b93dc6e8bb38332f7bc089fd9b67b6b6ea0bd4fb55a6726a467b2d7959957693

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d41f6339c13317de6a72ee323594f993_JaffaCakes118.html
Size

193KB
MD5

d41f6339c13317de6a72ee323594f993
SHA1

82f295b7c8250385f844939ee2ef3881f2c8c426
SHA256

b93dc6e8bb38332f7bc089fd9b67b6b6ea0bd4fb55a6726a467b2d7959957693
SHA512

050da9a0cc3dd7905150fa28f27241339812b301e79e48ed8065b8e0cc24cf0943ad3a663141a99d07f10a5a1dee11a5eb41f28f4435a787af7807876875c040
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcqGYHAnuML6CM0MHzcZl0MScp:s3OXLqHz0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7C89191-6DCA-11EF-B44F-526249468C57} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431952233"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000b80586eb538e4b86d283ba4ba43364f0c101f165ee3f8eda68bf9d3e73301994000000000e8000000002000020000000bc7639e55e2a72cf5e625e922c7e52b6ec98da80e651e8490b95cdaae02fb8c02000000011a7bf2ef7a7e3bda2e07bd24df345bde470fde45a61372ff4c37585d0cc9c41400000000ffc3097e6fa481d5509e5e69aa101cecf5b3fad25b601119ccc6fde62e16a5904e8bf6689985e24c2e1941e35d21abeea182128f502ae7a667d48ff4b962b12	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ace9e3d701db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000c9a31920e424f523b3d753f99170e57d184f2af9793d20c8083f54ca4ff18977000000000e8000000002000020000000158037acda92e5b0fffb29ab044f3b07aa6c902970956c2b7d01d3fd62edfec190000000931dda36dd4d2f34b18eb58d40316b02820b39cb9408d1decd15d04b42c56d4321a9fb1bb86ec9840f8484ee667634313b03e4e762ba4c05c0b6fa916f07d85e5c1fcf6ad96acbce44ff5078a9ec1e5e7e1a6557dd332a5a758448b2c6fce58c34143503d32d54a18bba00cac3ca7ccf069529ae8aabb97a4909e820208393ee1144afb33b0b2ad4b3a93aefed61096c40000000359cb8d2c1354209cb00f7013a5badcc05b74631d1e82d89c0ae552ab137e439ef644db1f3078c2c3373c9fbd7d32dd20a82cc2df09cdd1ba9f8f69dab9acafc	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2724	2360	iexplore.exe	30
PID 2360 wrote to memory of 2724	2360	iexplore.exe	30
PID 2360 wrote to memory of 2724	2360	iexplore.exe	30
PID 2360 wrote to memory of 2724	2360	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d41f6339c13317de6a72ee323594f993_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fae4a207e356495e2d9ec6550234d545

SHA1
de7ca641091cca0731dbde6bdcb1b34de1a8d719

SHA256
6abdaadfdd32ca7228d65f6d33d5325b70a16f243d4d6b319aff096946fbdd33

SHA512
2e0cbb223b32003d619dec0017b83faa65e920264112904633d30a61d8b7d538de90dd443d334650b354c5c6d05fbbe59b061fcdddc787167d560afe158718c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d842bab6a7616e35b416d69883ee1770

SHA1
f911ac336d135c8a77a3a6eded2a1e2343bc9a44

SHA256
bc7e766d210b161427aa5d79313704b9a46f42d47f38039917a0b438a7bde082

SHA512
a2b34cc2ad0db60a301f76d599a59dd4e6f2c6391cdcaf1fc159c3b827d4e8ed8082cabb29c6fd73cdd2da92b323604f6588ee7c7310ba1af0120f76808a7e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11a1fb684effaa4dfdcad686017939a2

SHA1
72667f295d036ef40b9c0140d577c7b329e0b9d0

SHA256
38a876ee5f56647f3eb9aa4d4f28cc7d7afa0bfc71309fefb257099435dc2b79

SHA512
54a481cc57d8bd7b6242ca372fcbef257875f64697d3ee79eeb2d54e071ffe16da47812671c878b4429c64557f2faec5eed3a0c0e6857c0863ab2aa97632bd48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f70a9e41313521a8e228d64a352ced0

SHA1
ddec794d9febf150f06fcf67dab515af7dcc04ff

SHA256
60dae0d0c455b6a06dd5af3e8ce8eff53f6dfe36cd3950201e219ba425fd5dd8

SHA512
74c6129e18c7028dad75de5bf012768ec0a8085a75e85a01c16361a88e76e30bfc87093731f2dd390786165aa9f8cc45136249afbb71624b9c94c82c8ebce56c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c852d8e53c2ea8a59fc9385d9ab9da7

SHA1
50d087aec2e4707e479ee37383b3d4af60033a58

SHA256
692ed82f7135554c5cf30331642c7221468253fe80a2c5ec62cf91420bd4178a

SHA512
2ba34798c992f5d9f6d5d3402429c42fa0a38d0b1c550e810aebb03cceaf0052bd4adb98ac1f0994771c80e27412437be12968d08d8fb068e0da1661d686cbfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b378a7e19c2d9a66bf7007427b63bd8

SHA1
b71c2f0bb47f527c65a52093b94883f323e95bcc

SHA256
138aa598d32c9d6037ae09be2ce0234c0ab431260a4cf8e7317e119ce588e30b

SHA512
d7a043b6d31bfdf09444649e0cd5c0426b85d0e031b7e1b5e4da0e4e0175d4b81716a7fb75b9102fe5c0a3e9008372f9c70817e751e93b109ac30b08ca643d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be5f452fef227795e32befa162d85d91

SHA1
be444ff6b14c94f3c410a3f2b1c1ae994ab8ba4e

SHA256
6305e5c1297303ee4a621893baf66986d6b9426636d8d7ee088493d04dcc9bcb

SHA512
1c16f12229998b74d89488181fe5c0f81138dc4024571d6c59e90b314a774014016be1b5943b28e4528de662c7f0bec7366ac59078b3d9f178c05294d24d2735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ce11ce972ba67582aae0eaddf343890

SHA1
3b3be59449399e56b71cfa4be2887de427a23d4b

SHA256
3aa4e6ca56e9de9f80192971a4a0d31ac9f531628fea6e39d8ae290c3c90dcd5

SHA512
5445ac2d5c724d7c8ae11553ce3c8cf3f9664662d69bf43cc0a32db9f100ef919ee0533f025204a67505e4720a85fdbb37c75c67b92b6ab82c10a5dceeabc513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ee223e46bdf325dd52145d4d635ba74

SHA1
abb74d82f439495fc272427add98cfe5023e37c8

SHA256
2bab6b2f7679eaf9147b5e0a644e9afc13c6c022e89349b24d0b8157721ce9a9

SHA512
3bf1b11652d736f261448c46af22f6fbf949b05fcc016e7cd94e93159fdbc596d7eb251b34337564fdd5112a7457a7fbb0ff163e4086d9512b05dca8db2a863d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
485ff2e22677c6053d79d2c853d8293e

SHA1
609aa4833ded2e411ae847f7f63155b79a48bfe2

SHA256
ddd64cda5bd0c25f6bd90d7c58bc38e2faf4364192259243d2fe3f63e5464991

SHA512
b58dbdcc28653695f58b715a6753259be0e4308f346d761ed4f660a2a61a787624a0185ffcc5f521b173de6df7798decede396d20ef85902ac33ab4b775828b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edf169ddd51e8d5911609089b03d2ec1

SHA1
3e9550cbeaa0091924c19fc2ea955a4cdafdad5a

SHA256
9eb2ffe2366b2054e8683f4cb10a135f4c7573e714e0ce67848b5747945c7b3a

SHA512
f210d4b417fe990ebc2526615dd5d67d0f9f0a22b181e0ce20c93a47469a69b2db6f576c17aeaed24d2fe6a45886d62ab2a3fa84a83a4b8b1d055002136e00fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17a8fab73a670bbabae9629c767dee8f

SHA1
e1a018bc76f74666d4e8b50913af8c3af58ae094

SHA256
cf74035ece5da571e7fe0fe0e42aa84d0405b39d5e94f4a8a7a867de4a0bdcc7

SHA512
56c7524682c95b6def53e02a69f371dd4acd1a4e2f8af79bf7982083d14c294b15212b26a01306e569ba98d42c8379d596972e56d3155000e1adadeb9d3f7bec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e1ac7008fc38f73e02875c754e0bae48

SHA1
1f8e139052eb5c5a2db625c155fc60a80a79c3d5

SHA256
984c08cbd95c7c4a658fbe691acf4bc91ac2a23cdcd35f36b1c9743a4c99ee40

SHA512
ec61bb27a0cdb8a80b3f5ff9900031583512a4ff931c2202627c22eb47b728c191a70340bb31718cf699f4b0b987150e69ea3cc5eb17cbee0a235870cbc5b7d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab937B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9736.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit