1c4f1cf9d9a48a2bb5f6e1d58c9dfd5c040c30a5e5231bf78c68a1dcb609ae78

Analysis

max time kernel
148s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3f890d16c4855cc1dc49d1851517516_JaffaCakes118.html
Size

31KB
MD5

d3f890d16c4855cc1dc49d1851517516
SHA1

6101e621d7c261b0927a29344273a4f8ccd51f20
SHA256

1c4f1cf9d9a48a2bb5f6e1d58c9dfd5c040c30a5e5231bf78c68a1dcb609ae78
SHA512

37236e5143accf56aa8feb5ebfac740a99d92df7e91caa1d3e24faef7f737e4bb06ab55fe8335fd3ece5ec0915cbd61589650c5ba08c56842f64c886d8d2b37a
SSDEEP

192:VWCk3GDG7GSFGNGeWqGUpGtqhynQb5nC2nQjxn5Q/JnQiecNnFnQOkEntfnnQTbJ:ACk3GDG7GaGNG9qG8GtRQ/kWSNSQ/j2K

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05A53931-6DBF-11EF-8C85-523A95B0E536} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000007479c1f2f18887dc9b86cb33b7c1031b0f588587b830a1b1f99bc005a69794dc000000000e8000000002000020000000324a1e9d49c8a9dae4161eae84f2fe10534813594266d3190881e4dcd7b6b35820000000891dcd9c68b1df5bce3d701d319d488b8f2027034d9430a1b01e92c03a17a18740000000ac6356cbf50e0e1af887e9258cb16dfd95ce767877c30758394fd253c6dc970da2282e939740b5e18a21d98eb8ab4ed56649653c48dc1bdabcad161ad8f00c5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301e08dccb01db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431947149"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000004644fabee6a895110ec8c2fa3bbdea5667fe184cdf9db7e02fae9f85ba0dd77a000000000e80000000020000200000000bfa3200789575cc4d6104588dc128e9d3640771792669f7c5a5cae5e604446a900000003cca32f1fb4c74ffe05440ba420bfbcfe832fe2946dc7885574d79e974c60f4ad37f1226db53eb39672555045d4b95a5159f8879cafcd493dfdffa2f31fc474edb7ea4acf5e4513d74fd222c0c3acb9f42be4539559d7cfccc9c65513bb39ceec703e4430efa3d92196a03c994073496a655abdf62670f2ea43d8221f42c78615ff96fe8de01efbf5d64677940c1958340000000d0e08b4c170ec7147ae22e708fc364268b62781ff0db9a62599ec2fbb1839bd40dc4b37213809eccc73ce9830fe934307028c3055ce77502d2dae9a4392bf0f1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1864	2548	iexplore.exe	30
PID 2548 wrote to memory of 1864	2548	iexplore.exe	30
PID 2548 wrote to memory of 1864	2548	iexplore.exe	30
PID 2548 wrote to memory of 1864	2548	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d3f890d16c4855cc1dc49d1851517516_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ea86ddf948e3f3a9fecdeff7a33e789

SHA1
5f9132fbc1ff6ddbf3cdc9e2431538b09d901cc5

SHA256
78d2b268fb2b6954a3ba6045be4063ab4a93298e4a52e418e3bb043e232032ff

SHA512
b807ac01d480a77cd7d1d900f60d3118a382cdec05bb4356c9b731d660d1e7b7bf27cd03b956d5f3aba08338109af66db957114f9f7f52f402127336d33640da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c6768bcb22fc8f09a85694bfc9ccc26

SHA1
a81b34ee3bb62f68f32d3b57c06485e922060c89

SHA256
f24aa1cf5ed9658b62f505b3cda61bbe5fe557d95c4acadd136f468c52a96860

SHA512
7b7bc1578ad60973cd06b4029bdad862539bf660647ed2187be3037e800e9a4e6badd99082f09f440d187a11559a68083f1e3defe50f93823062d1f74fbb1377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e54daa81136a01e71b86ec25acbaf5f

SHA1
a7427f51abdde2786ba0a8cc1b138b39a58abd6b

SHA256
800d81001f82921812c7b45ffeb84474c3c0161162ee8a656e0d4628bcb06b7d

SHA512
afc42069087093e51b122d17319b683601ce0da65ff648250ad92f643acb1a6d8e9113c47fee946677b6bc7456f10cf69b38eb2f57c2c91edce903aca9f6c093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2151b7c1d7a85a949297ffb1833fe8c

SHA1
b3f7925c324bb33a511b846177fbcc82104c5cb7

SHA256
bbf27238d85342075696539d1a622c5a4248faa96b959dcc3c205233e74aaea1

SHA512
d58060ef45ae58a58a98df82a13c3762f6218842fbfa92cf7ae8c2b542184f6f253eb03a17717a06a829e3bcb14146ab98a5a1a045914e40941c9d708e8ac300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94977c94b6e5812488d1b54ad4b4b65e

SHA1
5bdee3f3c83bc8e910336295ae7b88df4a08d07f

SHA256
b35c362f0964f7a42b9d67349afa036a694f3ec5e02b16b093a44e86be8241e6

SHA512
8b44875e4b01a2419461975582c411b8eb1db7998666b80e4e443ce97b8b76e86fc025a6ae773cad4611c0dbefe087c4fe32ae04bf3cc2f64fbebe0d76259634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a67cfb5b62a528851346d20a623e4c3b

SHA1
3f3891cf7e6ec76144a1f0b25da3c47f7bf26bcf

SHA256
303b19f9a8bbf19bd0be4295bac207db74a906b4a3050eb56304310ffcfb271f

SHA512
dcb98a5772b5f72f52955fa1fdb21d07ae9637405f7af03b46c994122cbe6a34692e2687bdb1bdbb1c53b5089618674c111b294bde606eb62c612ceb09c7ddb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a64cce56dde0929a890f03a8a1d2155

SHA1
3b9626f859a0e061bb39528c3a8111c67b1669c1

SHA256
16de726d592880fa750563d21f2efc5a24451b6274c9853a15f810ab0b202a2b

SHA512
4378a9597aedbc72597a4597d0af14e91487f1b758653bbe5c5885e3cd23355c72c2c3880962c8e14af30eac4c2aa09d89cfb40138b39cf34d30f030c5c7c0c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a09efc5df5cc1148638b0a9706e3751

SHA1
df798a3968b9e9016c526db2bc4dec97ff0e604a

SHA256
6d61058a9328708053c218d66d5c24893a9f1071fb92f2f048bc1fc56e4dab43

SHA512
26eda9614e4455a73917b608da35094484ad202e4201046aa5d51553f8510921dc44f5a242792b34340d23b7cf7df435e424e341a38af948968e33f231234ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6679a70a5f63d2770322fcf7797880eb

SHA1
4abf2be469a48f1f3abd15668290d7b67fcce752

SHA256
e51ca50fe19e10741cb9da13458afbf267e83083312a3edfbc95d63026c310e9

SHA512
061e8211d5a6afc65274016b1330aa6f5c802cfa14d277719ef07c2f2cc4d8b429983f829eadef78431b53b287b192b136fe1bf241670e05f24a898a818bea97

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD644.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD6C5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit