d5dc3a43fad27214f4738be2283867d9b986195dbf012a5406104009647d60d0

Analysis

max time kernel
144s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6e51c0f0707b4e2e9c9af9fcd2f4d1b_JaffaCakes118.html
Size

28KB
MD5

d6e51c0f0707b4e2e9c9af9fcd2f4d1b
SHA1

742fb71fe489e76c26e852b30466ec0ce00ba668
SHA256

d5dc3a43fad27214f4738be2283867d9b986195dbf012a5406104009647d60d0
SHA512

23712c209c8cbf79d67886a43818a21521517495f6243750394524bb3a5d3ccb86c2cb19da0c17ad4fc4c2cfbd58c21c19bd896f160da046e21bb55d8356105c
SSDEEP

768:Zcd9QZBC7mOdMwDpC5I9nC4iTwuwvwUqPd:gQZBCCOd70IxCbwuwvwUqPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f2ca85e802db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000008eb455bc5f12e040cd8272b29ddcbf38b458e1e953b12979a9a0727f81da09a0000000000e8000000002000020000000526b739da980d002b89332f020d1e72495ec2be73b59889ce5667779c542fad32000000004f9f5a9af478f1dfab6b8a5afc19b14e08728c9080f3d174ebba632887e95fc400000003f477cebe23fc6ca021c1c98c76407203430ccc54cde2af6c25d63ccba0b6e3e5b24e3e32af10928ebdd5ac9c46e513f88915fae113ce51ff625ef95dc3b236f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000c5954bfc3aee3758930d0141614a9d6587aac689e5ce6fb688e16cbf96b8ba25000000000e8000000002000020000000a27ee65aab70c32604d31bc481baa14d0c3dd7bcf2f669752beb5599ec4d7eb390000000aa75f728c7b56c043ee39823952f9fbde5d86deee8482ed35754d7d3a385e6569ec77e36ba7ec7f672b2dc5eca9a811a8ff0552c97ef46fa6eccf3c754d73b92de55c170413fda197b91a4467c730453c496816c49048629400ffe975c2ea6b821749978ea501db242f5e2f76336ec85391c44d0716dd167fac15e4f38f6dca99bf328bbbab4ec1c2e9086e6afd0d90640000000975876d5b62ffe1161c40d2907b5d843752bb81b1e933fa93ec6b5cb4a4c29d26cd0b8a8c7c1df28454542bf22a32352475d8fa18902f91db96520ede703e13e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0134201-6EDB-11EF-8C8A-62CAC36041A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432069399"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	iexplore.exe
2652	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2636	2652	iexplore.exe	30
PID 2652 wrote to memory of 2636	2652	iexplore.exe	30
PID 2652 wrote to memory of 2636	2652	iexplore.exe	30
PID 2652 wrote to memory of 2636	2652	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6e51c0f0707b4e2e9c9af9fcd2f4d1b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f7cc4f4271d425d8497bf96abb60ec8

SHA1
1e6550e0d13f797fcbcf572b3117304e067c081a

SHA256
e0747db70918d00c595f653f926554d6e69a33232d82787af34585878a42b6a2

SHA512
b00db9d1322447a637d29f1bddda97308f97575c7f999c3afe1f83e6c07e9a6f4e7a601da006402024bd64af011b7f22cb1797971bb6bd23027307b854efd95c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63f382b4d7d785cdaadd6af766b86386

SHA1
b348446ec8cd1303711e8d6e61cd6f3bcb37b721

SHA256
869143651caddbdb64c6a59fadaea70d9aae3b8626a2ecbd5836b870415f9ee2

SHA512
bab49358f4ff6555f04f3b8d3e4c089ce9ef90f33b63b78baa98d539fb90bcc951665ec561a7e2e8c3e6118d71a9117868425dd79a650cac88b52161216b2014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d80627b7c6a0a748cc83894538026910

SHA1
ea27177c3f295e122a027fcdc611d1fb5f98ade8

SHA256
e7e8d336f26220f93aa2f8ef8da3c5c95a4deecc09efb62e27ce5911b081e2ed

SHA512
6f0e6b1b82018b28207afbb353027b9275e65b82ff948cd31fa7c79b05bba1d9bbb5c5ad3974db786f3782482357ea2301db1d3026f134ec39291e4ba94dc405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50e6d0eb121e78c0fdb3616729dc1614

SHA1
81bed19dd1228186fc1d5047c59ffb2d834b605e

SHA256
5c6402a9ed354a3310efd7abce75e109194b3c68739e4984cb989e2a5d0ce0b2

SHA512
38c8949acd1899ae2a63963daf72366575ebacc3948096e607af90798462ff6d71aa9943f48cbc518b9988a33f1397a951672ef485fba9a3384f112678419da8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cbe53ff5b1274c6e1c3052a537b5602

SHA1
3092e4fd147d3a907408c10163db42de63da3dba

SHA256
58ed698cb986eef528e30bdfe76c2c989b650deb28027f8f028f5e5465671083

SHA512
ba11c248372e80a00ed38399c6effad5f8dd719ebf2fc7067491fe088e7c06c10b3d0e69baa4a97ff6f64bd71c540e2e219aa128226319a396b140b615852b47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32764ddcbc43d4c810178346420ab056

SHA1
d8686016b9d3a16ee23e893f52b10e5eef2e1abf

SHA256
552aa73fa9944dcdf792e45c61faa64d6e3b1981fa265204e8149477ce501ddb

SHA512
f27f3b3c8f35f7b8b4fa117f3fb3197b0fdbda46f4ab23d44a1548aca865c8639f8787f4d7d78e7afddadc90f356c4c31a04ae1e4dc7927de249196b5bddaf4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f49dc700066d24d99aeee98541c4ee50

SHA1
125a67e4ee634d56730ab2d4348c865e2876d914

SHA256
4e1e6491baaabc1b02d2d6bf1e205c7de05082625d4e52b0ae33ca18558fc849

SHA512
b5ae984c1cb960a2a3b01971d107f3be5f71c370dd373b7da5563f9752fcfb1feea0c1cd338fef60a2c17809a6d02740d03a51bde8d3306ea4ce9829b85de7d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ed95b0b71aabb0c57d20c4c2df39d2c

SHA1
3c17c1050847ce9ceb2d7322cef1dab5d1f85298

SHA256
cc0d5b79cb88ef2105e5448316582c23948d198b1dab01742cd613268e616993

SHA512
ca4780c74c013db1b1d82ed80287421715627de888757fc981e0ed13dbf80f095e1370df52e5aa52e66ef207798e00f87e16cc7e164a28eb655da21813741a47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c1e944a8442702be03e01460ccf3a6b

SHA1
29c39f6a5c0f6730a1a4b1093c10f4e221f9d562

SHA256
e1b0d1dd26ac9ca283fbcf0770d01533f06033a4a2ac79a31fbaae12569a0f23

SHA512
4808ae76691d41713a3e669e40000d435905d75811dfff27b970deaf0ecb6843050fe175854b971edeb8ee575076ec8daeddb7dab11e02bc1c43c0103ed35a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca1f95b8e21243df409318c7bbc2e530

SHA1
055fabeb56ea46f68c5e4f9aa5e84d9a25c063bb

SHA256
011219cd0c828bd2ece37508f5a5aa34ed4d2d38a0091123469c449933c6ea34

SHA512
4116ff3025ddd04add276954ad4b8d63e991ff22968313b20eac9a4bac37798b364c366da94d52555c98543ba85b3a874a13d84fde8a3901e3d95ec5ef14f086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8be3f77d722ff979a25f620e08a6877

SHA1
3c6152b9a4826ea7adda4d5356b8c6f63694b724

SHA256
60c85eec7b57fe680c5cc549078d85eba3ee73b7b664fb3eecfe460f060174a6

SHA512
0ca611c5341e0f50de0fc1411b70db8b8c3390fc70caa64103c53b8523af5237f433db4c6f35f13e422f5a464f9313a53b0e7e0d13ab10a10ee331724d87a627

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4204a7672973eaaf37e66efe61c2c860

SHA1
ea13d0a79d4bc205dda335856ccc4540249f1156

SHA256
63ea872d8f3b4a0765442394e17a243cb2d21c78f601bb0f0579aed1a46c740b

SHA512
f3582d16328b46383b298e6f1fcf68d9b5621f475206e4a71baa3fbd64509344fe9de9231beb706619daab1dc1b7625af0c62e33dc2f244ec1aa7eb9113492e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D62.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D64.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit