af1ed67483de4300cf19eda0170dc9e0747324da13f6b410d80c1ecb95e9d1db

Analysis

max time kernel
122s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 04:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d38f5089c68ba6060396fe3b5ce28d85_JaffaCakes118.html
Size

347KB
MD5

d38f5089c68ba6060396fe3b5ce28d85
SHA1

d8c47d826b6567c0a0b22f2821ffe37b3737f7a0
SHA256

af1ed67483de4300cf19eda0170dc9e0747324da13f6b410d80c1ecb95e9d1db
SHA512

5da74f14a5318e21f4949ba92ac7f85fd622dd205016a723be87f9131bed4d1d5900be447e964428dfa3f1ba6beb96be524d5b9c4da805c9251f227c3aa972ee
SSDEEP

6144:S8YsMYod+X3oI+Y/sMYod+X3oI+YLsMYod+X3oI+YQ:7m5d+X3p5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3058c755a901db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78EBE511-6D9C-11EF-BC71-EAF933E40231} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000002cb1529fcc53fa1d5f30a3e4c71bd0a526fa1c266b70d91aac262479f97a16b9000000000e80000000020000200000007eb01f2aa75126efbe76bef26a32ea5b56b99c60dacb2eee4a7621a4a9fd055b200000007ae4dd39d835f988bd15f0e00d26fda1e8f6e9b081d79350b4951f692416bb5240000000fdf63286db423c208388f386433b506fab9662b0f828285288d00c4fdcb6ec736ffc75459cec337cb8a959673798ebfb743dbca62d5b5d0af7b31b8e83e98298	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000db15e0eda73812653abdf36b20f752275c8aa25a5f6c99084eb5a0e6e7ed367b000000000e8000000002000020000000c517553d5a9944c2ba212aaa82e1eae05efbc19d56ac793677f693486460ec5d90000000a69d3bc82b79e6ac8013e3adb917866de383f85c6ca40397f8d5323af28a54de3c78d427c2458e5edbd421821468cf679df856eb2fcd5a980853c8099fc3d01303201e96b68784d90a9bf9c9690d4e1ec24a99abca7271eb192d063e7e5e20c8ee8f389282a357be8963de9208983758e9d6bb8a76363889411d4eee7f0e9b0da8d2bb193ba75832eb18097fb254fcb240000000d57b42759ed927ad8e02bba489294adb00698ddc5f9ae99767a2c47d8fdce929abc6febbb2dd6c1e4c4ca7bb8b1c343b25343d5a6c8bb76657cee16f68be0ae0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431932297"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2016	2440	iexplore.exe	28
PID 2440 wrote to memory of 2016	2440	iexplore.exe	28
PID 2440 wrote to memory of 2016	2440	iexplore.exe	28
PID 2440 wrote to memory of 2016	2440	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d38f5089c68ba6060396fe3b5ce28d85_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc5ca3c4c680a301bbd3fca67ea58aa6

SHA1
59c814e2917e4f2a99afaeba13bb7c4b7149e4d9

SHA256
01824cb27081be626b2e7309a8b5f55735e13575cf399707ba678d57c55da823

SHA512
4526a5d88bf72824befc7e5e9b1c12fa298bac05cb530c01a9c74742579ad2b50cd8c99895c99a1655a8bd69674233f5fde3f1bd11e998c40f28826b94c8901e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
226dfc06416ce2c37cffd6d6d74fdb02

SHA1
60877c398088f2ea74d6d5ab73a90a3891bd2cf2

SHA256
605a594da2dbfbcd2334dcd73a96a3a3e76ef35d40271caf32b8183693a3b728

SHA512
d4698def905de71254712e50f6abff9c3c35094ba38ff72162bcd4fff63d6ff8b698d16d53271193e86586fa1436cb0dcf03def0f4d03377f63b1e87197e0baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcb38d484aaa903b8751da905429332b

SHA1
413d0b7bb31e415505252fa88310409db8d8d83e

SHA256
ccd0df41a9a4e0d4ab88a7636da7b7bb9c3b92e9dba58600f0ae40528eb7b2d8

SHA512
c76fe99aea3a1a3c2840796d72684b428b9c8261e2ba3d5967dccd963e0e86ba71cc65c9890b2eda3209ed92125f32202b96c6f9a1dfb9646cd8f8379dc6cf1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9986792715f8fbd6b7aa5ea0ff0616f1

SHA1
4cd988981ba686f434a38b51be8660dae6d5c090

SHA256
eec224dc2d86240713963421e079bbf7e424e28a44619befce6b9dc965c522a2

SHA512
3a3a013caed7e5cfc2b9541fecbddb16b682b6671f193f27d516130685170789b4f44e0b06d786fb00c7e80edea51292496c1eff14e9311ccd1f375b35c9069e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67c1cbba1707c9ad0552d058a299b196

SHA1
1254bd151b8110951da25f320dffcd9dd0bceb21

SHA256
3be3ff3c49697bbc2f065d4903ebf4b1ef290cc76a5dd9fa4812879959212890

SHA512
cd04131954b7c497e3b6d3d4c29f3dc35fe134ff1430802cb954a31df16b2d7cd87c66715fca49884373a2b8c3df74526d099604a128c557c99ab0cf83f966f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1045b50f40068649f0ddc21ee2189aa7

SHA1
85991441132d69421dca0fb1edf4336f31edd449

SHA256
bd43fd150e8603f67c9c1db5273ffca7649b2002b0b96be5e73222d0671fc0ff

SHA512
9f76873819331e1c21f9109a78fe081752c34d5d12422e1e135819caa15bda3eacd92daea791fe86c2edac7b2eb4f725d267d2b090ed19f37c1c5ebcab2abdb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce778febd4cdd43a615a1f9dca59f8ea

SHA1
c4dcad7e1fd8f6fc9cf21c36baf2cbbefa82f6d2

SHA256
342a66f6105fc7339fc7f1650ecb411609cad3e26af4714eee6d5bd5fa34da7d

SHA512
405d2a3250653108fb0a25e93db17c045f5623d075d06f15f6828b32b20c85872f8b90ff61a85435777c06990d55a4d0966d64a7d8443fcea90aaad0423427f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6111124c613266ba585825f3f75a8cdf

SHA1
ce8b6adb83f226e6f7f5de6d62f3bc0356cd41b8

SHA256
31895ed2770c6d98ffd3f9b0ecc311b46f47ce2b281a37c5a4a9e27c96a28d0c

SHA512
2c0c0eb413f40dc2c426f5960f51d5083c0c232cc7eb7fec20606aee73723e4201244fa95fdbc4840103f33d5f7ee0bf81511fa93e82e4d932952bb91990cd48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45932a8aee5c6c56c57a92ce43a09d4a

SHA1
7b7ccf0a7737d2f257c247f055df32278268f195

SHA256
9c898a21e0734e7d9d9e650d6a25db2f5848d443113d2a6576ae92499adcafb1

SHA512
d038d48d02475fb1578e524b6daf993c4d8e4a13308e15e1eeedd33b748148e51eab4b31c79134ffbb93ad65ade242851834c9a4c8b55e913243d49023e590c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bd2c2f355324b50417b7197954d69bc

SHA1
3568e01ac044fd706c0029fac0df6f5d45e61f37

SHA256
c4531827c7ac5f513817b5c161b944ac82cdede53211711f23f8c3f1d5ef792b

SHA512
5e9a115f94a9d0a8cb736e0e130ec61c45aa32ecaeb71030b387235528a7798a7a64d0fbc6d48276551db6f471c01e66242cbfc5ce0c050f6b2b8274156f23ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe12f4dd63c227c6ef29f4546b5e86d0

SHA1
e4ca88b56765e1715709e67deb43c99b6b8914d4

SHA256
fe39efb04663d1a8b69edba4385bc7fa4fef2033a88a45dadf91c428f4ab8d15

SHA512
43097e9783585bf277a9d7191e512617f79bb7a6df265273a9ac15a53088ba5cdc30ef110acf772568b136424b97e7000e3373c425c66a03305ebf26db331e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49ac0753fe3655e07dd27d4292270a68

SHA1
4aad750f6b094ffa9635bdca67eb35ec971dbba5

SHA256
1970f238a583023f94cc987e1fce4bda058f907304099d5cabb59d36f1e724b1

SHA512
b2d36da5e22dd8ed12d4c38af663b25bef62ddc40bd8fea2c04ccf7f80664d5855b12b9b0aba44de526f22e5ef2f205e79f20ff3399ed02c41dd527638c20c10

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB695.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB705.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit