fc2fe70d18b77123c8d4a1cf560f5f475e4ca7b750d61a93b0103d53e8db61cb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d6a27f0a7f03b48782907892e4c06bfc_JaffaCakes118.html
Size

30KB
MD5

d6a27f0a7f03b48782907892e4c06bfc
SHA1

0456c533550aeb0c0e4dfec099564ed2907b2273
SHA256

fc2fe70d18b77123c8d4a1cf560f5f475e4ca7b750d61a93b0103d53e8db61cb
SHA512

d20d765ad1d0fbca067afbd9ae73f42a720a952257622dbb401b6fc602ba2608729d5f08db0f106d658c66c8dad71e022d2f8b280c1411820a21859867e3c30d
SSDEEP

768:wnLBIq0PwZkXEvajII0230ZBtMTR5DS7OuhV+ztkXcVkW/oeI1:wnLBIq0PwZkXEvajII040ZBtMTR5DS7F

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F67DC41-6EC3-11EF-A540-C28ADB222BBA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d19a2fd002db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000008c293a2923f0e476c4ed6537ffcca995777c33def33e4f07066b1aa88ca62021000000000e800000000200002000000084b67556cfb28461a421481a8c9f6a1744cfa5b7793ae1d4a7fd910452ebc80820000000ab71f894fda628c1ca8de367fad0797e546f7adea92dd5e259089d30bbcc9de54000000038a413e8b7dd4e685eeb426c509b63d9bc30f44714c4b0104d08f88521942240f9906e36e0dc229e97c3493d769272565b6ca2cd7bf7f2e6f1f5cf5745872303	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432058923"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000e72d2f72e3d871ff00ec16e46084791d9cb6ce852863a0c4dc9ef2e4ae066e40000000000e80000000020000200000001c2fb030ffc7fd020f1c95a18b103d3d2a576df9d407089847136099bf18d2a59000000097d5f4c3169b803a3af8e77381ed53912361418aa545ab88da01de3c0d956b7666cd8ef5601526f203667bd1ce91fe3a656b3bed4bf09c0a91ce51626645466d163f797e514a01726a3556f76904a9e5316ed93b74f30ce40b4bdbad4d285a5c2e5a628ce67b2cc1bee38eeab1eadfd8eac66ce7040cedeb9a6bf1e0784b60b35e019628ec8523bf9ec0b1fbc780c99b40000000dedd678210980ae7386de27a5ecb405af4cbc3d9bfe49da9c9210c0dcb2307feff5c087ea9ef1ac33991b0d8d9d1b1b7e321a8f40a56b3cfe2e9f2abcfb872b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2316	2380	iexplore.exe	30
PID 2380 wrote to memory of 2316	2380	iexplore.exe	30
PID 2380 wrote to memory of 2316	2380	iexplore.exe	30
PID 2380 wrote to memory of 2316	2380	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6a27f0a7f03b48782907892e4c06bfc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81595b731eabef945eb6d81493edd7e0

SHA1
d443c0230e8d93441769f9324312be507a023585

SHA256
31340cfbacb30ef8c7e826c41c2ab78e9f921bba43b5c3b5c7eb7ed17cd76e11

SHA512
e4884f43fd8fe272565b08a75c4d3ce65fed137961e1bd85df9f14f26365d198869f8550848548e828dab8cb0ef6678dc6ae4a30aaeb8517b30c657e6b3f45fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f9fdcc7039080f77e4af8bdc0d78d37

SHA1
5e4bf7b79b370ca50c5471110497511e04110177

SHA256
6313dab50f3ca02dedd35335b9ed7977b9c6a7ee8c7ec9895d7f4ae8186e590a

SHA512
d015a0091fa66af171ad679d1b70b5494e75883327d6dff458300255fa60e607abe2e4edb04c5853d27d2deec88ef522735ac24658c61d8ab863e69ee95dce94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc38804fe358abea7091cc9d0a49f9dd

SHA1
2703f6c00249fcf97c3154f82d762d98a5b4a93f

SHA256
57bc330fdf48ab0b68e4a5de0cbcbcdde2ccd39abf9c0c9f3e316c1960f8ab6f

SHA512
1f5af76823c29e34eeeca563f9aceedea640e5f56a94b35388d89d044345094da1a4ecdfda79cea3ecf410ca015911ea90a1ec29994e4ae56a6f26a7d892b5b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
140b292f32901854d17b1e7041b30b0d

SHA1
2abbb57e793849f7dae186cdbdcca6e20e6e5daa

SHA256
2d37748472edebf3b67d45228a8164ea729cac09573be1ad75a23a2bd7150a42

SHA512
22a1229bb47845b95335377cca5b65736f8cadbcb8991a61f16c699a9a46caaa115c6143f7049043170ba8725af0ca850513e403d498ca51c10a8397e62d126f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
247a5f66181fb654fc851f9c780e6790

SHA1
4af0d8e292f8660c1c7008b5a9edb44bd8ee78b7

SHA256
2a3d5d2a8ccd61fe947915c2195680f5b32625715ee91d37df3ee49f608e1c39

SHA512
6908978e4f6dedc154b6b1c244adfc2cb9cef4f1b154717ecc9477bcaddf7eb65ea7b87fa805257b4eddb6edafa2e4ed46bed8feae51900d7ffccc94e6cc0e5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
860d84b7769bc5c123c91945f2ebd35b

SHA1
64a9456ddb1673baa4b987abc9068e82b2f2b9d7

SHA256
4aebdd985189ed46f40dbea8da22e877dff1709c063ab007077667cf8bb33389

SHA512
1d0bf655acca1c0d385a864761384770e5daac2199f6f928b6e4e98bf694e11b009c1c43db544c5f005cc3c4b07615a36a33ac7413500bb85fe6c5385d01d84f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f9d96b381396ddb93db239e7c94175c

SHA1
b07b171fd4dc8852e58bcf3c89af2f3d2863d331

SHA256
3dc7c3b30c271d9a3d2839823a1652587810e1cacc75d90484ccdc2494b1974a

SHA512
debba39af820cdb20f0be7b80d7fe8d0b76b9047e715a1b41745b34c9eb4216f275fe6e6a867bd7b37bd69c9782a16d2208a4d33be8be34084ebed268949e02f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d26cecb2bf92a6a49787a84a717cbdd

SHA1
5b0d414ef76666b9ac2890f6e1e0682190f78d68

SHA256
5559a4bb7d4dbb59113077587c3c20d72dfc718bce25843525143a1082db026d

SHA512
a725d9b95225fcdd192e42e1cd9431449a898618ced177607cc62674794a7ce4964f98568d6a289ecc89b933b49dbf1b7150f86ceb9878731207aa152b974f15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b2ba5be30249ca7ae15e92b11d983f3

SHA1
b8f45e23d20948ec2dac5ce86c654c97875be45e

SHA256
94197a2f7807fe3a68d3126a289918881cbd31169f61dbc4718a9adaedcbab60

SHA512
57226fafcd1ddc756e48ec3dc57c961f5c5f6a19189538201cf0e4a0cd9c79ef6b0fb1fbdbc9eeb50b4cc0c85560854d14b7f0b1da5439c7972c382d69198461

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab66B0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6732.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit