feef68f33c1b28bf8ffafab9ecafb2993e3a520d4be2e351e81519adbafce015c22304fd785b91c890a4f2dfcf11c97638c78007982108ea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd8b7d5321464d93f29429ea9386c906

SHA1
33be37b4b0028fac98a04d58321718499eb60c2c

SHA256
94249f33992adcc0fd22ca734d6e5528a29e5fb652f3d698f44acb9b9347c3b5

SHA512
e23d8ef016fb9922118a2313bbeb5e4c5b5b27a0b0a776764a3d300b20d1ee2cec491a4e485c9c1ec5953bc01ad2e289ee8bb506f78f8f36bffcedb6aba15a3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd5335334f439614250ed1e9797f90f5

SHA1
b35c565d766ccac4dd4201e066ec95f39538bb20

SHA256
9304a2b83c83425e454c7dd52513b1292668406321d7abeff86daa847afc7f43

SHA512
13de97800cc6a2822c139fae3b93af8af1e3ea1c39083fb367b36fbc661a590f2f5560d9ec6caf67f1f6c6ea53d9b0d7a1189f39b3e4fb6b3deb7ccf94e3f382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ff0cb479e38e952caeff6f439ba999f

SHA1
318a844d45954cda5c4bc91c72c2d78a025424af

SHA256
c1a9e095b115c667bcd7fa7a03eb2716c93f35e3ee758c08282fd498651705dc

SHA512
8a9279c2737a863a4c2ca7203288430d0a3a2e7472c781a77cb1fe4d82ce43e9ae6a274373e6bca16479868b0d932d68be0a79b46d41b7cc537481adf096aef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc6a1f12fd1ccf4f7483b22a463dad2b

SHA1
9ac3b8d373dddb562e8b77bd40723fb7819fb009

SHA256
36a2776f8e728a47d304e98b14b1d2bd33c55b4fafa535bf369d77d9f33663a9

SHA512
df16dbe61e28ff9ff08e3d5ba4e39727016b50f44e5c986c0c57864496824807ff88bc994fcd7c68d9905df1778d78b8eae4623a4f5d0ea4a15401196cb153c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e2ce27ed7952e17c4b2136bfe1beaed

SHA1
c5bc7b062ce8c9db2e0887033a4fa5b0e8adcb57

SHA256
05164fa91b9ba9c33c3811eb8561fac691f6d5110b3abdfb4dd72b0f759b1fe2

SHA512
0fe6564e379801f6ce440e94f84c50747e7246fefefb9e723149dc81ba41ad91c605c373ddb4e6a591dee80826c6b18c944b086d108ff82440dc3beed76fd4b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD348.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD349.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit