9fba306bb8a8faccdc813f61972cd338f1e313fcacdcef49e0306b004b6658d6

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7455d0e0c27d7620f06e3e10a69a3e3_JaffaCakes118.html
Size

38KB
MD5

d7455d0e0c27d7620f06e3e10a69a3e3
SHA1

41b42cbac4018f0e4d06a0eac8943ce044012df9
SHA256

9fba306bb8a8faccdc813f61972cd338f1e313fcacdcef49e0306b004b6658d6
SHA512

9a91ed404fe5795e79c1d095c95fcdcef30add96f5e0e40bb0d5470672c9415b3a1e746989b1874c2581a01ab70b82a2b4d1d48161ee5ac049c0b3f9beed55f9
SSDEEP

384:3Lc4SXR60ggKK+cjwd4ywZbBeJtTNQu3KY2s3ExvbGdVwiRqZMU8yAwH/vfNn:3Lc4SXR/w2dBWQHu/dBRqZMbynHfNn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF6FA2D1-6F03-11EF-9982-6A2ECC9B5790} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000273de4bb372e8e36f802c00737bcb489418964b4a24b6ca15b71e0ef5a639a70000000000e8000000002000020000000a342e319d3b2243f6991c82a5d995e5079d3f92c911f87d1c59f575c9a33839020000000611097f8358036f8eb278f8bfdd8fe8a89c42f7f2dd02c223b1c6c4bd609f697400000004282ffb2b3df09bdd1428a784725e9b2012752274092e97cdcde5bfc8d56ea0653cc54f217461f955f03d5e16859af1f7a226f984362cfc8c5d26de2f1fdb59c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432086714"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000064a4df3707de67cbc8a2446386a148cef9701621d04d6da64cd804e02dcc8ed8000000000e80000000020000200000009cd1a23c5f168c26642222ceff5937f80d156db7ada7328560d724c93d60950b90000000d64931b42ba73d96aaf8d62fad7b35f830186028afc83cdb46dfb19760cd960d3aed6913b3f70cac1a2c25566a8a49fe4560cfbe4bc57d5565131116b6e75bedee64c5ae6089e16767a6b1ea03edbe8ab520d29f221bc2fcc9a335b96871bd0d98a033604dc9fb826322fb943d6059161d6d7514f2b3cc46b44045747c768859063c0ce6f2d34dc1c7ac566e891bbb3c40000000fc46a6dde5254fdff2004963987ec886579282e069d5ee2490940025c7fefd4e15f944b1b820ac1f6f923709890cf2a40cc55887f660d3077806fdf07e864194	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ccdde51003db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2668	iexplore.exe
2668	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2940	2668	iexplore.exe	30
PID 2668 wrote to memory of 2940	2668	iexplore.exe	30
PID 2668 wrote to memory of 2940	2668	iexplore.exe	30
PID 2668 wrote to memory of 2940	2668	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d7455d0e0c27d7620f06e3e10a69a3e3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
539df9e6dd3ad6d8afaeb384b014f762

SHA1
5cfa3770299a704fb111b57db6027c7a353f00d8

SHA256
d58e0dcdaef778f46f3764aa579c6ce8009c751b87ad2eca4a7d176176058198

SHA512
a60ba3e63b94f6dba7febc7b6fcaa9a9e9e725f1e8d6c1dd80627cd0c82addf79a60c24f42310817f096f439bbb03ccf7ba6499b96647857f81ed660503975da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f55c82461f1d78058a5efb07cb1dd4fb

SHA1
ee0380532e2bce818e4889c53e1f5afc0725d670

SHA256
c8a4bbaf28cdb31ac35982de4c7f9fe124507473158b60e920819c8d60697240

SHA512
c67f23d7d1ec901ac8f8b8b16d0d72ff714e2b75ee5985717625106b2a5af43c690bf959b593b165b3612939000a13c0375dcbf486f56978e0c3e6eb4bae966a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf800fce75e498c9a000a7b9b7f45d04

SHA1
60cf90aa9a0a9ad76919a45824f46e4351793b81

SHA256
fe41a50ac0c679a97a85b9089b07ddaed542d3551c023c9ecbc465b3b3f1d68f

SHA512
e862900c474865f9a87d367fe0616b6398a9d9da6e137d40a71d315deab16871799edbfdb961570a6adad00f56196fe68d2ea498e7d1a2fad3b7fa3d863888e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b7587cf551738ac6df1dd9fae011fe6

SHA1
1c703baefc49a47703cc385d3c2ccfedbea2ae71

SHA256
b23c55941d0b4afc85cb2700450050cbedf57c8179f01ac4a6c1e47584e4ce40

SHA512
a756d179f3004dc13dbafe0dec81023d66f852e313a7023bfcf8802567c317ba4ba9c569b5488cae3d36589d5a4435818e8039ea51fab170c69c6b613f1df0dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f35a1ba7aad27cbec19e1bf49c1a607

SHA1
64fb8de293fa70fc8581b422ddb64ef5b4c8592e

SHA256
653c179e8621215bd154a8ff66e881b36c02965e5d291564d3f555cf5ad9f382

SHA512
56b99c3e47dbb0d0905e0c09de2eb122db7ef6fc1e0de2b3932f75f2b29742364fc9fe9c075a6b681d53eb0e746a5a83ef98400676cfbbf1cdbcebb599d55cc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20237714e1e3ca4cd2f911cdf0b08056

SHA1
f8dabe46dab36b1b8fd6db89c48ed3825ddbc3c3

SHA256
e04cfc6bce26e37b962f82fdd22eedbd0d8f2a9859824bfc6ecbe2f4b1024ae5

SHA512
38692bbbde5d530a014c74cd2b595181f78cceecddcbfc026226a355a4af5847a39b3e216cbf594485c043b138e5157faf1ade3b458f427a85ae2cf076352ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24ae7a09f9d225721d8c1a9ce020a7ba

SHA1
fd61af111cf3d6b0954dcfc332840e45ec32bfe6

SHA256
71f1d87f21f3baed7ac69e62bb67a58cce0ccc9f0bbb433455604a59b2f60a39

SHA512
f049e4491cbe48742f507dfbee072db477f848d139f5dfa7e090556cb2d82deaea910a7001c398b82127390fa1533b437ccf4f6ab9a92fb99c7aa310ad06c192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b20b171fbb740417d6b4e5706f29f277

SHA1
fc4c878e60402bed0631402c332bad2e002ede24

SHA256
cbebe59b4b9e68ab3174f6fc39b75b407d89fed0f9598f63b98c77ea477138b9

SHA512
eac0b59f62bb7af9e01fa5a301e1ce3663f5bc4705b4d6cc53240953491d6f115403e9eb34a32eafee351ac8d9101f8128ac70c71d446e138c45af84a32a815a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
575db9d4b121b8a93e4eb88c0854d8a2

SHA1
5393e8d4deca0532f671bce0d06a14725659f0a9

SHA256
52efd3e352e19125a4bede26250cf668d0b2656047b772c84d4d8f4e76ac8229

SHA512
bb913635510cb883a69155e490878c1e30dfb257b2a359d040b3fea0dbe82264180a606e6dcb2645e528dc7f305979f0f418742f9ff227e2747f55d46d1b8403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64e61791a3d3698c3dce97cf78ef1cfd

SHA1
8d45e7f5b5cd9baee423fe035fff7a249524de4c

SHA256
f4450783114190c7ee9e5a72cab84d0d4200845bc293e00afb684cabb694e304

SHA512
517096c2a30614f5231809d56eb2bcd1701a018a14cdad2200714024f2d6b1c96d7e104f5a3015a59dcf046eb7e44443b44f1c92508f62aadf9fb8a5fa0e53b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bbeb6241ee1280c69bb44fb8e0ec6e4

SHA1
20f0a97e383b38321f7d3158148c1fd53b07b855

SHA256
76419e72e8021c271d6f704ad3477b523b53b27fa7ccf3198e80dbc0f015bc15

SHA512
86c102580a076db3a58ee460692cfdbc967f16ffff77c7fe5834f2f04e979ce67a01425a55a3c17e2a910b0d4d48e053286f4b240cec036ade34b649e72661ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc066b39c477d0f0d1b0165df5ff336c

SHA1
263c8f9d1f07d1014d65fbc281c2e66b2a1a0cc9

SHA256
efd470c9fdbb14496e3e813903ec2c116a0b53ac87a1040de2907ada6cef10e2

SHA512
f8a6a355f6c4801eb3b95e69de709ed76bddfd74678d722949e8d40690ac1643f46f6fba2fd5a65f10445d26d7340fecab8f6527b486c4db9219b1948bd14f0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE082.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE363.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit