ddbf5c73f13db31ce6c535257b7f1ed82c77e621d252ab863bf953f017826e7c

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d31d95f017369cb2a18be606a9671668_JaffaCakes118.html
Size

80KB
MD5

d31d95f017369cb2a18be606a9671668
SHA1

71019a3848135d79e968945e54dfa79e4a4f8fbc
SHA256

ddbf5c73f13db31ce6c535257b7f1ed82c77e621d252ab863bf953f017826e7c
SHA512

5e458e351a4e5779bbb021c157f72f1a79893277b2843a2c40afe81dcbd105f3710f67e248c8a97aae0b0a7cfa0d8c9070dad394de54538f0ff6e62cf6df8658
SSDEEP

1536:dzw2oCd1oFneK3rSaQ96hoRFMjtIZbN8mySet:dzw2v4eaaZFMSZmmRE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000000d4076481f3cc37f43445f73de3211c676bd95b72e79cbb791da8e4aae22bc2e000000000e8000000002000020000000fc69286490098de877fe6b13caae34a09ae916ce37de03bb2a13fe8dee2c88ca900000008aaa41a53fb5040514589b9d7c0c885ea79b8d3663415d99493fd75607e3a0ec31bd13e2ee283b84b7a4191518d65c4df465e49458c4239f6ee55785cf83e084ad0e191372043dfb715159d96140c0ecfecb71d36dde5f11d6eb8c196d7f96bae5de218939f86abe6d4820df4997d391e1536a5bcbcd726bae22be3e971975834bb4d491321095c7d838e5c32b0723254000000083b0e8dca794414aec6594f4ac5744cad171cb495b47ba40e62597716eeba2bd05af358bb00a2953dd7da6c700ba3383e248ae2e27b63b354652c9304b45baf0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{914FD741-6D76-11EF-BF23-EE33E2B06AA8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000011e0ef0ab55c3c2669529c766499b4837b997797c706e1fc660ca323b84b6753000000000e80000000020000200000003a01f310e0de8a022a4900868b08d17732568d58c4d9576295575691b54d7499200000000681917b953b0d17e8e249a689b4423ce11beea81b9f71ff42473ccfe5c9980b40000000e361f563e659d6429ba2036eb9b4fff4e8d2f24db58560730472b71c3c26dc8fba2e34051256f9222d6521803dd77e5899a6916053bb46d6eda1c9a40beabb9f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09ed5588301db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431916020"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2168	2112	iexplore.exe	30
PID 2112 wrote to memory of 2168	2112	iexplore.exe	30
PID 2112 wrote to memory of 2168	2112	iexplore.exe	30
PID 2112 wrote to memory of 2168	2112	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d31d95f017369cb2a18be606a9671668_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bd55d5e6f2ccfe6adf54a020b537ef6

SHA1
02c6b2df285b81000b8c433db73a406c157a7985

SHA256
ce48af38132176ee686aaf114b361072c5835e4c6e5735f9ab9cb5a000cb9893

SHA512
29ed6663f8b26ce85ca2190aeedd60dea34d6ce913195fbba40db95a5df5a4ba261a911bafc070b5afdbd883a579472e1c43458f87496a6813442a970b516458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32b750aa4a1e2a94dd724ba97d4867ae

SHA1
e1429e4b3e53911a6a2275d2b228019f1c637a48

SHA256
68b2e565ab9774f2e58dda6d95ab1f1d64475e1cba267d4917ec6e6bac829541

SHA512
aeafc5271c500dc5533a0300e56226f9bc2683587aa455832ad3d7c002b4aee761a22025bca17375d15f4aa1317b47dda4e6272cbc3919d3603a35cf4c40390a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d8582706c887c359152e00a9d538d41

SHA1
a43c00ca6ff2c6e6ad7d87d0bca568e7f27e9156

SHA256
4246521410ed54ce57b814127ceb74a005e6c3f6f564f4174411068b745d9bf4

SHA512
d45cece30f192ed5b1fe20b9efcd190dc6062f13b48630692dd6b17f09802a217847ed3d443a14ea75e968f8120b8dd79fa37177f810abdebd9b05077b849e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37478cf828ffe2c78024dd20db3dd3c5

SHA1
1d0134f477c7bde2b9b5cd0b2580d010736beb81

SHA256
0a0aaee340d50d18b87372049d387a9d61a95945f6c51665673e72db19760e2b

SHA512
28b86592dab0655767a2819e9dbff81c2ae6127de19be681416652dcf9ab62ed2ad29048ec4efd0a54fafc78f2f613e8a29bfd29bfa986eee66342afef5a8188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f7e04515a3bbd0cd5e00a5d26bacc47

SHA1
9632588c3ddde2aa8d431bf7de4d8426e82554bb

SHA256
9c4cf99446f7812f9f304ac35b0b49f96e4e39bbb7b37e4abe620f743507acb5

SHA512
09cfbadc624a7a469f808415c124c03122d101da387c17d47f4bb0e80396486025b9ce5343328782afb29473592d7302f0938127dbf0588bd2e7b70c3cf5130f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd35a8aa33895c88688543340ef88c22

SHA1
c00d0e8592ab2d33618539dc4f70c91b695ac7e3

SHA256
570a57b7e9a5cac570cc02bf6345efbdbeb28e0b65e7913fb256859789e093d5

SHA512
1e0b4386dc9cb31d4210bd1d6572f112fba87503ef7092b7dd5547882787c32522b441661ffedd1b5aff0670e860022b109a30b1f13d5dac9bde41448247babb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3635477728293caa057964df7e9f6cab

SHA1
db2cc43676c437788bf9598d218c116cdd95ba5d

SHA256
5958aabf5a93819e3daadbc2135be03235c5cd67e1721039e168985d3b49a8dd

SHA512
a5d7b611ea920009d7370fb78ca3709b2be6da028241cff6d03021d36a8d75e61f0ecc45c800e0f00830af3b731d982782f10c337fd5e877e902655024020342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c6af43e58e4a20b9cc197f12495769e

SHA1
14f3ccc7b1d1e11b6250d9d28bdf01f4c1196381

SHA256
70e864cbab0424867428aa19c7b99ddb146ed60434d776a20776437fc3289bee

SHA512
746f9714ba8204c08ce9598dd2fdc6571132e7d9bbc239a31d965d1e8380c9d8f1c31f098b39afa7b3edab00b09c363f02f892d44ef7d5f264177be7c14dffae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b8f41ea4101e5a8e4d0e1889223760d

SHA1
48eada84dee95a93acffd2f364725ea3993ce0f0

SHA256
5bf31ceea4312a1cad306894673f2788a72566a51a38d69a2ff277ef8b2489c2

SHA512
26321109645868ec2cdf60c888535a7ba624d161796abe96b5a06853a2becdcf5f0ad18969cd4064eb3cf987dcf2349db93d0fba824ac0965325180955264013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75a296468601238584ae7f539922b486

SHA1
51b9d2de8779fd577b4fc9a1dec231067908959b

SHA256
ef95340b79696a14035c0870ab7ff216c95c8ee62f1c44f00784a99e2827e4f7

SHA512
38fc82f97436e23f74a40aeeb8fdd5edf6aaf52515bedadff4498a46b29b76f8c35d3a751edaf45a06342a795410d3efddffd3ebde1f84fe0e36f752fee5103e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ee67ff98b3b1e76cc4289d688468770

SHA1
c1aa56cb73ccc9ec8acad2655474d5416ae311a6

SHA256
a800c14041439f3af7366ad30ae43b82c9776a9976d540875eba2694157db710

SHA512
2278a602653b3ade9b0f4c0af87fa81997a7f5d7c8b9c040858a2387d00a6c86d18b68d3411bb940f3ae9477d5c3a61a04f10387aef2ca704b2cd510ac9431a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4df4a5230bc55fe100d127fab49a0395

SHA1
aafb2164abc458b5b6ae2cd8c664ba8a77a88b4d

SHA256
1f2ec1a20c43b4c69890de504873f00c27bd760cb63a933f6d73989cce0a7c5a

SHA512
42cee5c67c0e34296f307dc308064f70608db6ec1a92e775798f2c40b3cf3e2a1b7bd267790151553823c7ee80e440b904a9faf326a6b5a9b7163b828827af28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3f40a07a0675a9c485c5c8a7b657e81

SHA1
4dbc9205cecc902247ddc2639dc9ea7eb8f8ef5f

SHA256
d3db8f1d77702417ef5c1af67ccbfa92f83623bd91a54583f02dfa56d2ff72d6

SHA512
b53487dce85615f75c9369e4a06f34c02e0053865a2b1a1c738a47eb70cf1f79a55b92c189151977d103b4d6424e0bec211e6a314c3c5ad22c3d26e6d23d4c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB25.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBBE5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit