4088c2d7b37e280d526d2d37238106ad043baf95a6a837813e72abb59275605a

Analysis

max time kernel
139s
max time network
139s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d431f41fe1483a739654a946243b213e_JaffaCakes118.html
Size

18KB
MD5

d431f41fe1483a739654a946243b213e
SHA1

19767c198d9a5ac7296d732e5dd25ded64b623c5
SHA256

4088c2d7b37e280d526d2d37238106ad043baf95a6a837813e72abb59275605a
SHA512

e781eaffe40cabfe266d03b5ecfb794022da1da50d5e13261c9037f48c6a8933e4e81a7d22d19a24b8cc5e4334717c306e1e18004bf823b0b38d2103b453f5e0
SSDEEP

384:SQuyqkEBMxZR5R3D7OsxkVLqxbCICtx93v0ZOMhvIggkcxaBiOzV:SQuOECxZRb3/Hb9CJvGImrh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00df5df2dd01db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431954803"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000662af379d30bb45e37bcecab2faf34a72e760366263ed52953dadd22ce3a3c32000000000e8000000002000020000000e1f15202b94c6aead6172df460e81af0acfa3e9990499eb376cd5d74d5aac78520000000b7dcdf036dd74b9de377596acaac9435cc866f32bcb81fa7a5b41bc89ac1fa50400000001e998d74c3483133374237c0fb55775bde653e50d61cc43b63cea0adb57dde871beb6b8766472e667cf431aede840a8d9f1ce27676c39d61c4e6d01043cc1135	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000d79f11bfdf552233c0d9eac99f00223116bd92ca36bf03ded9a5b48db4686caa000000000e8000000002000020000000df9b83fe7d17851facd06271b032c34ef5a49c12683c4a013d4fcd24247029e890000000d5bbd8602d00edd3e3ee348de40659af102aba493da79dec6684e432e7a1dce3f246b538a983396b0d0a0fcdb605dad4c60d486e81d2e5a80922b82aae9d020275d676e104a4a2e17ef9cc3e0f78975e007a897deb3ebd04f3a05cfd8817b752f0d3edf29d4f633bec4907ebeeb0a3900eed8c4b8809ff1cded6f126d3ecc4e5bc3a380157a396817ea74a400400ecbd4000000005796ca18572e4de5bcc8e7441272bc8ef74e5d20e8eeceac51331d940f5e2e361b01b3b4e780f6d5691023201f1210dc6ec7fd889f9de23eb522697670f7e30	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD288C71-6DD0-11EF-B81F-6A951C293183} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1916	2112	iexplore.exe	30
PID 2112 wrote to memory of 1916	2112	iexplore.exe	30
PID 2112 wrote to memory of 1916	2112	iexplore.exe	30
PID 2112 wrote to memory of 1916	2112	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d431f41fe1483a739654a946243b213e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80ce016a44d839e420158516d2f27058

SHA1
792aa9178ca1b707f668671654e84b437dee478c

SHA256
a42da26ad035ab13887ce428b38f5df73d11c6eb9c4e4ca862312ac8025d8460

SHA512
1318581da6ea17b57271706d8fafa5e61085be40674037dc9b565b4b0c5455aa4fa3a2923aee644e87f6a60398cb036185d6ef057372025164366bac683a7157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ce110f94dde100a473effe3b21f80d4

SHA1
bb4be74fb22bd6c88e68248215c925ec177d77eb

SHA256
178cea3e077630c03c1eaab06a071fabc06f92094b9a1c2323815fc2436b7bbc

SHA512
9191bd255055766cbdd0bf49b4e6309c372d7d7bcd9eefd66ebed7d8c4979d8a3ef77d3be78691022c93c7260bdae44e877e9e870c99a88104980b11ea47e1f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98a44a999f03e79e31ee29023c4bd486

SHA1
e88d6024842e6f159edf12b0b8db7a5f8d90399b

SHA256
2e3906e35895dc7ac86b679884426a168a1643b025e98ca3a01751351c46353b

SHA512
5d563dd7f747ef2a21b39481ed91c90cb83ebafb12daf5250cb2e60275d2672addbe53a692f94d3f706e77675ba014b376381d5cd25d2658ae6520e24340083e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
839f69d771b91c095344a03bce9ba644

SHA1
c1d209a8d3faf601326e2ffaaf342ec642082068

SHA256
14eebb7569c64544ed63165725f97b5d096a03c753b1600f1aaa82901a996ee6

SHA512
0c12923e2cf54d4fcdad178e5add3e83828d5273c290fe8b1c9fd94e32e1f246ef365a709d9d417d9a9712a68a83298817633b2d63420dcde7922fd5ec9f229b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7aa459922f66c9722c06d711cc5978d

SHA1
849456dc89f217a32b992cf3f76d105f0fab8373

SHA256
9baf9e19ea1b2dd7a00bc77b913e0a18ddd8bef7df1924394e81784b6c284ebe

SHA512
377df774241c5c15594c2332ba58e96b4d8b1b8d50bb9dfaa04b0e266a65d2d9582236ebb771bf212fb1bafcfb661577fe2ea22a391e3af0ff2a84a07ddd926b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ffd0a178805e189f3067696f2e6ab54

SHA1
632e0badf5c8cba795cd4a5394ca022ee6476824

SHA256
84c03bd3be351f409c16ada40d41271bfa5293ec52b97584e32ec51e3428ca00

SHA512
f893be10adbfd91fb35ff6d8659292ed24111a5d01e9ceba48e0fc5f4785e04cb560ccf4554cc43878d05601fe167675dc3c18c30253f97e656377bd5e3ead94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
409e18d388bf1e1cbf16fe9ced95eac0

SHA1
4d6027b9f3d3cc0534f8f4c49df44311d29b037b

SHA256
abe18e7dfa48c6c8418d9a431ddf95028de83c59c9be2487024a2b0fa2cdd8db

SHA512
057429ed840d92ddd75a0dd9b4b3972a4b026b852472fc8be4909519bc6f40c04c35381fca5f007ab7184ee6c849e0ec9c72b137be47338d4f42c18e4ef3bf3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7700588b5b165825a4c3e0905c9ecf1e

SHA1
27d55cccf058e1f16e76dbab5e32f0389326d048

SHA256
5a88a279e1b18b0215d1ebe6fb67d38e89a24acec04510d689e6f18c9ca97ca2

SHA512
954c6ce0df88987adab558c622b2890749ed26b94519ef25ce0522309170410733256d982dabaeb09d7169d7a8e4a2489e558e19310d403b2f2e0b3f1f441f10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08d99d06d9eee96af272d76cf19818ba

SHA1
8d833fea56955bea155166d455662848c4c5cb0e

SHA256
39f6c30c6892250adac61a5a25b2af51e4a6e92643c83dd32d75a05be2892d0b

SHA512
9ab09fd963c7ff5d1a73cb4fabee52946ee8e6fc5d1257f4b3d0c26187c2a58a1d3b9f8577e704451dda5302f3dc138a9569a3d4619b46a781648df10634727e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7c41d645abfb9b6ca19d828d9d4d85d

SHA1
2c59a56365bd6520bec653b5c9850687731370e6

SHA256
269a36beb7a6f098f138b2389040dbb36c77fdd4a976f23896362046d1832580

SHA512
6d917115a3be860ce9cfabba08c5b687b2c5c5e2f9483786d899c1263ac6dd961356b76a15ea25f93c0a483310e201c46fde856e05787677e0de485e4a41da10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40e9c49cd970a9aa890967572778c41b

SHA1
d45af96c629364a664eb10757aee3bc84a9da06b

SHA256
2d09abb147565859a6072b62d4bc45b781c63e033cadded0d117b1b3cf8fa146

SHA512
b82376f588ff1a2cd162ec9b462688b1b692d98467edc730488f023a71c7321da6f2cf318fb9631387a0ea8127300aa5846da3c5c6faa0aa76d79c4cc564671a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6817a93a4f7465d3069e6d0c3b930d2

SHA1
766762d21012f758f43c41cb9e6e3c1e0bb5ca77

SHA256
65ce140492b4fec8594d0f637db24dd91ec7813e533d5ee0b2e99bc65ba5c4f3

SHA512
5d269ffe9bc427dc0ccf17014c5baa997d7bb68efafb35cfad65c474094a6c9c9aa302827d9958160da64da064e69f9dd7e51f439e208ae93032881309a6a53c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c32abfc6b11050b3b0c541945b11df2d

SHA1
d922aa9f3777a0e9ce7584c84b699634bb0f251b

SHA256
acfa19714b3df7ef9cef9b8855aa3a7576328788ef91ca829deb932a79e0cbb3

SHA512
0172094d70f0b12ef4d850fba9f9c62bf8ad9b5d7dfe7018ef724578a9a100fb7ef6f904b1b5ea706a23ef3a297f5905773924556b0dc107f48a459f4a75e977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bd491e90eb84b2fb37dae1f837eddfc

SHA1
22bb60a4009b5015d001c926a5d45c87ca7bdce8

SHA256
476469fe5931ac820c10f6531ab2b73a9aa1189dc07e87f172248121b50ae88f

SHA512
bcc2e5b60727d21b979141a11ae350c4c4ccb239524c237e9353c257c7d18cb70bc00a99ba0e3d5ac5a92fdfa82c6d90793493b4ad59667afe097c25b5e12724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f00e7cd9aedb43a2db37c8b6780344a

SHA1
f6b3673cc1325b833cf58dfe59335561c46ebce3

SHA256
a39819224678d1d7d7c6ced177f03567d6c2b7102158056a0433d30040787fae

SHA512
3b64cd8babfe6934da9f57aa88aa970b41960dc2bda380b809e821d77cc87f18dc548367a8a358e74119182ea9e69993ad8c0248259708cb8c318d2464c0ebef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e233efb500276363dc84b1f6af9f01cf

SHA1
8e848b36b0839a95788a58246fbffbd12db8a570

SHA256
6a95aaef8fe864b9f9ac7a1357661bdfa0a1d79dcafa0fbe4f7e76f1da6f73cb

SHA512
51a303976a28276a3cf6f6afdc5b78869d5b1e7307b949c668cec8aa3d416c21fe86f3fc27a3c9de699876540475f7fb542a9b34355ac889ae1b4f0cdec57bd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB9B0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA11.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit