2f80cc284552fdef1717c015c59ba1a8496bd0f91398f2513fe445e38406e177

Analysis

max time kernel
86s
max time network
147s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d54f0d36ed897a6094d43ed9f500e2ca_JaffaCakes118.html
Size

327B
MD5

d54f0d36ed897a6094d43ed9f500e2ca
SHA1

8285f3c1b3dd43531b7d1bd71348106fe430acf8
SHA256

2f80cc284552fdef1717c015c59ba1a8496bd0f91398f2513fe445e38406e177
SHA512

8b3ae71de57ae81461a6f2e0b5562d2045f614aaf4ff20f229a6a59d3dd0e3863d1a78911819189505c79d00467d6c85bc7c8c37760574ae22b224af721f28e5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000384c0e3981090e5cc454e7daf3f5482fb71edfe5c4a9ebe2d7650ad393d4378c000000000e80000000020000200000006ec8a2c2ad79f81548586c7f639744e883181411adb1a416730650796886cb1a900000008350dc011c19bf65fe68b88178095b42fbacbe8ff88833fb7a60f6f5f3bbd12846f3dcc6c4a8c719645443e616744daa77834ccff0ffd2647035a52e03525f9d23bc581327fbade021a93d5c96a616c869bcbed8fa3ac308f02aa49a2a27f739b5ff0bf5c9edce9e6925b6558dc52fc52f8a3cb576f72df58c57a2cbabc77f5288d97997251fc88005e30913d6ac956b40000000ffaee0f1f854617161f8f025ccf82139ad2de9efdd34e87e417ee704fb7f596a0bbe022d6c47a3f251fcfa3fbdc35a08528894a79490ddf3a175017d64b47990	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432000968"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{527C84C1-6E3C-11EF-9DFD-D67B43388B6B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0dd41314902db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000004258886b6e2348be012df98f4ad01b8d586b5a50602100b39688a39259e9264f000000000e80000000020000200000007ac0fd5cfac7643180e019431ece04efa0e2e8ce0865510b4494494e9d7f13152000000042eee113b07ddddeccf541501b1e4cdee44281684541c1d15e30cd8b4f4bd60140000000bc20dda63af30ec30f14c6a78f340b280869656d586d0f495f2c05af4060fe36c0c0b54587fe0dae62bf5a36c75d93f4092e23f9ec56c63f62ba128204e13f9d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2596	2320	iexplore.exe	29
PID 2320 wrote to memory of 2596	2320	iexplore.exe	29
PID 2320 wrote to memory of 2596	2320	iexplore.exe	29
PID 2320 wrote to memory of 2596	2320	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d54f0d36ed897a6094d43ed9f500e2ca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d4670ba3b468c0b055f91a40ab1345f

SHA1
f3ffa7a1cedc7da9eeaf4522374bb2a3d3191c14

SHA256
055b87df0f17cfbf22614151aa3ec988912c13fc9570259695279063712f0948

SHA512
779d20a8e57c21b75a40c30addc8dbe7e25f86805a7cceb83a0eb98d3c69b9863ca9c0a7408ead098f72ac2d24fa6461e16de9a54224517b09624b7fcfdab58e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97155da50d6b66680869d339912e88a1

SHA1
d19c66e1ed3940e607a12f487a94451d628da92c

SHA256
4e24b94ae38bf1920eb7bc25b1d393e0398293e9f8f1d4d8caab8bc49100aabd

SHA512
eaa4f9a36c735641259c4f42e1c00da7899bb91175abe9b3b4fac7184e2852b6bf488ff20de668488cab016ba232e0150676439ddb98946f159748b2e4c09ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1569e8c3f342e04d267790f55628ddc6

SHA1
8ee0cc949e9438e8c3aabdb6ec5944f9efbe622d

SHA256
fac4094d0a369cd029424ff6354145a8c2029abe24abea2710d2a17a05180b0a

SHA512
395a6a59b6ac19701f391f204e8583a3b11e81bea0595a77e97c45c2057570fad08f0b1f16f2c0b694668ab897715b19053ee166c3289fe512897a5ab224832b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5f88f28969071f5551bf8b8f1c4fcae

SHA1
5a92662b257b70cc72d8de8ac903d7ddb5f58f6b

SHA256
5bb3fd9c682141f07b9b71a0e224479e45a0db731d959fc330367989683b6330

SHA512
a7788b74bf1e393d0c56d4d228771ba847847a3790a4bf359064e9ce3b4670c8b155783e281409ac2a3ace79d45e76780c6786d949fb0e8d62e6817966f47bcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a07e8e790f023a791e52907a5317864

SHA1
f2ad7f5a4ff0e0f1e10bebd21c8795a2542d19b2

SHA256
e1f146d6e37b1609dbb563a2af375ba19db19e11fc05399a1ddf84b969ad4088

SHA512
c46a1fbd711585abcd851bef9a0ccb8a463443cf7cb2fb17a54723ee0ed67a272ccc748e33aede9047bc2105b914e3932598165dcb63b385f5d18ddbf0efdd0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19f14cb26e944faf99450751ff70e2c0

SHA1
b2caeb99558339dad7169c7c1fcc8832629b2bd9

SHA256
c4ab08b4fd769821c800020b5b3a603770f3fa408fa9c70a5f23eb0fce5e66fb

SHA512
574fbb90aa654f2e56dea33d64998222cb4e7b8f62e778461ef589e69d4e89806e06dca7afeb49db5ab91bd66ee1f914cf7c13262d49567017133baf483b443c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54b46a83622e318461ebee1fab46fdf3

SHA1
177b8defad12c9a2c847a7997fde931de451274e

SHA256
bcc9bc9770e37e66fc44ea7cbddbea24a3e54fadcb8e5ed823163483fab883dd

SHA512
12e44ad68d9d5189a558d89c2bed9a6111a115d08c4f7ee968b8e5702d14bc8093e822304437496d142224f940c2c33666971591d6a75acffe202279a8429669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b89578edd58f91f98ea7bf2e812c9aa6

SHA1
34c3e7b514bbdd5ae342de375f0b34a2c8a04338

SHA256
0adbac7af0c646dd933ea6480e2e8be02bdb4a4b71e6e841452ea93a23e93eb0

SHA512
994582695ca515a390427c00b00d8e0204edb167cf3291ea21f8e962efbeea4602fdd67dd924017d87ad8e7ee4749cc5ac529c66ca2d3b7226c6f3e3fa1e8cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0b35cf65b3fed83ace29bdeb3633c75

SHA1
b69475cac1bd6ece95aded91aa5e6040c7ec4491

SHA256
50781e683d4909d12d627069f53230d135fcbfc59acf047db17e2844c34f1b9d

SHA512
b8bca5b1b4d3759a78d63135fde4ec32dba1d33be9e6de0041f2d20eaa4c29ef96fb7f62e7166b983a64f343b6942edac0f8cf75bb0b5e16a856a333035cfaa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38ff299ffb040d53b9b87280cf0e512e

SHA1
a5ee62fcdafae742bc62eef754a4a00b251e4fcf

SHA256
81c9dbdf1f207234417b03214c25db0859fa29994b4048ce0a473ecc6997f08a

SHA512
1e0cba55105759794a91b07a6dad0c78ff49e6fe9edc3ad3579c99e61a0ac8a6b407a6b524aeafe53b18b370025fab5bb88a09fc8af989bbad50ec37eee38d71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef21e950cdb45d22e9857a71b969c582

SHA1
06c97676b9960836eb77b63c1162164478413a2f

SHA256
c188c2f141ee0f07640a5d4ae27f73c292b5191a9350d2dd75ac949e4812cf10

SHA512
0ba551351ec70cb94c1e92ff859022abba2c06bec6002d12967402b990227dfa4fe296e0d7c136399e91aa9a19170c966bebdd4083d416ff9bb232b2e94d4092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffb1d709c1ad10b539f83bf935b6717f

SHA1
a709d334b54100957d70326a4c9c8dfd1d01e5b8

SHA256
d0cc10c9f487f40bea2cf6c7da168ed13697f3ca7e083f7f6530899b02462665

SHA512
c37df8f220726752d34c50c3d9ee820acd13fe6f781dea497676f3a9293f2a4cf9f8ea7fc305cc41a0e357b9922b5c9d7391c4c62476f404df70f028253a1444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F52.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FC5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit