69faef2e502c9c88921a57c0afd42b8332f0a42cdb18136880333be8ef5d1811

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d73a558f2626bef1eccf039e9e582055_JaffaCakes118.html
Size

35KB
MD5

d73a558f2626bef1eccf039e9e582055
SHA1

7fd26743b2b4bff05909b5e2d94661ac44fa7797
SHA256

69faef2e502c9c88921a57c0afd42b8332f0a42cdb18136880333be8ef5d1811
SHA512

43bc820acc2bc2821f46c3105d7b67018013d84dac6ae36b1e7f8a7d0842b90e1f1fa83efa2356e767eb1049799242b0bac8cab606334e05b78a42ed0e8ea231
SSDEEP

768:8XcHTUHwPGZB/vEBRvjVdTakxdDjMi0DRP172WFTFUF0QFiRhj1C:XTUHLZB/vEBRvjVdTakxdDjMi0DR972T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3051b1870b03db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432084408"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000001993b8a287d2e7cb36d64297a3ebcbacc6415c16d3f4edb826bec89544dc2b85000000000e80000000020000200000000a0483420334013b9859190c38db8fe3ea90e3afacbb58630251ef8526e6bbc1200000002411252c4d83e88a31d95f51cdbbb82663dd6e3a26fe8453572038135785d93e40000000051bde4af0d8422ff1137c60c9029889ce89262b7b96ff27b97c13bf0b5fca3b95d10126d0469de5d0fa3ebbfc0f1ef15bcd83b5ae7bc45802e35395ea1c65ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A35584B1-6EFE-11EF-B5A6-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000004e0eeb84db7520750ac98e3106e29d8e2b0142725e02f03248349a92c7f71d8f000000000e8000000002000020000000e2f6d3ec90c21fdd1f6785ab9bc9c911df3551fe768b9c253c84b1181381c98a900000001d0ccc212e601ce25fa4a08c02c49321c4f946b5bb45671b6fabe32fcb287f78baa5b20a1ef47e92f0136f735dbc820495b5b0d213476c9eec2d1559372228a5c1b3dcc726473f5ee621011c266e80a83e21f36cb4d835b621bef442e710496a7629da24dea267766ca2af5985708b0e7a958af72c85550b4c9bb508836af63bdf9b7e2dd44efbd7424c0898adbe0a5c40000000eaf453132f8696da59f66d4dcd5f35401c694e8b2ff84b6e0799bb3ed95dd243627f485b4dc16f789ad382415a71e5707f6ba29fe58f96e46c7a91540784a144	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2152	2092	iexplore.exe	30
PID 2092 wrote to memory of 2152	2092	iexplore.exe	30
PID 2092 wrote to memory of 2152	2092	iexplore.exe	30
PID 2092 wrote to memory of 2152	2092	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d73a558f2626bef1eccf039e9e582055_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
c58bf21921a6f1579958647096da58c2

SHA1
9881524b79db1650a24c1023a83ef25f300b23cb

SHA256
f3728f0bc13310faff9da4d593813e3e7cc4f2b6d6ad693a08a848f9d9933410

SHA512
3dba7f214ab802c282f495e5d9ab4a34c7a1131586cd3b8db1844a4cebff1c153fe42fec978606678be51b7861f24e9fda373ac5806de9ef65257ebe889a6039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5adce4edf23f478761171b6e5861425e

SHA1
cf16acdfcbf510bb760d59040d700b0fc365bd80

SHA256
b8bc99c16cc716fd91e895e28c8fe8c6f94d033009ada033b41fea4a673de169

SHA512
10db1d002f137181520ae98f1ee673481cbd4384ba302eec265fff25efd0beba6668ed99d8ba98cf1ec872ab0967a1f46ec6bb2da4b3b4140c53b9b9625b9cbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0db479cfcc14b92f4549546fd6a2422b

SHA1
db2f264f91219f59616dee1fa881094fc973bb20

SHA256
dcb32651d72370b2d3442f77b63669a60764131b78eaaf847ec221659eae35ee

SHA512
bda1d6af326ea9de35cab618cc0f3cd6f492fba2dbefd2f469f6ce91fc5518c15444dcbcb68762c0bc66b3487d6369a7e84dbbf22954468f0bfea8bf72368c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96f833fa98e9856cb03d86169d49bcf3

SHA1
666d2b78b81aae61fbeac7dab7bca860651f29d9

SHA256
20b2d1645c684e40d2f8fc37f765d18efe4c762887c42dd92de1bb4f78b0ca14

SHA512
00ea73292268a755032dd04ac653204fde7f3965bf7ea953d094b1f9689a364be10ed8d0556183032acbaf9d1e6ea5119be53c48d503ec35273ff4e4b88e22f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
654ec0e708ba5867e6dcc8711b6b007f

SHA1
9215efe38030a44682aaa17b7410d986eaa6400f

SHA256
90c5ea4c4d76b0813ac25fb89c76665c4bfe3f2913071031f5bd8fff0a70ecbe

SHA512
8c31e1228bf1cbc2fafec76c84063d9520a93f42a0fba07f2d18621ee2c7e4ef16832200000a78e56b8d1848316d23b5260b0d0c862eca4755cd31ae0b00f026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f513e899fbfa614e0012d435d7a5954

SHA1
871f98a899c9b033ed1103cf37e0f3c3232b360e

SHA256
b7a74cb9e5c601e0f8b8d575c47d262d4af95da937534c6fcfc1ffa6e26f9822

SHA512
893152879119f252765d250ba10762ee6c3df696aa1eab81455125a5b59e9e6da65a0e96df1670369e14c91e801ce98cf318312a03b17bc3346a74fa698d4e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd6cab061d19ae93652514abf4063ebf

SHA1
028868a0341870e6f106b600feb8e12ec7ead04d

SHA256
a86f23c131d67a8b2d603a00fba963d0034258cc85ec21c8f89cbe980bca6c6d

SHA512
7fb234b3d232c8ac1d04dfc092876baa4a6480f19dffb3e5d6d0502a41bd3b549f5a3b13a96b754736995dcd6aa7f2071eaf29bad0399c3d61726cf2f042ee2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e704ec4ba15b2e856d6f0f6d384bc9e2

SHA1
95214d389e35aa4470b8207fd1a5f0cbad8dba77

SHA256
a240ea12bf910aaa477ad099efaf61b75c1f1e8b98c6f99286f899a5143cd8d3

SHA512
8d6eb3c2bcb3daa8f6164fa1925483fee1f980a41b3f90c823cce71a469c57ccf81563abd8043652a31a4c4ac8deb61887db2dc2a11f8a491646069db42fdfda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f657d2c10e626f83c28a25b11460d166

SHA1
0646f7cf515e3bacab0ffc82d94e41c830284c5a

SHA256
e3821b9f745bdc01e065617cad47cd0ad3664bd5fdd4e350269250d4ec2b9715

SHA512
a4f8e7ee080141426e869fdbfe351e8e1a10c35447c8189a8ff0b8504697165c9e6d5b3e1b93c86d91e7ff0f781a04d4fa7f4a856b486182cd2bab8d50c96803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99d35268a883ff0a7905f6672c61c308

SHA1
1fe47155893e896837254b5c341232069ac3e7f6

SHA256
9284d4c29fd456dc4b73fdfe560858b6cc8c7a77ac006f33b76dd066ce882e99

SHA512
f743511c8537cb9bbdc6187623aa00ddfd04b18a8312dab9958db31b8547bf6b27a5dd72a393a55fc9e2d188f5763e996d059948f849277c60122ab60885ba74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9c4630406c27834c9457b9a1e464184

SHA1
a29444c3149473a64a1d637f3e2f53f69919f7d2

SHA256
98743fceabcde41515cf41b92230ae4a3dffbe16b828c0ebabce4a7a1116bc8f

SHA512
7e90e25c000496d1635de7e0988095bedc2901412b6bf55c4b039c1f96265eaeeb968a213de77a0301040209008e2dc4c06170c02464107cc1573aad34d64823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54d74271a4accde00891407de4e4ff78

SHA1
a687ad9c61b44b78f7421e8da6adce7ebddaf605

SHA256
a236d8c2a96901ab06fe1695b10c3cac00203be4cc88e1aef091c74236d04f65

SHA512
7d8f8b085e0da8f46c79cf1e1cf7b95e85722db1485fb691f0f0839901a284aa52a1a1d41f670bc43d0d6eba409d3e65d2b11a92a5e0c84a2f908642198ff205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e13f867989d5a99cf6560ee7cb60f3e

SHA1
cc342ca8cf88bc5b5545d7f82d1d137598ab8e74

SHA256
609246adff73b80c67b5ca39f8ea95c8a6da24333a62b3b8776c9b4cd5422d97

SHA512
d47ec39a6e4ac07e9cfea9bcf3f4ac7523a33842105e03004cf5e84a3d0ccdf3ae435411bfb340c98fe1177193c4f5d5653401b50b9f5e2042c88624a6bf8c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f50c24fc901f9257e51acead13ecd74b

SHA1
bb5edc09899549af6bca70e8b6c7c3a884307a2a

SHA256
f32dc82b5ac84095074675d67e8073c9a0ba6cbaea0e88f6d4583d019af1c0db

SHA512
d4f653bf1345cec0ed17001fd8a833fc59ff5d11d8f880f077bfa15ed1c83a84b1651b2ff221d5157f261710bd9bcc40c5359c85f96039bff27a9cdafb9e5707

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4BA1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4BC4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit