3298d65406b1cefcb519bc2d887ffdc6410fa944a7e41501609c29873d630078

Analysis

max time kernel
84s
max time network
126s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d694e5702fca8f19486b9eefdb98d393_JaffaCakes118.html
Size

44KB
MD5

d694e5702fca8f19486b9eefdb98d393
SHA1

082dc79419111691b761db9ce6671d0bdff48fb5
SHA256

3298d65406b1cefcb519bc2d887ffdc6410fa944a7e41501609c29873d630078
SHA512

1d9462e320e600d4c46239771ce7c25a8b575d98f7beeb2fff69cd18f7876fb3c615a848dd950aef46b540ca86d2efbae3934c5e8f7c768923aa00cf8674fe11
SSDEEP

768:jvoSFNgygrg5gdgCgzg3gVgF2J+QUebmz2dGZ2D928zZ/Xnh/XvZDc6:jvoSFNgygrg5gdgCgzg3gVgF2J+QUebT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000002b7ff8838ba606f33c5393b729172b83deef1be65dda1f649d5cebc858b606c5000000000e8000000002000020000000e29c32bc58cc39fe993558bf9721e464ceb06acf0d67cf30798492ac991a2a00900000009f9ab438c1d5c4171dcb331dc5075df8eb5a0911610868c2cd9e8f5dddc2c6642b2ed187b0549d0a5ad79bed0686e1a56bd67d21e3f612a00c52f2c5863548d5bea9c52058c271bfb10a4ed3520e56df17cfd59c056dd18f63f4f7f381d9a18092414c1ea072279a988c2e7808e6d0d904aa6c5f3fd30faa5c21e1630952f451aa28c5f58fb7052830cf1367782faf584000000062c1556de5953877ffcbcc21e6dfd4c45e97f9ece1d8833b5b4fd16dd7ca8872caef95f0debe9a4053c4880d5350bfdc4bf700fac8a13b740f669d4b930cd194	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432056959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d9408fcb02db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000006fccbcb396a90bd110526e13e3f7187e4f0094856ddb28c925934db327490a70000000000e8000000002000020000000222dbc21eb475e21086db4e57962aac837c2780244d69fe5a3bafafafb22dd8e20000000503d49df1887f7df5bed619121b8bc683e720f352d6f3285fa48c66b8609c8a040000000c4a3c9389c2ae0cc2b07ff9990c60cc95cc6f6ddaa5289cd6d5df66f044a3d1132738212775ab7ac60136f0cd613f208339b376a5fddfade3befcb68c2de3bc5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA7CBF91-6EBE-11EF-9DFD-D67B43388B6B} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2596	2116	iexplore.exe	29
PID 2116 wrote to memory of 2596	2116	iexplore.exe	29
PID 2116 wrote to memory of 2596	2116	iexplore.exe	29
PID 2116 wrote to memory of 2596	2116	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d694e5702fca8f19486b9eefdb98d393_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23df0ec40740c183c2c253666fdbd540

SHA1
2be282074f56f5bef0ec38e649d43a89cb821789

SHA256
7a86e1f648e7ff7316a0ab6286de935c01468c1577c3ee2160c135b11bda4f30

SHA512
70ba1de5029c20f0f2950239e9d68ba1a9ead2f2d304340ebbc79111af1d6965e904a49869b4c5c6ccd0ed18b36801701e0d765025babbbb9ccf52171b7b07d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
524b9e3077704d817077972127b85b3c

SHA1
d508343cb7a26e5293ba0d3485583e17d91f9cd7

SHA256
b94ea45e77f3c3738277d4aab15a63fad4ea3e399fbe4edd3e726e2262a830d6

SHA512
55273a83278cfad8f63b007d3313a15333b256a946cf0dedff041eedd867655353ab780b7eb2476f13f1b177675da81cac4d70e1dc4fe16793cc42a19f745d14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a9bc08a7df3b391d2153389a4a4c3ae

SHA1
89cc686814fa44ef9488a12d33f4f340028c7766

SHA256
5211e0a10a152bc29fbb9e0fbc047047e4f259737a86514f9ce0d4cd5c50bdd7

SHA512
c9e76ce66f2d06884e451c136fec7abbdb4e3ad40acb9eb2b9deb26c0a38a0c3b90b36eae285c6c7bb82b9893961dbb296739fbf8e3248a8ae0833eb777bc1b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80a3469cc7cc518bbbc1d0c9f531d71a

SHA1
b41d3038c3c3b1f1321b3e28d601db5770809821

SHA256
268098bee27237bb30ec93546dbdbf337b01ec94aa27d5608b25499b72b230d2

SHA512
973f17b5a74e54f47625b0478ff0bd97f7db8bce81b9d136ac3e1e93e7437b17c53411968d8d706acf3d05d2c175794757561ae89116c8befc36b7495a089adb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cebcaf6d7f98b0c01a193fa926fd7db

SHA1
24aadfa2b3983c4cb3a01d1a8a75d50eb8eb246a

SHA256
79e31087249a650a8ad3471b978d6696d47e134a4741f04115ec5bb9d92b8eca

SHA512
d92f54515f936b4587be0fd445ee55d9663c6f1e5c2ebd073e688c4a1793024a2d53619008c45a4b3176a417f909eda38735326912e5b25f486503781f91787a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5f9e61ea47a18a35afcbe70120fc0e9

SHA1
d539eed65900bf29c14bf25023bc473ffa2ac77a

SHA256
ee5cdc914ae48a36e0db199a30ab25e0d92b56cae88085b37d24ac61e61e6634

SHA512
f4e67e3b3a6986b134b11552554ade77483a5b000326960f2508fb8658ad8836310d9e0a752e19146659c338ab62141d70c6d6098da1d4017ede6db573045cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1B7F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F78.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit