d102deb45f9f1027d0cef5b15d1b559a3cac98cea8fa2b77230d563004dc2eb8

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d638f9246ab0d923dbd752270b566e20_JaffaCakes118.html
Size

58KB
MD5

d638f9246ab0d923dbd752270b566e20
SHA1

1eb78012b2596ea82d8a326a1c02e2dbfb86116e
SHA256

d102deb45f9f1027d0cef5b15d1b559a3cac98cea8fa2b77230d563004dc2eb8
SHA512

b98a1701c90ea81e10790a2953152833881c967bad3ef1574dbe526268aea296eb6512cc75af9f302cbec692805b715e0816cf6d56e4c5b174f57e8c7ae7979a
SSDEEP

1536:gQZBCCOdB0IxCW7sDfVfQfufHfSfbf5fEfxf/fffHfmfpfTfof4fJfLfEfofPfIB:gk2j0Ix8t42fKzRcpXnfuhrQQRTcQ3gB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000abf5e9834f05c72a524c6fa9b0e0cdd65ed3e3c812f55e36a3ebd37622d85350000000000e80000000020000200000002c6f31ba317dd7a3fe4a6d1ad0701009c7ac0bba5dcec1cb35fc739138689a2c90000000fabb4bd09858f2c8b56707915df273c0ab11284694593650e859dd88e4ea413ae35b00ae05cd349c3a82bb49c3ff698249368fbbf4501529cf8a4d6aa402d58e0e05918b05c62c8535a78fc90a77fa65bdddd708f99027e9611d594c85a4e55a3c25dc65ed183f153a5c252366b00de971cf7bb792fad1794b7cf8af4d6f48099afc07bdb835d0f4db9e3aab839365154000000070f42891cfc2c24d3c0946f790acdff8f01b0f41c94a07f34b8896fbee464229501d3142163c908d55f143ee244c4ce6bfbcef394617cc45dd334a96b20cdf60	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000009f07b9a4c16f102bed43bade4d8ae140d27d48821cf37651b58562a60fef1d78000000000e800000000200002000000074cb41fbd9b4dfeceb0cb38ba6c61a11c88aac9870bd211bff80556e7b6358bb20000000b7390376a6cf7bc05b9edfc2a124a046a00b098df7f9c5569ae8c1449fc9d38340000000352177890dec9a1dd3e10efb92dacc1d86ec06bc7bcbc2ed97966f83be5167552416b412b91286c01f8365f75027630678eebd4a6b36078ed51823185eee9580	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16262221-6E9F-11EF-BC08-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432043371"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c9d909ac02db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1520	iexplore.exe
1520	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2308	1520	iexplore.exe	30
PID 1520 wrote to memory of 2308	1520	iexplore.exe	30
PID 1520 wrote to memory of 2308	1520	iexplore.exe	30
PID 1520 wrote to memory of 2308	1520	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d638f9246ab0d923dbd752270b566e20_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
539c289048efc48d8587220dc3846347

SHA1
4bad8b200bd74b09b463b1926fe7c8e548287280

SHA256
eb04196245149b36020090494255c4b1bc642c823c2396690b774a3c3d75cd58

SHA512
030cdd86e78adcd0fab0e1caaa8698b22f3be5e838f34c940d422c01924864fda7fa286e70c2b9dd83b6957509402fbad5a301c5bf2843b9a63763ff8978b3c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26bbb6cd9efc814c6a3a454efb81f599

SHA1
63262be9ea317555700df09710f0c1912efb2b7a

SHA256
9096cd3302da5eef989eb2b8aa46c80bd953e3ea531492b9e827ff3f4b0cfd48

SHA512
4af6ca1ecfe0bf9dac26be47a42af5e38ab93bbc8e2d0247403cc5e0292abaefccd75f179dec245aa033bc5f0ea19b167bff71c6c707d3c6c9a0d819b7f46081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8f05f7266252161f3e190d30006ecb9

SHA1
f66a41c9bd481d0f37f80aa22ae078db2036ffdf

SHA256
2203d45d57b3a65d34deaaaf690a2801b7a207f944927e0189c571dbac00ccd3

SHA512
c32d3446a5f53c2833834b6173ab5766c585d531f82133a24eb48761cf26241503eaab3667554fd22d96fe1d1c142c6eff4b584fa29dd5c06fedc69e44774022

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
746f15de379e3700092c47eb7cc29f6a

SHA1
ffae35c7a951a61e5931246d76ec0d8e05cd68c8

SHA256
30b220b91636ea1b25e127f1556be38ce0c83b16fd78a5105927147fbbe23689

SHA512
19a8e7915bd60b0578a4ef3ff3b0c53f53be43ad313a5a8267ab45b2c5b6e3e6fecf2b975a4bcd8390efd7d98a7f88b461eff699ed3a56915302b7d747efd7f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d6703367cbd026dad138203b9c1689f

SHA1
b9857fa5eb068c88be69b84b6c80d080ed09a304

SHA256
ced9d470da0938c630dfd1fa639b6411400bcda7062c41a8d6d73a789e155a14

SHA512
c1fc80d751e3bb9b42838c6d03a36a3954f0318fa4a8e394a9b7a2b2ee0429ac50075b72ee97d6c3157772bd2dd96273f53008510d722ce84804727eabd691b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f1102b66b502621d74268ae94084fdf

SHA1
7a70e102d3abce6ade4f955bf1fd7ba690a3edc2

SHA256
ce3b0dc957e1032026f2200baa7ac04455eb68f9e49a15936ce390a408cc1272

SHA512
4937ec2b30c396401226608f76798777b2ee27e3325450b300bb1bf9baaf06dd89e757928746d09d2a4d6785e85019ec873bb3f85e4887237275b952a8b5f69e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4632fa1453f925fa63a3ed31745d347e

SHA1
492ddb74320398ada59758be7b638f16612b7ebe

SHA256
7951d511da1d0d598757d4810d28c7e900c469c3c3f3b445ac034813d26955fc

SHA512
0cabbc8f75b575db3a5a923ebeadda227dcf78872c98729b3b4b8991bf31c243a7251e0091becd7178e78236916433dc5a7e4a6c325700f8a068875869a61236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52a271986b269b230078c0a374abbdb2

SHA1
864d5e9bf53b7c9c839b9cb7252345fe12c6553e

SHA256
f19fc72c924d14fd028a1e9e034503c1c414ba9f8ee3c23d9ddcaf2d3c18487f

SHA512
87b5d6de698648d28bf0863f6b887faabcebf17f0106441f83fd513f29df75b8dd1f6b36962136d01ff6e6694b289d317541d8533d98dfcc3103f83c57fd2bf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ca6592735d75d6cb5a7eba89b0914cb

SHA1
a51f641d76c9cc06c8ebbd44465fcc496d9169e3

SHA256
48fa529dc72cab825742a31dbadb5fd0de8f9d632f7a2db84689fb238b79c278

SHA512
5dc1cacc64411ee0d3053914246aa750fc81e242204ef5b33fc9370092b1258a9d39b27d2baad9c15ca66aebb586d7681fc16e2e71d29c051702dc0276b76dbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
926fbde2bbb307462732210eacc46d3d

SHA1
dab949efd557602d302cf8b77b4bd12c98738083

SHA256
b131c65d5f38a463d44e854c06387b09b3ac5bb9620d97d6a0c02965e92e2c1c

SHA512
4f54e1c2bd2034178d9a4c366cfa2138613602af32fb8703e08f70f6cd81cada6666ca39e8853cc122725016148e6efb67b7c0cda20d6d1bce2c42e1dc30ed87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc9758563c9e208b7c0a6bea478c3fea

SHA1
5152a059ae04f2818f37e51580737c09a917d7ce

SHA256
72bcd28ad676038c4c2b5c4a79ac424928278b7a0c9e2ecc6eddd9aec02ca48f

SHA512
02e023874a92dca34634cb3cf58133768e9e312ad5c67e407443f0379539e29caf67f352b6a76932c02f35428fd6893a1024fd9c646005ab14bac72217b87e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9ACB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9ACC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit