427c777ca23d763cb3f346726ee2c6076f1348430dfb1e0defc632a48dc18e51

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d32e26e24933e4d33f21f831b1ab3648_JaffaCakes118.html
Size

9KB
MD5

d32e26e24933e4d33f21f831b1ab3648
SHA1

eb2ce0b532f846e55c5ecd2dc401e641273bbfe7
SHA256

427c777ca23d763cb3f346726ee2c6076f1348430dfb1e0defc632a48dc18e51
SHA512

67549b4cad995d5b7d214c50ddb9a7b912117ddbf3e0fed44d0749a417035f57e759a75c197f54308420b2b1326ab272a202a159fb11d1179fa14f9256fc4211
SSDEEP

192:JC4Du4sDSln98pxSGwvno5PI61ZEknO8ecIZvxp4v/:Jle+n98p8Gwvo55ZEknO8e9Zvxpq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000c97654c74c9a933753d22cab1f71cf70f6c785231421829b5937853efa31acc3000000000e80000000020000200000000388b7ad66ca59cfb1b0c7e9ca5f6235e4e5698a58f95fa8bfa094f2698382b2200000003acf3229d9849d2ae0f34f87428eea0dea3bf3e6b3f6d576be1dee666a19d3da40000000d5902331e9cdbd722c4d63d4e0fd413df0c2cba75daf4157448f690b3acea161d47e2eaf9d587ac513218b2c656fbfa5a0b0e58ce9b45a4ade30666c78c8d5c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431918649"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305f75a28901db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000009b3120a669062ae974990729c744af1d2147fafafda6288167f82105bcb198d6000000000e8000000002000020000000377a703b37e5e0b3865e387e6f978a412add901934204df168e10096d732b34d9000000019bf2e1164dd63875c4008d29c1b36f0236f1386e28290a29bcfdce03c7b800da7d59cc709b1702c21d78da36738fac00f55e7694f7d3e8d731a9df047b58fe0edf972cb8423d6548f49a15e81c0e9c1b20313e1524a6381632c73550cb512e345979a4f77acbd012fa66cdede67ae8120b5949285cc6805514ecbb7df14f7c87b2548e9e23de2a2714d8d6e3fdb029140000000994c989282f4f8aeff9e6bc66cc9c22015bb9a4d7d563c8b478552c5b941111199dc5d38ab92e134cab9d88c78ac5751c91b691ab656485bddbd4a89f7107371	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B17D5CD1-6D7C-11EF-988C-4E66A3E0FBF8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1568	2848	iexplore.exe	30
PID 2848 wrote to memory of 1568	2848	iexplore.exe	30
PID 2848 wrote to memory of 1568	2848	iexplore.exe	30
PID 2848 wrote to memory of 1568	2848	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d32e26e24933e4d33f21f831b1ab3648_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0c04228acbc096a14fc93102300006c

SHA1
c2561eb1e155de6fe8866e6780fb8e318a031ed6

SHA256
960a3e3ab0318befbc97988393a9e2b07dd0eefcb7b53b857c3356f8b6a5d13e

SHA512
acd28ee21b04ea1de420afdb3ab9d61c7a4ea8e1a8878914aa520664a3899ddc66bde954f4b79c32eac631ff370edc035e8cd62119a4e4b17aeee2664757da38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed45de15e49dca06f1872db1efa29c55

SHA1
b46ba698a8fbddf7b481ddf6d7c43e0cc5152522

SHA256
964538c74fec34a233934549974f9fab1527697ecb9c738436f7f4dcde410b36

SHA512
93feb80e6097c45d3c98daed012a08aaa4c65a92b8f4661aa3398b1c94b00560be9d631e65a92b5035916b25f8f0d662bb111baec2b6358917b280e4ed89c987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7b041438e3a8fdb9803d68fee5d1fc1

SHA1
de7d627acd369420ce56ffdc24e7a56c0589bd61

SHA256
2ccf83b0ad6e042c7085633fe2abb9c37085081c4aef12fb813efa6d691d264f

SHA512
733ece5ca6efbf79dbc3107639890a95fbbcb344e2b7a4e4df66827dd7d45bfd0b25de092dc0f99842a559446b0a6819c7e6ab177cf24d206013a8511de7b8db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee600ed505280f31a6b60a1c0dd63e2d

SHA1
f0e46fe1da6c15ba40a70b27648ae839c045d60c

SHA256
c309c03036693a553d6957d5476939e42808983c25499e1d4f7562ea3f2510b1

SHA512
d94e9ddffbe1f9186b22963a697e2e77948e31fff3200171c4e699f47f9d1e8e9be022c0541252d377e310cfbdb288f6d50be6f849f8dcb00e0932b848418499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f2e028638eaeadefcc60c1e9e2b5c30

SHA1
46240f3976340522180a0f9bf65474a1eb7e5eda

SHA256
4e531e680bb61b17187f2b3907c16051c88939869cbfb4ec36af8338b90766b0

SHA512
8720eb22b32bf9d85ab34507d3140039115788028b7451c438ef8e03563373cc986d9ea6539108a9cb180b62ce511410536ebd97cebbc134a98edf8e85b95a74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b7b2b2e84cfb6580641fcf0bad720ff

SHA1
be790b2c8203550a6bf94ad526934907a2d98f02

SHA256
e350612f85fb768ad0fe781afc6f1b79e0a67dc8655ed4effe7e754dbfb3e361

SHA512
846a0ec4f43ac76a6f74137b4d88c723504356135b4a71d3194bc48985a2784791c22bd8ed8310df5a8b8fcc09606f5b59aa8d43ccb141b44a8964a97ef0cca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61e5ecb3ee8d236fef8d02222583ef80

SHA1
045ae36c09fdbe576c4d9b6d972695afdfda522a

SHA256
b367582656a624bcabb82db98feadaa6c08e0a1a222c55d6e78765854c54e9f7

SHA512
eb6016320a0cd7dc789c8762dc439277fe0a64e50ce9766cdf8220bb498d2c9ab1d06a4712d70cc9395a56ed393edcdf6a18c9fb1d5fa72d451aa0443ffb8a3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44e2b3551c8055db0c4601bd22574a0f

SHA1
e72f23f77cf831ced1a60a69a11c63012237491b

SHA256
f71ccae5cb7413704a1f2f3a7687d65b500e32de9d7fa7910c3e92e42e415bd4

SHA512
55f02a2bde82884fb42c7c65c36a938a5188127d494b62a16528c855ef20862ec03700ce6a52d1ad1b73cbe5befaceb629fe6b93ac939222fda14376484dc967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da148dc5896d7d674ca0871f3cca1449

SHA1
df6310d0e7ae44546f7c022d41ce8dbd7a112dab

SHA256
5754f9846963e39f65fb3cce33bada35a1fa8b412f28ec11fe0bfb2e00e73e68

SHA512
30f743f349aff30b0105fa8e86f8b939ec8ce840c68e0bc7323481de5540d3edd31d8cc7c3f968ed2399d77d0b0715856304d73e6461569c666600f53e58dc6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD74D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD7FE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit