76711700f95b206e792693b9a24e27df9421540c5b8c1ec962efebe2c0d6b91d

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d67bed0064be4b6f9774c3faa57f8b49_JaffaCakes118.html
Size

28KB
MD5

d67bed0064be4b6f9774c3faa57f8b49
SHA1

59a0cc6bd59d76d6f9ce8184072ce5b187a183fa
SHA256

76711700f95b206e792693b9a24e27df9421540c5b8c1ec962efebe2c0d6b91d
SHA512

72719e013a8135347359ea1e492c619296bdce4bf49c17aa59c67d81a3e206977b2e68901b9f5d961fc98bd52717afa141bd1b6ec8d15e0e3fcc9c093cd70e3f
SSDEEP

384:nwPNxKo3CxCHMsV1oHHXfPWdo2auuBs8nzGIeU1ddaX32iXj3ln29hdllAf4yoLe:ngT3zyHHvPWdoRuss8nzGF6dYx5n29ho

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a610a3c202db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3BB9851-6EB5-11EF-8EB4-4E0B11BE40FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000057e09a970c4871b186bfd7917aa8054946393445bf784bcfabe7ebb03584a3ba000000000e8000000002000020000000092c62dd012387e12049e37383a0880106274e658a56ca7d02b29498f5d7a62b2000000064b109631a548845bfe380c27267d9108b3d2a2ff0c177a7a868b8ce2045e11f40000000e39f0c41a7f6ab9fe8a86fb3c453965ff6d80d1ebc69ea3287e672f25b93ce4f173b6399c11ad02f6e1f4818b2fffe9804701db3d7a2ada3d39eaf8cf717f03f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000000eb087b7f3c53f84f580bf8628dd9bf85038e0b40bbb9df81e344c93b861c694000000000e8000000002000020000000341824a60c243b3ddf2e476781a722f71f861a26d8d14bc8794a570c951ab811900000000e838d32f3e18383653f0b80a8141490e9eab7ad144e545b4178ea55e379faf885249a7a74fb56647b6067a98203b074b2c7e3414cbf0cb5f640a2d7bcf24a6326fadef3b6faa5bdc45d76e3542ab75670761f4be0eff3c2d62a5cff5e07bfee25145b6dcc655d075456a17ddf3b79a2928a5e95bfa5183a6719e0b42afb06d0d22b75160d548500d7834613b1c29b6a40000000a5c24512a16d1a81cc0759827d78cadfa14cfff58b1c2ea69782b60c39793aafac51e560ea7081b72f0ae6ffc6a7a8f8655ce40a41755dd5baad079a582e4be8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432053111"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2484	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2484	iexplore.exe
2484	iexplore.exe
1828	IEXPLORE.EXE
1828	IEXPLORE.EXE
1828	IEXPLORE.EXE
1828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1828	2484	iexplore.exe	30
PID 2484 wrote to memory of 1828	2484	iexplore.exe	30
PID 2484 wrote to memory of 1828	2484	iexplore.exe	30
PID 2484 wrote to memory of 1828	2484	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d67bed0064be4b6f9774c3faa57f8b49_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a6eaf13fa95e29809b4b596b6247f67

SHA1
1040bdbfaff938d7f1477fd1b20c8ffee5faefb3

SHA256
850859b08a67ae8e27158bf0885c2cf750e70ee532415e10781de9bf9c1211c4

SHA512
690793fdfa057444adbaaf1e3dcfe147b4c0adc978a532cabcdeb7d134e31c2bc44726f7ec4b4a47fdfbd72bbb8258eaa65ae774637a7b6f0be7982c531bc2c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48c5201d70b660dd5c6db07c8d8c2b00

SHA1
65ae0e103965cdf79669080ac3a212d9f462d481

SHA256
fc7be9df186afcfadd40d367f2d484bc69a91188489f9dd5562c7610546038d5

SHA512
a8384915f1d77c84617b822d9d33640a60c7a03fefc14ac4ecf0189a09498803933cd5241322714cda64b611d044ad61ae34e3baac5aec45937a3a59a25ecb67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eebe2a5238a8d0b3afae99b2fba16523

SHA1
22d09732aecfe81eb99bfed398765763d06948d4

SHA256
f4ffae7e640010839546226920ec9ce90a91e83f86b3b494af388095ce020d56

SHA512
3d807714330e561f844e8dc0ad9e95ae11541ee175ece783b9a6cc3ab38093a7ac3abd571d69c3235139c1b383366d1fe9b84145617fb1919ed764eb03aea0a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fa028515de0a4c5110dd2d04f4ed782

SHA1
9b4f72531b0894a37e4d22d2bc9912128f635614

SHA256
f28da12952510e483784c9a4681b664eb219aff98cf6bf835ac6c7de777a780f

SHA512
68793235c396b560442eed1a8efdc4fe03781afbec0d3f751dd47f6802f984688d3b313402e776ac0038fcbe1712a8b5191c00c4ec17f1a5cc1bbb540db22dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ac306198c75c6da3644abe9dc1859c9

SHA1
4984d79344b80b631224a1f35ba3637b4955f787

SHA256
119c287f3e5e075dcddc3aef398aed6ba97ffe3ee4eb5d577c7c852327075d5a

SHA512
406399830783535cfbec0d85f926624d1fbfbdd02af7a6e1d55384f1bb15a05bf07f42fa50a73a8845b4f21cd572fa7ebd4ac67ea8ca7f8016d8b3a2d3e1b2d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
229781ffc5beb9e150f4e7a71b31eac3

SHA1
5e856985aa5b347d72769755c61f426e90ddedf6

SHA256
64669da710145a1ad353815c65900e3cfb49628bde4e97ae8765b3494564de52

SHA512
5f69031b07c80af6bd036e046387d83a310b288de2d18eec70ef4ab68b3d063883c0b5f0516beff49d2509d39a4f8b3bc533eb97d743c8461ffbad881004b4e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74b9b0e1dbcf192bd1548aec84b6f424

SHA1
7f88f0fdcceb7fca65a5c01966c406adcd29103f

SHA256
f06eca1a39e2d0d9e267a7ef3e1c06dde622c76cf2904c309da2c30e03567f67

SHA512
01adddad961e25fec41b668100c56bc301aa6b0e2f6521d68ac9832418f897b1bc20695bf64dcd4c9060594f564974a7adf76d8639abeb4f3a32ef5a777c48fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2548172fc37a02737387c8b3b5d056b2

SHA1
252f2652e8845257e6dfd1634fd0b37383a63efe

SHA256
c8c0dbc2345e988b90c7cb9abb2c1c6d0595b3deb23a08650b5dff73698570b2

SHA512
1efb094d844e88656fc03f22c6297227386a5060db18558a7d686c1216b9653389fddcf20781f38ce3ca9653403a2f5bd05f2a5671d9c70e37d152276a14ce2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6557451e3d53586ae2d3f05ec036c61

SHA1
6646c2a435da4bb80418735afd3fc97f347fb2bd

SHA256
c4ee87332a5224258b9768457116c5f33397fe1c6bebdd5596aaef9eca86d004

SHA512
a10ffc6747cbdfe4a1330147f85ef581fe86bc02b8b6402401146eacbc638fd1e51ce95e7918168410a171e8aa7ae0943a3f5ea99be66dc4e8554fd30470acc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
432566ff88556a8647279924e40745e6

SHA1
b50adf0392389cae22da712420c2cd64b71fe8de

SHA256
0e33aa55d05f3f47a179626428a4c27381e3ee9c6604cad56282cbb5cbff8597

SHA512
c8492270945c90b409ff9e8502115a8fef937f1ebc256fc52e993e03d4cf43d930258e2954aabb8e39c2b3eb44f80348075d9ac8294cc45e89077722b1685659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f63c3f62e4fd5eb3b5d04e4547072a0

SHA1
110fa3a0a38378be1a9aa0c98f7bc8c704900146

SHA256
4364a396c968a47693ad707c40c84509248df53a560ccf5025d29fc5b951d509

SHA512
af658623d25f5ddcec90b01f07f4263853c7793497aa55441350df135b5e6f2e23966f3f503a1fbea19a46098b888573e21246744315fa06f10957424d5d08e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
713806647eab671ae86147ab626000c2

SHA1
1e134030f7f5f5beaf81017dcb47ddb0911f3c26

SHA256
f8448c7975e823f90bd59b8b5b263507b0c160693ddc6ea217fca4093abe9e36

SHA512
ce6ac1ab2d4d11d962c1b86c3eaf09e701e5a4ae0d5eeec3e24505248a9bdae0837f4605578e63cf860220bda1df2a21dca0bb969a6dcd1561730fb1596b227d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d259d61aedba14ed332e28cb181be3f

SHA1
57848c1594091c2473166d6acd4a682df0679dfb

SHA256
955dc361ce91905816c772287f40f972360506d2a23c0cc524d035f4cf1143e0

SHA512
e229995a9cb5a2dfcd7f5f28b88e160b540f3b220377a35bbcad029b763003a93900bdd30ac3753a8ed4b14ae3981dea18157578e848229441722132661f4489

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F06.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F19.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit