96582ca4dc7022ef45f6ecce39d6c9d2da72a5c5210f80fbca2ec1b6837fe630

Analysis

max time kernel
119s
max time network
138s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4feade5d36befb0aaa2d48ded76ba25_JaffaCakes118.html
Size

11KB
MD5

d4feade5d36befb0aaa2d48ded76ba25
SHA1

acc6f72e226673e84d318c0e1a52b15a1ad7d841
SHA256

96582ca4dc7022ef45f6ecce39d6c9d2da72a5c5210f80fbca2ec1b6837fe630
SHA512

43c067062a8aae82464343e8065bf3ff919a889cd91a39344e4fafd5e3e274492da120d1a7e9a0bf599b36bc3d38009527f407a1c8d8b7e5a9431411d2fe05ba
SSDEEP

96:uzVs+ux7qFLLY1k9o84d12ef7CSTUGGT/kfnskOpQ7VgTFeQ9nnxTncz20wlVHcD:csz7qFAYS/PfBUlpxd9PHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000020bf6b575d17408c115c1253fd77c42468ece44421c90559395e172da133b7b4000000000e80000000020000200000001404cdbe761a478908cc227c5b0cbfe9d02dfd1d56c952bc933b2ed14be4f1fd200000001418bcd24bbda1057185fb1678f7899f4a236740eac663d3b4a64503a7001d0e40000000994305b631c6e3282d998221232aea3c832ccd7652ab8a7ec93079a027c1bfdf3e6b9740a91d1edb5a0a1356259a0af0d0d69ab994e1329046e18e9b537863a0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9449E051-6E19-11EF-9982-6A2ECC9B5790} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10eaf46a2602db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000eafcadfd8d22f32aa9d78471c63a8c3986e725591409cc0d9dcfe41654f1c22f000000000e80000000020000200000001658181366bda5142ebdb171836691cb52ec9e34fecec5227ad9ca24eb1a20c490000000834abf0c0cc23fff965e24f7ad5bc29dc63b8ab5d3d918e54dfc0e5c78984d91b98ff6dfabf5656db2db576f0356f4a08181d0e163a6774258c230ac2266aae1600f340566b88ac9b333a69a60f17d58486794b36f3914bb5c61e387650e414bf559f39ba229c5f5c647cb9c1037d2cdbc1bd718b24f6ae07549848fa9f2f6e5ea78fd96da42f41fefa2cfce3c5ef6f040000000a420fce75ee24633a9831e855413030200332ea8095a05f839b7d2b0db447ec64fa4e933cd7c104044990c22d5c64abfb36c9cb34409d6c96324ca00314ba3fc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431986039"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2668	iexplore.exe
2668	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2764	2668	iexplore.exe	30
PID 2668 wrote to memory of 2764	2668	iexplore.exe	30
PID 2668 wrote to memory of 2764	2668	iexplore.exe	30
PID 2668 wrote to memory of 2764	2668	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d4feade5d36befb0aaa2d48ded76ba25_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c7f37558dfdd81e98769900c9146936

SHA1
9003e1a40c96d8f4e7edbbf91d7c92c934acdd77

SHA256
6b43cc1261f11510dde46a15a712b0e6d4581b9175b7a428083a00717449ad97

SHA512
d0ab5b40edc27e32da8681d02d0fe6fcc206c29efc41ed50bcbad145507a812adcbb10fd7c89f091ce67255e99c43922ea62b1cf80a4d30c0d80af391fcd6ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f337fb283bb880d853d82f7693d5bd5

SHA1
25fcf3f7869ecd0d4037347ebaadbd2cc9d0a8a6

SHA256
bc84d9f148a44c9d706b3073d73f69afb61b871d9a9c04b4a6f9f55f5c486c83

SHA512
30c4f21787423723de8701c245bac21eae3bbdbbfb998edb08ba3cf83b6a90d6fadaaeb9db03f4b75433f2d575c2e380dc7e1a0ae542c0ab6131edc6f56425bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e92cccc330dc0aa65d178016fd468a1

SHA1
978dc2b0924f34d321fd6e2c96bf2dbb8e03c88a

SHA256
90c9255903024e9909434a26a52247c2aa26062c0b3bb0d7d0b295e45998902b

SHA512
f3fc816c9814620c2ffcecc998c755cc59a00d5f6b727b7e88f3990a9e7c56221ef5975ee9928efd42835a01e993e0553bb74630be3ebd9734f3471fff039fa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5defaeac2e9b3d123dd10d0f17f5e9fc

SHA1
6bffdaa16b051d4abcd03dfe65efc393de053587

SHA256
6a1542674af90496b77fbdd17538b99c8ba0bc36997ba7ef5f54479800c5d1ca

SHA512
552ae53ad3d31446afa5e6ba8963eece5d2358486b0a50402152a0c2e2621f6cdf9e9be020353a315a427047cf1656b82ab5b7bf647023ae011af270c5ef0ae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d863ba1ba86ffbdc2b0cd2ef183ec126

SHA1
68002ab8723084a640fe4c5a9b4f83305685ac5b

SHA256
097c511a449f4d46a06beb76bbbd4fa8fca3ce35a69ff7de3771c77bca6b1ef2

SHA512
ec5db2165d1beed97c23a690531d1c818b016b1d799b5251c6dde70b0dd5e822d64f5ad11ba15d19a186894a6a776205c22d54190dbbd1f0f0d9b8a8d1e6f41c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71cda75e0856d3c52c65477b1ed01467

SHA1
92abee4c8357371ca0b7d8836872db9046fad3d4

SHA256
931f91d6fcb2b54e29a55b666d66fbc18165cfc1df18369ccb7e94ec39a784bd

SHA512
82c3ddbff240974b6159e2316c4a8d69f3a56b9dddb985c5f1f4aa479bd520f87ea734f801d6acc01e0d0f2f833d6ddd0cce8c24f5a9c06c8dd42f50b073ba89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5fd2c25c7b7fee5e5b4690a0b6e1648

SHA1
4fe1bbebf3080f860b35c6d93822488ce320bc99

SHA256
a559c250965232a3a3971e3b11098c2aee4ba18e912d92e47fba50d889b1c642

SHA512
83e8bf259fa8ffa1dc55ce3f2f20eaefd8f4a94002fd94817b018d0ee2f61554858975992776d668311cc531c7b6c350521b1f5e6d45cc97eeed59c6b62b3b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ef99d553c5ab6811a715c80aba6595a

SHA1
8314af89a8f3c69856ea1ce187233dcbbf7a23c1

SHA256
ab932ff8a1f707b0c905c4975b76012a3e79f651a43e1a1a7d179528d2d50ed6

SHA512
4fa0332026a9aa16e8bd93bd77f2eb27f4bf3dd5d806b47252e902488ab0718095a66f9ece31b0ae598099deab45294a157eb971510be72c94f4f66a63ab479c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d38ef0e8c5cc0f2694654a0db13f4010

SHA1
2dcdb74dcb93b0017890f80ef765447a085fce65

SHA256
d23e0fe5a52cbcff8b71d2a5fd7a68211a8a0c9a6571a378898169df7e5d5704

SHA512
22c5c781059f594e311e74a5b0ec2031e86d33c9ad648298dce0274a002b1c131e2e2e20a196d52b91a9cd7b98da88a4ae14d5fb463a38aff001ce08af537e63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2dc3517bc45009e34e0766ecfcc5edf

SHA1
5bc2c06c65bf2fb8eb03960face951f6984735e1

SHA256
8dc7192c2d3df61f71b2ce32b6ce691c9a3d5fa67bc45b3bf213be8e482355b7

SHA512
ddd71c1ddf832b9b53a8bfcd7ad4542a665deebebae02a5b61060d877096674b93fc408c010b771629191e69d30b91072256f5a969ad5796ac07414cf495ede2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ebda06080d8149b921a3422be149ff0

SHA1
fce13aa8f22b6303f546cee6bef53bec96de75c5

SHA256
3ab9eea5288db947d809629c12739e00635ee5219c6be46b49d3ee85fc5b212a

SHA512
4afc8c4c92233104239935016ac0cb803e60a6503b078906f55824e518f237a88397dc20e23c850a77e10dd371f59dd2d94301011de7809594689b339da5b0ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdb031bf7ee794ced5ab626019f6b89f

SHA1
4c46de5d30536ef331bb8917b1b4a4c7573b6980

SHA256
cb40f0496bc0d175d4f8dd72f444150eff5632e1463d79b0ca3964cbc05009c8

SHA512
6cafe142df03ce2f3b398ce30d5371c0e3ed4d82e1876811f747633bc2cba70fdc9c21f398851cbea5228124505091592f679ddf4644bedc809a67deb6de705a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e89f3d304856d32d0ce0899dad8062fb

SHA1
6afc9979e5b279b6a3bb4b60c2b32609d477c191

SHA256
d02620c27534bd58e889d676d96cf79d69a710c7f92c3ddf3cb17c17afdbe3b6

SHA512
e80f78d5a96ef128d3ad0503a94984f3a3530500f67e85423d4f6782a7c367ba4088a3f1be2007585a6bd035c784e76acb63b04d0bdfbfb7ec117275c4ca0a0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc7f8997b9a7ae1ccd916f05b6acb0aa

SHA1
08d9ecc8111bca1fd30641ccf601265418044101

SHA256
36341adf828ac18017b9c0b06a061ab46fc2792612fd27a354e4938358bec942

SHA512
ff119d3a984dfbed7161adf60301d4df65687d5586572e3a06f26ed74f5628f4649c528235431600573e994c57b058d088dc9b6f8365ccad9f152b9c51ef3e09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fb7f2b5ed3c02ef9554952b5277c5f5

SHA1
d672819edff9e48adc36be2ff290a6e0ce29af63

SHA256
86ec92a13dfec11b583c9f15ddd66ce2796769016e3828a64f13b564d962cd58

SHA512
5a6af84c8c07d8a1d5ffb229fd9446a10c3e35489ffd3ee3d310fbec2366bf94be5ae4af1470e601f91de71fe8da78f96d694a9c3cd60a9376e486446d694511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c5cec5c87d0b2eef6d50d0c4ce094ab

SHA1
6496185e734b4f46136c10daac6fc97e8b6da146

SHA256
5c8c67bb6f41dcb32d876d887d3798f284a521ec649e8f96094c333fe3fb7936

SHA512
657b2781387cab2390e4c37ff13b2b6c9e519f5643551c0a1506d806baa040f92a0a8a64d9cbdf3952563687410c260b2db6f767335ba302cf1935893703b1de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C56.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F94.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit