56be122e77c2f6cf15dd5d0a9d65bb054a3aee0c48fbf40089bcf155c278aa07

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 06:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d5d20957bcbe480f927f613ddc967108_JaffaCakes118.html
Size

34KB
MD5

d5d20957bcbe480f927f613ddc967108
SHA1

cfc78540b264cf3d75b8720bc3302fb1bd5cc084
SHA256

56be122e77c2f6cf15dd5d0a9d65bb054a3aee0c48fbf40089bcf155c278aa07
SHA512

cc7617543d7e6a9042b926347d92fc3dab1229ce1638ecafabc17944f11e43efc72464219f7b1d6e8d836b5e8356de1d61dced966cfe8002d0a9921db8d675e6
SSDEEP

768:g7EpFwSXe6eDewe7eIeygjI10CJC3CNChCICrC/CvCPJExBq0Z24HLx8lFlFn:gwpFwSuDqtClpjIyEWmyP84yiJ4q0Z2z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432026738"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000009a0f815f112f3177e82b2a4b5ec6b066aaafbff17494d1415f1f4761d7309cb8000000000e8000000002000020000000f82f909bcda2ee53a1c93428340bf6f24a0f0e5b474f59ea5ef8058988d1008c20000000edaa277d63920d14c868f116dbdbe1c7186c78ab5043e04278143841c486d68940000000f29828edda8d918fcfd75762e707ee9c2fb9ecf1efbadd060ce9d802ab508eca0a392ba7d9e2d4bea2e3109db41e4fdea8da9c4d834fd2814b9100c2a91778c0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00c89328502db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000035dbf0e3af95b22248077c3acf4560351e9afc31a4d735b16dd9dd36990429d3000000000e80000000020000200000007540796ea86ddc3b9eb978e510e330887103e6277a74e034bbfc7d2298ea9e25900000009dcbaf55b8c6a8454700b2d8ff3c88c31f93d94baf77e41672b4afe88264887576967071ee87dd726e5324da690fc541e589d0059893c23fd32da90a78c8b8e3249a7cee63b35e9471ad4f79c739e0dc51c12d5a297b10bce6d146153401b6f7c6bacf57b195121a5872e2d655ea7b21fa5b160e71502c5e44b13331d069429e21050cc940ee50c51ae2040cfd87c79f400000003f6db429eeab1855b44c3e770b9accc8259a9b372ad48550209382004ae66b824cd457dfc25921e4bb96b7e34e2acc4dd848a360bcd86287e463ddbb4473c3c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D59BDE1-6E78-11EF-83AF-F2DF7204BD4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2824	2432	iexplore.exe	31
PID 2432 wrote to memory of 2824	2432	iexplore.exe	31
PID 2432 wrote to memory of 2824	2432	iexplore.exe	31
PID 2432 wrote to memory of 2824	2432	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d5d20957bcbe480f927f613ddc967108_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db3e9519fed267663a248123a87b54e6

SHA1
efbca0ab98fd4003d12a42995fad12f87bf1af63

SHA256
a3443b919f99bf8eb26eea1b34d90aea92af3c497bb9e3facacb54aa599c1941

SHA512
9efffb586f1c9cf7c1428b412f22414eb0c2b82ccb42264c892d34c84745c5f9dec2facd8caf5bc676d232c2fe63ca593981c78871c64cabcc1ca3b78ee46b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2755f8aa386e1c7b495a3768643d6805

SHA1
23c7c8577de1e5507ad4941b9c01414b1cfebd9c

SHA256
2364fc7d298db029b42954e68df2c6c374620f6bde04946e57c6db5e2b73b8b7

SHA512
199b1ce8faa055634b07c8eee4f06ec3bf97f62249adbf8742835080fd723f1764c031d6be27c0c43c0c7e4aa282eb0a1535d36b2483544fdf9933828813aa83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5e3a2ed067610aad6ee443f40d523bb

SHA1
95858c09da02acfce277fd9ad3a13f95b431a120

SHA256
3ff71208c60ac2483b14ee76df1a42bed7e51f1c083101cb6aa0da1aa438bb17

SHA512
f2e8de1e5c13cc333ece06a09bec342c8271b2a0cae2d15b379df7d07a5027e51bd176d1c0e29b6e1d630fdef3f63181c1a1f07a91e84aca4b37f3d98228148c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ff19261426a8480798ee84d6f8edefe

SHA1
b6d4817ccebb09269f2de83f9aaf19fbd2f595e6

SHA256
1c46855fc0d36dc547695a3e3b7b02c37e600ac9480c72371197ddb4c73b1e4a

SHA512
d07619a305b5e8791a75d6deb44be3a503ec0723cc6f698447b4f27c0725313fd3c796ec875c6ffaa49d88024d9c42d520e22f0876ccf54d84910ec16c66a246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a5a81bf772fa54372f6c15ed2f8c315

SHA1
f528738912dd47072eab17583e90fe3b4a8b8fa9

SHA256
ec869cf49e320e138b36a167d3922641824c5068f970de2a8c7f8a3c267f2af0

SHA512
1f02597972b65ffaba4e833116a0c30744143404c4bcadbc54dce9588a2100e1ba53073fbf292fc351edeee7efafd078c37019bea928bdc50d594a8b223113e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cf30cc2b10981cd65f79104109a246c

SHA1
67fc0c5d14f6adc56bd798c051286b9b97cb90fd

SHA256
cfc27cc7795ec10fac7ca23a68bfce1aef0a3ee9e3a1ab0c3e55b99c197509a5

SHA512
7fe2cdd603f1c02dbd22c9cd190f1aca1bd52296a32e018aa71aeee041d072ed6d3a996e00d9fe825fde39491fb5d104e895d9f199bd497ce5b6d3b54f14bac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c30d592ba969e0750b8f923daf4b1ea

SHA1
ee1a2bdba2fe6e0649ccea4628ae8c575db53864

SHA256
cd3c3184fffc5b47e51045c98ed6b18ad1a7803f7fbd6bd1c413e1964f81a3ff

SHA512
402c69b3b88b346c00c560eef1846a729e443584c383042e321ecb85dd3a678477a0d23f17cb115fbd06e1f6f649a90f911b139a189fd16f5eec81c0a1d6ae8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ee8614c81d80d11fa20afb931b5c10a

SHA1
cb103e8e2a22f6ba8e482c1d2b8c826dca9a228f

SHA256
05b133ca0099afeb7426069f74471d3d8acbfa0306cb57cb4181b7fc8138679f

SHA512
603cff948fbe0331114c495447ee54f13158903d972fe840cec0d094b07f51fcc2f5f130699875853d9eb69817055a631352ea2cb474ca9006e4f183dcf04e8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c0d9724255eecac1f964b43ccceccd5

SHA1
46b79077ec8d66b8619e98f2a86393c0a7103bfb

SHA256
1e6dd91368e9d9baae89706ed3cb90feb3b6b76b5b4af0b82a834f99a3feeef0

SHA512
200271906da5de1b56acc997dada22b19b6ac8bebec3af1e2e5b86b61fb2addb1db579ec8323387e000f257030d714e981f965c550c465e08734c4875cf052dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a2e28eafff2ea821659b44967e5a366

SHA1
5cf788340a4672907ee3c3dfade20ffab7330fd2

SHA256
d03542a88970a12efc1ce579e954cec928c9d1d2e2c8180576a43bc1e9a3ed85

SHA512
f86ca803b74e0a89bf7557fff64c7322f71e322b5cdb0ba82b536e0899e53df80d3a6851e7d4f20f9411cbd2694f121e925c1b712c7e50ee2571aab1bc24ed05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b43071bf664f249caebb4e841f70f804

SHA1
b08dcfac84b63448ebc97532648befecc35ae2fb

SHA256
15c7741e19042962c49ae1fce8836a1ea7f2f473f4032b95f380565928c30cee

SHA512
9e21e3c94eb2453b3da8dd8bfb6e553a739d662552e5c328149fe28e4481537953f5c6a00fc5c9384a13203e3f4baaf9253c1fbe1a4b5abef82e0b590b148ac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4263f0f614da106bc373d3174edd356d

SHA1
02981138a27c78a7f27e3327d13844cb37e3b55a

SHA256
e93a1f7e2e971f1948344ba913e725ef616d97078c435042b0ca33f65f869fe0

SHA512
ab0bc34373b96d01df48bbe606a0c345e354d652d7e19d69b42bf7229a18f22925221a349de4a97ee2f83c16a335b8c43cc9760c8fd9ad6c8c4719bbfd87d873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
095af400c19a25e2393eb1ecf0112548

SHA1
f4b636c759568ac47aa2e6ed426a858a4bd20b27

SHA256
53aa93743cc55173595863959655b1acead183f643dc1c52921e9e389a61f654

SHA512
dbc8083ba6016989bba09d7973a040612ba42b38667f8ed7f6181b885ae5dce1b97d22e74f0004b31a9b97b44dab975924a97297b828a18292cf63062d45672a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77321b465ca6e4551443125c8d67ef1d

SHA1
40b07f6de496a7c4818158a8b974756240b02ecd

SHA256
931668c548acce7c7b74ac2c67e992917beef19610b5357af8761c59c5d7d30a

SHA512
ce6f3209bb35dc11f3a8edebe6ccb553c22315faadc4e7784c56668ff8dc3fed43f63faf5065ab29c1e3a27c8292cfdc1f62515e42e64dc955704260be879942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d3b913689f38e5b21ee150f2ba09a77

SHA1
ea29cf99f596290d18061ff1474b297d03b927e6

SHA256
ef116d16d34a9554628d9ef7199d9e11e36355119f698eadeee2a8228500fe14

SHA512
7014ca9cbc0def53a40959688589bc80731402c339809664241e28c8d2a9043b754e858b0581d2793ad8de7a2b8fee657b47a7510440418992c071b7adc017b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab495.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar496.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit