60e3c723649029aa955a2ac9b11ed35e158655920df282c304446093614a7d60

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d73b11a8a5aa69f8a66c134ea165d109_JaffaCakes118.html
Size

121KB
MD5

d73b11a8a5aa69f8a66c134ea165d109
SHA1

8f5a3c6399f6e741c37b38f99995011d837dba32
SHA256

60e3c723649029aa955a2ac9b11ed35e158655920df282c304446093614a7d60
SHA512

fac589e1fcae2bf777a0d4a7fc9810acb78f60482e8a9fd98c68222a5ced092013c42ce85237b441f3ceaf7fa78c50f13846da52375b76101a3f5729c2dd6001
SSDEEP

1536:R5S+KBRTP/1KWA+WRV+Pt+RQD5aOvkum8wHf1bbKZ4:2bRTP/4Rw95aQqf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d6d4f20b03db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432084556"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAF8E1D1-6EFE-11EF-A6EB-D60C98DC526F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000c4cf896ce75ade03c3d4b8e433f2afda805a035f0166131b0a8f85aa6e18451c000000000e800000000200002000000036546e4a02d43a762e02e5f7996f9afda40c2d282f06ad3bccb50db3244c53bd9000000062f7b4b46662232cb2b32cf8a69a4c56dd5d4f58f1736b4a554f0c953a6b2903e8ea077a36f7ab94612eda6220e2b4303e04632394c3878e7fb53188801ec40d6c24d61e915c2704c1dd0cf2d1d81d446a749b563d5b0d26e1f004b0ab4a914f5f8cf3ff8ea1167b5b962905743dc9069545044a4d7c8e33bf18270d6f1a336ae6e228a117a18e5a766d2b4b71c3a3a940000000126c5d910339bb8fe6795f291b4fdcf58923890c96661fe8c4fb03e3fd39b20d3aba010c347388a3fc8fff79f75e4366a9721f0b7ae3c29fce60d77eef29fd95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000189f49735d77c1572175d1e8fecac83b2a38d75ea53381a3a9a9631f7738adf3000000000e8000000002000020000000195254724544147521750e625b5d4b546aaf626bf8e64bf6b046c1104c2189e620000000f299c08af524a47a1185023dddc7f295eaaeaf7fb73291e78c9bc4bd70904aa240000000c2f329901829d9d65292f39d2805787fc34a8652a16739d83e6258d2f217a2eec188ef02d06df8cd034e79933359dab3bde9820b23bc5dd09ec89cb09cde3628	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2356	1984	iexplore.exe	30
PID 1984 wrote to memory of 2356	1984	iexplore.exe	30
PID 1984 wrote to memory of 2356	1984	iexplore.exe	30
PID 1984 wrote to memory of 2356	1984	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d73b11a8a5aa69f8a66c134ea165d109_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a441052b3acd555de4ba845cc6155c02

SHA1
f82cebb179ff175e6cb9773540b7313b5afc3fbc

SHA256
73503546675a2e364f27f4cb60f73cb6664c2224649f2dae56f4f62e4eba3725

SHA512
b9e05fd948e88b40fbab15623794ee1d5af256873e4df69f490bbdeb5a6b1a596bb50e2a5c0f27c671201832639091763c11413e2e490b37095bb9154b1cf28f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d283449231deaebfe097e07e87449ad4

SHA1
85ff2f9b6cf660dc6e092016e371b285e0decc9c

SHA256
547ced9454ba337a06072f55ce6e1561c281287626ae215049430b0afdeea337

SHA512
0209046d34e32238ec77f63ee03e9c05e8314ddeb4dc31a35b388ac21dc5d7f41777b41474fbdd0a6a7fab6cdefe659ee911b380db0febd820971b5ece335055

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4df7b250d43a748e7112a45aab771b9f

SHA1
c1164cdc4f86c46829bf7889a205261bf6ccd77f

SHA256
16c171c030adcdf7535db06457115c93f6d312c8259af3e6316bd0ae396cb44e

SHA512
e7964d6527381c0b7e7e14f03a2e259123e37f9efa82a4f846fdef04dbc7ec8314d3d46ab031a2d58e7adeb77eeaa17ac884266a33a6a4ffa2c8331a155ed7f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d271f6274f3ec48332c8f5a698aed053

SHA1
8b6515ef27dcf957331893bdf98d76f897604374

SHA256
f38320c24824563b512f70921f98bcca9292a756441ea6085f8ab420060b3a30

SHA512
628e25e68da3c5d328f347bbc54fcd22d89ef17fc644ee5e92b082f73b4e441064746c632500136e4eb61bc21b160e10a511a3dfec2c441e9fbb460ce870e1cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3091b027d2e5768dcf7de044994078b3

SHA1
3de2308a67d30eff3a335eb765409af735a5589f

SHA256
3517fe502b43ed82dad21310b219ee686e840ebe0d4dec092b9d17ff5f415e59

SHA512
b72a5aae6257f58d7f7587553b855ef28cd9af6e339d8de37aebea6316931fb1761b7d834ae4a329a3e3a28c83acac899b25e624aa2475738fa62bbdeb63ce12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34a2adfc1b7a38acb7231f66e9c50e1d

SHA1
2e2312a1b8be0b2b375feea96d4ae5c9b9352a8d

SHA256
f63cc067dea2671c9e48dfbc2fa0997838dab3e83332ad15d419f1f109a5f8ac

SHA512
52905a905162389c242328e1edc2f4d3a619bbe346193c928efe15cda525ea4ae524d5df65fe15babe331e5d9c8122a068b634b90b1a8c16f07c25cc99d22fcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
778fa511d9dcd31a6f1e25f63e6b2bc6

SHA1
6ce19f5bcf8a27d855e59552eb78b821ebe3ea68

SHA256
92cd6ac878622ede316b1e9899e9bb4393d8c259c62a44d1de56804364e1be0c

SHA512
4a0e7596299d97f61f4b59f1781e956eb17121ccda1dc3dfc4829fb61401aa92ee05aef1a1412e7439b6893c37c3d6ce3f42dc7341e2a5d8ad89708e17395399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e7601ee8b2be446ee28678f3e7b4d6e

SHA1
17bc5725d695976eaa32c0464d8a6a276fea18f1

SHA256
023ac4681467cec5d2a4def73aa0852747b515f0f9210c7be61bfee4ee11c40f

SHA512
31fd7b25208fc07703b39f1b131fad984ef0bd93ac8a8871aedbbfc474b3310f1a406e93f8aab9dc026b0aea9886e5a34219b0342cc749921cbc8ac2d2bb242b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d739bf03ce6f0b2116758c6a8a6dc648

SHA1
698c32f29bdbc8fe2969d103e5a339d9262ab818

SHA256
85476ab04169fccbf5005db13d739de9316d1f56a6e826b9d5aa2b26ced90e67

SHA512
388d9237a2f6009e821f92a6d01df63fe1f8d32cd66be33f3429a2754a930e9f8d337db45e42943daae77f5676b3a1c9c68c26291339df2058e1c74c10179faf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94f0eb56d402eb224ee25c55016420cf

SHA1
33d4b4b97b231e65300e8ccef9334c8d412d3aa9

SHA256
4eda3fe97c5454f27bc5c5ae3544e2b80c3ef7f65ba3140a850db98838d9849e

SHA512
ecb8537235c78399ebb93e2c1b5cdca25e2018e1fd7cbe221793fb3779001b1d9c33b29c2656cfa6c06d40eb63d8260f54010da4cec4354f22b7692ac91fb67b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b61bfdc838e4a8e5addb57546874f702

SHA1
755f967fe9ab465799ebcc3753384ae2db3771ef

SHA256
1ecd0041f2300af2cbde093416934a569ad4ea589d092318d1ba6b0f755509c7

SHA512
325fbc5b4ff532432012ed7cc865af567ae3ef2fcb53722d60d194495cd2fd2d4c394cbf1b1878c0afcfb5c57493261e2f63fe8a91a02503014e0d48e9883ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf683c56e265edeb5c401839e62d17bf

SHA1
c83ba059d8acbd8cc082315c472c656bad1e843e

SHA256
59ce321005113c908194862322a8bc6a4291c1462dc5a36003f10db9d7f8f637

SHA512
5f175f39d1afb3ce7998c161b472e07ca7e11a240b381246a75cd6451f7ea784a72fc392e93e232f47db9c4eb447bf5eb26e16ce9f5162e7e8dd4c10fd8d444b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73be5f78e5da4aab346ab53676f78242

SHA1
bfd59a59dd0fdb363d855f03141b44db73ca5a22

SHA256
6255d32050965d2275eaf7aa6fde100be66c367ac86f0896faaa5e82eae6eb4d

SHA512
f515b29bdc8ac0500eed2a1f5adffe2c1d56c7982ac5d6b72ecbee609731b290c53bf0b138ebe8b47757bbb7b3f6aa4e0ccc3a97b1bb48bd2b1661567a716130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22c462e7db6e1ee8f03a690f1cb10fc1

SHA1
43d9e32729ade54c6f2a90f2724ccfe980204fe2

SHA256
abbdebe7eb41478f8f0a56ec35f5b028a6a9659cc263152ebd9fe69c558a6472

SHA512
f936f1eab79b7332406fd55cc649e31b6de0471117c91994ac73b1c141cfd03c1c9438ec2970d595de87c3241a00fa508910eaf41deee0ff4f6e67aedcb1f681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd5151a3d351e07a7e1f2356585c62a0

SHA1
3b97d1a815c788bac72a8daf7f680f081e1b8b91

SHA256
64d13519356bfb12b4936af8f377ff68405a110cf43a684349506d471afa071f

SHA512
b40187c48a747dc0ac1b8504ffe38e35997808861417dcb6e113898b5927a80c2ff382939d193c15787351999e9f781decb07dba17b3345c43d043767ff408f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed84c1aab468d1289079cbdef54ea2ca

SHA1
c73649633bddd33f0cd39adfa6ae9111a9a17201

SHA256
a24151033383638c98d9ecfba20af15682d7d8896176bb7c282b54ac6cf1cd2b

SHA512
d1b160818e30a2258d3968688053528cd5386dec66c36a19f526b3856800bd732baac35feb428b65cda8d443bffb26382e06451bb451d8299056637b0030dc14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84487aea5093e2a593688b3d7458d10e

SHA1
41d4a7ec57cee1ec6cb8c3a208606ffd02a95276

SHA256
8ffb70fe458979f12ece1a74a561ecf8ae5be0818e87a6b3051c05a3f3c12de9

SHA512
ab549dfbbfdb01227d25762819d8793594548bbc61890d89f4775b028f0ef7ad1183eef366e819846887f3c33ee9825f9341c8c53d0b5fef145613ab197e08d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab81EE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81FF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit