37559b2fc3ae9bc04a64a1371061db4f116c56285b45174fb80d9418c06317c3

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d603b40a4be788f4c2b65e2d23fe66fd_JaffaCakes118.html
Size

176KB
MD5

d603b40a4be788f4c2b65e2d23fe66fd
SHA1

53afc60130ff9662692f0aec3fc9c20c8f26a70d
SHA256

37559b2fc3ae9bc04a64a1371061db4f116c56285b45174fb80d9418c06317c3
SHA512

8d8ea411c7a6dfa560e05d1ebfe6c05663538cf06b40e8699712a9eeb206c02457108b368ad9e7b71295ca740eb34285ece6df006fac5c82a982ec42b71c89ff
SSDEEP

3072:SPyfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:SasMYod+X3oI+YS1tA8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909319699802db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432034992"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000f5d067a9a755f64f5cf4e4a48294317e7a57b77f7bd7e27ac365293b0f215eae000000000e80000000020000200000007bc870cd9484cfd0744dba77ce626fcc0847f794bc97441c12ac3fb90e4c12812000000034d66bc0a8bc4d185d9cabcb903e7102a238366dd70904a3003d5bbeb1ef1582400000003e188747bb36feccf32f76babc1c72bba2483facf905059bd74ba607118b3b7e80383767f66e2c252a4b14c76ba599382d80d2fe38a818f11bb85328b792746e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000e23b61d58fd3aad01fc430bbfc1bd6076a7d9d59c1a4d378548b5250ba40daad000000000e8000000002000020000000c67f688b361881aafd4ef36a63c578e7574ee6bf86e3253a36587eac22acf61f90000000733a8169cfc83c60fbf9a3b8880052dc27ea1b7654e6bdd25f8ab9461e84e8d8983ff181c39019e12eb738aec3270c0a674b131885a541702f4d08787148ef361cb3decf3d0ab4b2fc6cf42252999201d6e6e01be3b146b892195d3342b516f603c6be9ca1bbb697412de3c6736ac43a70997b7682153a06585b94f58e68cfd201f7dd399b303fbca056253b77f79051400000008021d9ebd7a6ad95a30d1773ac09d8f097535075486c80ddda700f173eba2b1feed6456c4eeadc7b549accb867e9e87bfee4923e334a8a703158b961c9ac5765	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94869C31-6E8B-11EF-9C13-E699F793024F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
812	iexplore.exe
812	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2500	812	iexplore.exe	30
PID 812 wrote to memory of 2500	812	iexplore.exe	30
PID 812 wrote to memory of 2500	812	iexplore.exe	30
PID 812 wrote to memory of 2500	812	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d603b40a4be788f4c2b65e2d23fe66fd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:812 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1331364f009936ecabdf81a9f9781353

SHA1
ef2ab70ddba45af0793b5d34872d2f1aa6e99f70

SHA256
0b7d54c8d2b780c205ff709aebc088c434c80ad0508912f93946525a4a194d8e

SHA512
0d716be0390862ac810c4b7b90309238a3c6685986f8ccf487d47e73f78b5ec60804589113f5b5981a71cd37b5cf1b8e900f6f43f1abf0218dfb20899e6fa6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
731393a3ea7a895907d8b08c949659c1

SHA1
9cf0d87e4378b54b0f20d19f4b9b97c9286a004e

SHA256
36690905125f17e17a7897c76641e39fd839ffe7ae7278da25303718c9a6c12a

SHA512
50d4a9bc6c3e5e60801d704fdcfdda130bca02d9e25157ad0dc996d567f03476d0929305166bfe4df190d7f5321e9376ea59de7d8c5a4f30b348ee626df80fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
569967472067fd89a8cb77de6fd00e24

SHA1
5200e950924256d575a33b800a28ea08296f352f

SHA256
28a41e88e8018fe95afe72d408fbaa5b5667b34a7994a7da2ecf37ff3218cb42

SHA512
88e57816701a7c90dd4d80e39ba3ae7685e1bd13871795d5d9aba9695b8f4e43d88f1e0d0dd0965091eea69de98ad6a32e507c00eaaf338323d4c6a6e191ec42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac483b4e2c3c64f5576308309a81c7ca

SHA1
98f18c206ec9a9b238f49db74a6187e711b1d343

SHA256
3a906132e1b22a8c332dd979c365d7bec49cd637f226b01604f6c83ab29664f5

SHA512
f4855f672b72f9d7cd92cb230a99639cde49248fafb425b5f69100f69402a4f434667d577f0db66cca55fa487a449abde433f7d64290df107ac835eac7f4454a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da97d8d29c65ab42b59f6099f81fed9d

SHA1
def5ce9108348ec4a42db6258576468b2a8272fc

SHA256
604f01752c03e31d6f8c680bb706e1cddd293efaab850209aefe1649db35c53c

SHA512
27d2ce1af80f36099128b69a62205c001cf0d1d6a2ad87200da86dcbf8745bf8c58f77cd5016b707245437182d63c8e1c1599c946d7dac105313752a4127b181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a0274f12b332d687f9eadf0edc3d32f

SHA1
d9d01d42b76e1d34150b4e3021acff09bc4f4bc2

SHA256
62d62da6362ea714f4ae5166da4486f7c4c53a90452f512b4166d90cc28a8dc4

SHA512
d0c94e69d12aba34cfae62601e77e35ec2691bd6328e37b75e87682d9e5d39aa31090963a64aac02e6821e562307a7d0d0f839b786872e6b8e869d5f16c6eb42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1036428e76a4acf9359921af45b3fdb

SHA1
d1d391f833f7a8f13cf79939b2d6658a817c67a6

SHA256
c7373d6f0472edeb64017085af5f7f91160918bb89324bad058824bc09320882

SHA512
56f1ec3ebe366c546ac6770b019270f994c87c8b8779459da5bd2bb60d536ec779cb5d320a8d6d53d90b913a7c0b35d2a2f4f967937e38bc0bf4c18f5b3d1a13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e15535e236878789d53e5c274c64ebcd

SHA1
ba102659161ff2e3ede29a34d04c3244a5806223

SHA256
672f922782bf68a486d8ab0db7cfdb591ae5a1b31f26eca1fd5d60e87ca6cadd

SHA512
a76d7d0cae7fa3aff8456842f0fe6a2da789e3dfb97344752067a0c5533ae72112f3cfea8864c8c976d8e792d69b397e0f2fe6780a88c30c2f2edb8840085659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a31fa59d315a73674d21827d8a1817a

SHA1
8373b42ad0fe2dce53549882a21699e0b155e022

SHA256
f6bc5d8907a98901c44a658a3ea154be61ff7236d6864f75fb334b38c99c47b3

SHA512
9aec81bd416bdb634a47b426af21dde265078682a69cd728d8ac9f09d3597295a16aedaeab6aefd5f95895d4f3536e2b65ea07e53c41e9bacb651fa39eaee15f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1182b4ff15e0f29beea53c566ee1c86

SHA1
c69389ead9b7edc97cbcdff3072a1335fea50b8c

SHA256
643ca32e66d2a3fa16e1564b0789c609a381acf316578be1c31d204b7168c4bd

SHA512
a975f38afb987f719c5fa6a460d14526afebd39c2883958bd59ce9b636ec39e6f4e4a335b1a4c76db21168538fdf07acf250dac08b24e7292071263b9b26a9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68d3d7c46412cdfdb746a5efd929942b

SHA1
2955decf72d76c5aafc8420503b6d67f0aef0882

SHA256
7bc585f7f3a8942aa8e587666b07b8064db3ad04ad0e4f12eb45b62943b9225c

SHA512
16d55e07a1af409cad44ae2fc8ebe7b84328631db791a61818d357755161b1f8eee55ae670886beca7650538abe31f2ab2022b4cac55625435436d025a85ccdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB6B5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB744.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit