d2d7036f74dcb3a0a1edf6ca08bdb1f08789f7e6624cc2701b6a767077233c81

Analysis

max time kernel
143s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d744c508854e19ecb4222966d3cbe6be_JaffaCakes118.html
Size

69KB
MD5

d744c508854e19ecb4222966d3cbe6be
SHA1

1be3c40f9578e3e8e196c7861802f18094fac1cf
SHA256

d2d7036f74dcb3a0a1edf6ca08bdb1f08789f7e6624cc2701b6a767077233c81
SHA512

87749ebbaf296667cd84cf6e9313eaaf6fa0e90b3cd107ad1cc4b79575855214c4ca4cf723e7e7b27469ee29b81b335bc1b7e958964e726cba61681f4f87c1af
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6s96duRD+R+LtoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcc:J3VRiR9TzNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FF805A1-6F03-11EF-8287-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432086533"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000d27efd7565c5236d318cf33a5261bbe2acbe30c321a163fffa6101df48b55ae3000000000e8000000002000020000000136925232d81cd2ff6f9efd7acc28140a32aba48404f515501afc7971940b0b02000000034b1010888fc5c373f7d6658536802150f02b1bd8d00f5e706830e5c5c575dc9400000001a4e30946020b45a5f9c345932ce3e5c001823dcd6ec34761e22d1ee2cd293dced2b2724a76ea221044f3e0f218cf4c122197cd5a95317cd14b040771da62ffe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c5c7661003db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000808c37e84ee5faf976964cf177642598eb1ca2f41af1e5cfe742aefc96faa0fa000000000e80000000020000200000002726687e8e6f39936eb3605bceaf3dc2ae7fb474296f6d76f4f983e9ac07db8e90000000b7c39270516a022d7a464effe40dd6033b2210d550da2db27f7680f8099ed972038ba3a7df7d67977d521a4011fcf0274d8a8a850b3ec921fbae9844ed88b619423056f9890a9bd8feb72396d1822dd21ac7facdb4ef45105199f78a7b1f713ffec35e8c04bfb9731c3fd8aecb97c1a9edc37eae8afa4b1d0ac03b1b9dc7dcb42a255cfc77218a964c0fdffc927d23454000000064d7d6ec19cdd62fe873e4541ec5281bbf7478d9eab8d045c2a9f6b74a051a500285eb2d7bafb0eec2575e8e5f88ec1d19d0be6cd76bafe44cad29b96b7a3887	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2068	2316	iexplore.exe	31
PID 2316 wrote to memory of 2068	2316	iexplore.exe	31
PID 2316 wrote to memory of 2068	2316	iexplore.exe	31
PID 2316 wrote to memory of 2068	2316	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d744c508854e19ecb4222966d3cbe6be_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db73bf75a7b8a79d58bdfabfb4eafd2d

SHA1
8bcd82e86cddba1695e6117cb22ba59e181cdf95

SHA256
bc93e9fa54276162f2ab13e86195d0db35ac307ef7dcc3daa5dea142da5798ac

SHA512
bc70e661f615a98a0b09772d9fc94b8e09667a729b3ec670445fe16d1afaedb12bc398998d1897e596557353d013283234db59edda98c75d5440b0ad33a277b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09bdcccb8ac67cc04b67b711f27f840c

SHA1
6c4710291b2f9ff39d542d71ffa41746a5e0a9b2

SHA256
acd6bd13949ab6abe07a6979da076453cdf00ac82ebdc68cb76dde092037d7c1

SHA512
4c226960438f0c90158c28e45c87336c06c2673fc24e93d8b0f8d6e1fcbbbb16d92c31d327f9ae785a41fce37f340c42bf52f2dc865c641842e83e66c0d53e07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae2f83705011ae0f3e19437e0526b7ae

SHA1
10ff693793afac4f60e218e94842f57c84ab54a2

SHA256
0d0383d982248bbd6f27d46a9091efe9c43ffc997ed40b32f97a521d7adc7d40

SHA512
f1266e7de015e49bf558ae33b0145c413e8bdddb005f60cb0e2a836a9ce60049f06d83d9c64d60d668b4f406311c65fa13343eecc3d6b0cbb358e9897b5af798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aaea047ef1cb2a27b32ca3eb6c0ed5f

SHA1
f966137f6efaa6380d88a3e4df5aeceb5b36ce47

SHA256
6b3dc900b4f4eca6436e981d2c951239a1c77c7d14ea10160a5a8b13fbad55d3

SHA512
6c001af03b06509c1e1121c561c34fab871169c48b1e0c1da600c3b5dbcafdb79cf61a2cb2bb0bf80d47a5c07c66eb321b2637701a13ea99d9e73c8cde869e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb8b7e99f8914fba5768731a8cf72a64

SHA1
0eccb8c48b2e8204906def1e4c05a5198ee3375e

SHA256
72ce32b6a7f8ef13efbfcc8fd707d2c38dde9a007981298dc6405d1fb131f6bc

SHA512
904f9c2547d98c690c866661d6e302c75c2883298f04301d86c81eb23068d739a636e77b628a0ebf866bd054e4bafe7d76a80df31515536b2d5b1bfc7fa9d44a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ade268406a696a03af788956d5d6aa30

SHA1
6f3aa3951938c034db8e91f12b8fc1a2d13a7f31

SHA256
d0482e493fcec48b3095a9f1b2b7c7347056c388e00b6b60e48d976ef5f57e8c

SHA512
d729fedee2cb864dc895c0f7e8baa12d852087245d3fc19287fc4c351826bef36d6d9d229fca03edd0172b744668cc892cfe4f599a491ae2e55841832c279191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41a73f396625ecb0bf6ac850e4ffec82

SHA1
4aba5381169908ed1790cb9e79ca9b9d53645c49

SHA256
8a17451377e5aa23c9eb85c9ec9b8a42134f97a5f89732d8ff5b42351f04d103

SHA512
f5d78750912fd82f301b9b4a6b2286ab59535ba11a1f0ddb5864de0a4a456c88c76c94922b959d4aeaa4ef37910966078eca1ec8014839e5dbdff48f868d9906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07133d2307832cf4b1077ddf4e7fe146

SHA1
a5a5fee70d502e982d522b8cf6cf5bc94f6faf59

SHA256
13a144c4428e1da830c6e9fb2fd8f311d0f05c604022f08c74fa2a62fa59e580

SHA512
9dec67aed7603272f98b54771323979414631c24399153c0b1d78368386b95e7c50d8e7703896ac4c4b78f27c2d764556f56e4646f6586dd529006139f8d79a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6986dfd9470bec889b0fb4797e41a190

SHA1
dab65a2d864219068ca9f4153e51ce6166f54608

SHA256
249d29a90bcb74c050e494bf8083c195908f155a59e9b56ef0dbb18d643abcbe

SHA512
5915e8d94a7537360a9bb5f0293ae8abd48fa33dedd5667edffb5f16e815c129ffb8d9bc08bc2700d5e51b4f1a38e2e7d76112820f07c8eca8acbe7a5b884b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f189fe95aaa3c10fa45fc7383817383

SHA1
fbb1838b2425f9d4ea993c0d9cc50ba4594c54f8

SHA256
ef8a0edf7b11a8a0e400f8e390f6b15647a9124db30d50afb2701581c50f71c6

SHA512
b6b0a4ba13cc89ddc6a22f3d199bd0b9e15936bc66fe616bdc424e90c834827f6f7e0c12d89a8f9e1a4923af2344698ed0e403f196730c7d1eeeeba691108e93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6084a091d47382a5b532b5287683d41

SHA1
3cdf2231a6812ccd833f9a708dadafa64d5763bd

SHA256
bb78915c53e47220ba9a666b4b7e49a9a387e572f30f0f2a19ab8088619aace9

SHA512
afac024987a48608418a7231eaa11fc03edb058f6acfbd667ee8eb22e4fc32d47522cd7b4aa6194c0a89d6c4a46fc29e7ce106f7a659d4c68f86c5d4eeac5f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af84b440ef2c9b4f6af0e675e70582ec

SHA1
04627f5b8d4e5ebafc0e853a7e40efbcad1a410c

SHA256
60bd22b110ccc79138bc0afaf914b02496c563dc0306354f4dfc96767a215b10

SHA512
d7fe001d3f528fcfa214d86c1d88f6a3ce10fb1a38f20fe2183230731e3bf57eeaba0714d940b305fdf5596a90f3fa55b39189d4b2c863c6fba4863ce343134c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89172af64185159d8679a54e4514d6e0

SHA1
104304eed189394a879e08e18d27271760126287

SHA256
038e3b3ab156942437008d3faad102d952a6476ec70f4b6775e833ef8d467774

SHA512
c527135d99869f6064b62fa94f97f07c4005cb006a8ccc7f2c8b9324262bcb47ee31c50992f8759bf67de9304db5a174b7422c73f5d5c783b80667cf38b62d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7a1deb68bb14f2232eeb7db25b6d891

SHA1
cba59aabebb535dbab3af7079b985b178ec53936

SHA256
795872d7e4f1ed78951241f7bdbbda78dc95e8ebe7aba540fe83a50ba47ee1a3

SHA512
ef31e7846a785f199d1c61da58e19b15820ad02087a9a4cb5b02a211f240d12915b8149b08ca96e0761ce78b1c17bc2636c26ff9e540cb1827b0bd591297203b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4375cd5d3a540c02b044cba1ad0130ee

SHA1
33405b14a6445a6ba2d6b2ec6af60bc37da7aaee

SHA256
c20fb8a8e06eb37b3de5dcd906caee38d291d663719423334b1895872f5aef73

SHA512
9cf3a93c7a9c504a66fa4a991a92d7fe5ae9145091b488862dd5bea698b7833f78b2e63d5067dd3ad9ea818e5919880be440fb37a61485b5e38379a32148dade

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7DE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar850.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit