9e4a2f7b39432f2622ecedf172cb1765e96b9e4384a5dd6fe7243fed0570b96d

Analysis

max time kernel
137s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4fde583c5b0d4bf354bf278c6b86457_JaffaCakes118.html
Size

133KB
MD5

d4fde583c5b0d4bf354bf278c6b86457
SHA1

cafe0eb491ca5a753d145c347af2577fd0f116ab
SHA256

9e4a2f7b39432f2622ecedf172cb1765e96b9e4384a5dd6fe7243fed0570b96d
SHA512

195a44f45b250eb8b923ac29c3b6a70c808d5b39ce9c5739963d0f93a710c06c8449b9c4692a2c4df42396a1e36e93e76fb01cd7fbe0f241b088f06cf7bbf0ac
SSDEEP

1536:zPZydlEbbA99YZHqRHHEExx66++IIddtt77bbSSSSccllbbFFDD998811qquuHH8:z4dlEbbA99YhV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000008624f75c05674817132df8d49b7723e135664224e31f0aa945b82f7b519b3cab000000000e800000000200002000000055b09eae0a6c5d41da96d11105b40f4be33c5dd5ee93b1e58fe806a0c7c4d08a20000000a8e1d5dcb2f1572cf05e7eab1f8c5c098a5460ce63de526eb35e946676061695400000009c09adf5ef1b8ade390f9cf7b3dca4e69a782e14fc2c46abbb1d1993c670a4e9f550ebd978245e0aa7270e928f8c861447d659848689de4ab3590da3677750a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431985756"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00660ecd2502db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000099ed3a89b41fa26350481a590b0c59beb284dbff6222ea12b41e1705bc01ce5000000000e8000000002000020000000e5e6e7bba40bc054cd24cb41f57cb8b2499e8f5530a66948754677478080e36b90000000183bc4deb3db60d9c41c5d9e51619a846ae49c34d9bbcd6bc682cd347dd5a1eaa6aa96677e3d091476ee7d8f8c2bfec9e2ce9661193bf55bb2cf5b3e8adacaa153649c39a4698dfc0daf1ec6d98816c22a3abb69fa0c095610e9b0907c8aa51b7cfcc1530f11ed38d91508f05fa5b50728b8ac4fd64baa3412a027c4d1af9a18c510663a3b0a03d4f017f47ad79be4c4400000006cf6fb84dfd00d7ef53bbd22d6e3ec43cfb50d764b4a0fa4593aff177bf4948abfa94144390393fe61bb97efbb8dedb9e29965213bcfce756a0933defb3db0de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2348F41-6E18-11EF-ABA3-46BBF83CD43C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2572	iexplore.exe
2572	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 3028	2572	iexplore.exe	31
PID 2572 wrote to memory of 3028	2572	iexplore.exe	31
PID 2572 wrote to memory of 3028	2572	iexplore.exe	31
PID 2572 wrote to memory of 3028	2572	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d4fde583c5b0d4bf354bf278c6b86457_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5fa5f3506c2b6799e28dc41386521e0

SHA1
8a78aa4bc303276e8b927718e3645c0d26012f12

SHA256
b1f986d3e54297fcf2a492d5ebc807cdb3e1e9b050290496fd71d00fe9de9bbf

SHA512
e0d99e7e209682ebbb7cdf31cfe125714893502e9c9aa3d98c200be634f0cdc535ca2b95733d214552f6b355370d5a0b0d4a85565357827190445b8667781434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6db1ef5c1e3fac53b65d97e4e4c6b1fd

SHA1
717fc0de7d76984d9c32164ffa7ae694357194e2

SHA256
9527c14bf5b22bb7cf19cc1677e3f9fae0004701ac7eaff8fb3e1d00680cdd72

SHA512
2f78f099c2ac850d3fd841247542ad2d9abb68ed125dce11695a77480d766fe48068bc39296bc0a664254a4b94e5ca9c7857fb23e60d45cbdf4d33c6341bf3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fcd0d51a7daecf7e3849f0b02387036

SHA1
6ce63ec8614782f854eace6ca6ede58029b471b5

SHA256
d5852e7409d0b950e128ddd9771fbe752d89f6728ad9bcb3c69a0660fd8bf227

SHA512
8147225cc3261b4a65bc92acb698c6830f97b57b0f6f4493bc998684c38809dfad3d48383bcc8734e31e546ebbd62131d995640fa6498954d86155ef7ef40824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86eef9790a0826bf8f19f7481df36407

SHA1
8ba32628b07f95f74901edeedd710953219676eb

SHA256
b33f4f3d9656c85bd2e8638361d6bf61c5ae84f344282af00202f6edc900420f

SHA512
b55027e1e9457aab38dfb4720f989b5767581cf08031ea737e91343d1b58f74804fc876831de6be86af0123b05f2637d5b634dfb4bc731460bb896628c82eb6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5057b7758af3ce23bfcbb8e2d4fdef8

SHA1
ccaa9b846cdcd4fef1be242231bae867f55d6048

SHA256
fac2c9064047ec8de30ef2a82ca1bb33d9173773fd215f9c02beae4f6658c662

SHA512
fdece5b2b42ab967a85b44df5a1305b4b89f363dd360281d6c41fb27379e3f12292861e1d6518e01620ab1f7c81f8c03e38df012c6d5ef70628d937c51393cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
373aa3c141b1b70d776d7a241e832eb4

SHA1
72ae300d2807e5148a3c769b22278b2cec8282fe

SHA256
d482705e28a20fbe213ba6f7fa102790dcaf209fe0167ae77594f67d9ba8b1f0

SHA512
f2f73c2c16a8c611b30544e1aee1a0a209e8ad8f5a2cea8c90b7aeb7cc65005f1d4a222b979c27a763e3f61492290d7fa9e480b152fe241c7e0c67532ecd2252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3000c0e42de4fa4a6df88abdd327af0

SHA1
65d87eed59a7ec849837435306aa934f27e2c6a8

SHA256
1c43fc8ac09bed6125b836d6fe2522ec26e057f28d662b56a1bdd99491dbf90a

SHA512
09bd6509c8a5fce0df4606ff18031a11e850e7c9cf658a4a5adbd05204af9c40ccb9b3c01db1b8fdef5266e63c4b9132afb30b63ab6d1a5a73a59bb513a6bfc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08f01aff317537041f197f05deda9ec3

SHA1
cc70ec271b64c816db983c6351c5622d32c86f33

SHA256
12eede052bc6952d681fd30de7651c8d0530e5992cee059a30910f0d65356116

SHA512
b5d29eb0cfeb18429bd5ce55b9f09ff0feb8f0aa71796d9a2404c3686fd0be6e37261b35b6d6e852a3e30613f9d55bfc8d3784f1e787b960fe0edba983471a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6319b711e6d346b0e458f204747876b9

SHA1
d56375f6aca23954cd787411370fec2809d1fabf

SHA256
8aaa8ff76a38f6c2aad8329da1fd632006baa43b9c89f08c7f8213d32d613b97

SHA512
15298fe011c6c913e1e634a43332785d604a58b98105e6a20ae38fe50be53ab1677b6add05e5a3dd560ca9e35814acc433be29cc02462b7e97ab9572e6165dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c01fb3f620b3d52e063651c82a2edd21

SHA1
664f86d2de1deb5fe655b3b89b0443691b1b5138

SHA256
62a3027dbebebed3b2a3a207c71734900c8cfd447e494f31ccec465054af4208

SHA512
1f62b63fcd9ab6c74fcc7cfa0e5adde81b2697bb0031d0b5fbf2b1ef9cd254eae0143ea2efbad42a9ae183f819ebafc02c8fa12736713c8e3eea77d54ffa3af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fa7e25c6038c9a13606d6822f21adb0

SHA1
1a5b9e7403f39da14a1b2b500ccbced937bd8315

SHA256
bc134ac9a579b89378f129f259e6df20915c58a9607ade8b184cc2852851648e

SHA512
21e22d6cc42c6aaed719de6adbc064fea9c0ea3d7c8d1cd1333249addb020efeb87beef37be4b302b366f71423efb826dcdd58d890f8d1493747cecbe3c744a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0faf6da943ecd1c6a30fa2f3e58f1773

SHA1
3057d523af5cbe0ee74608c1fb26e803aa7f795e

SHA256
07627a791a96778fd67d7db826cf858d93643ca6801f3d892f7792fab5c24577

SHA512
185ca17cc3b63014d01e3c1fb7ba98917125a7ef2013ed35f3385844c91924c365ef8003b1a31de606a6e2d6ce5e04b4838ce161d8e97d7036e7926e45486981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0925aac9391de574d553db5eb3673e62

SHA1
35c55912973ae85163b9de7ba4285a2c4a2d19d3

SHA256
fd793ea29066e995c38294e494b36c8a0fa9ecfe935f5008445dc32a5fbd2bdf

SHA512
903d142cb1d8fc9c3ca973ff44b84c8c3e020fbda324c3f19dba4271862bd8394297319130dae9e318792c9d9f62ecd2b2a5262deda92481500e933e622a9fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31735caa913d9fb930bed7759bc92aef

SHA1
16005101bbfbd3da638f601239933c0f2a34de88

SHA256
9489ee61d89ca6f9889e5b3867213f7cc8c4ef1e635b488ea8d6dbd205dcbe69

SHA512
683d679be4d31e5c9af3cc4f70d02b2c6c21c863b978a159a338a2617e95bdc3f6e08143eff3121a4d737fa27c23f0791dc1722fcad21f509e0f0e71565b6f52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f6ceaa4f0c130324588660b1ae96bd7

SHA1
7e42d90bf807d300aae6267c248cbdba889eb926

SHA256
57e29261b8f873b5820638873b689e64c25ab7afbf2ed976cfc78e428fa52312

SHA512
86f3a38ebb147716ca9e457dc64a21e34fd0067d773fd66333d3adb65f8fafd1095d4382929a01ba7fb81eceeeb5d50398fad8052a07e0882f8f77157ad94b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4a4b12477c0a43c1d8a54fb9bc64243

SHA1
229f55da6a46df39d6d441ce6b2351483aa91fbf

SHA256
eb0bcbb31e5ea71caeee4357b103dabf12039c78894a1f9aa84217a85d1a0e65

SHA512
a06586824e0f4cac32883c7f0f2b9c1fe195f469301e06195b6c9c97f053f25f66222cd214e85fda4b99adcd497fa8c639c52b25b61b596bab1ca566c38c7128

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF421.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF4A1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit