b35ef3f1c03bd5caa23143d68a3c268a36c7ca5157a2e654b9b16be5d18cc074

Analysis

max time kernel
137s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6fd39681c5a768864ab38ec15976bf8_JaffaCakes118.html
Size

67KB
MD5

d6fd39681c5a768864ab38ec15976bf8
SHA1

a4f579b5d0d868a535806d304a037a50d444d377
SHA256

b35ef3f1c03bd5caa23143d68a3c268a36c7ca5157a2e654b9b16be5d18cc074
SHA512

b23d27de43e2621b8cab098b695dcae4362701dcd46833c882b929366ca351a77fe2ce478d7ab52daa92a953596d63a873bc98bb325bab885f8af665268cf11d
SSDEEP

768:Ji/gcMiR3sI2PDDnX0g6sh6EdH2oTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVGo:Jd/BHTzNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000016963937e488d708b8e264684362d4bdd4df43b7fbd8e1fe4ab1da4f36779726000000000e800000000200002000000067e68c284e406f5c3e8ff93ba75d23042494e92b9fbd33b1f39db1393be4ee05200000009234986f206cd6cdf42e4d4e28351fda039534e05737a6a662bfd01e2546bade400000007ab87e42358f69d454e6aad92ddc1413122fd172772e954c9084f0354a3ef492d5fa8c50e99348a7bd69ef4b332a931fa19a57613628c84991a18d33c71ac262	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A34946B1-6EE4-11EF-8AE4-465533733A50} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000006386a20710029cc396500cce207610653d02900a09839a20cf5aa6c83382561f000000000e8000000002000020000000fd2db552876161234f1aefd146d13fc7d5d21b441b9224b640fe3d21b214513c9000000076f65c7a68d360e5c51de89f5ac08fa07f126c05436281b4f32f88378ce953f9bd7501e09a9fbac198bd0b3f31ce6b059ba1dd8138cca10e02eb9c6d573503035c4c0f02a0a3893f5b449fee22ed234339a15e4a701f0ad9bbb38b1d93acd239b5164487aafaf135b98c0471de80c1b14c6cab294fa430de63fa5c1f17a61c3271b947ca488d029fba2b884266984d8b400000004ed577de4c37a668b0371c39f12b2f168003a14c37756f64ce22345bfd8a5418c9a8885653b9fffdcdd9f1f0119117bbcc613a1ac3a9d078aeadf0faefc5d8e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d043327af102db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432073266"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
768	iexplore.exe
768	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 3064	768	iexplore.exe	30
PID 768 wrote to memory of 3064	768	iexplore.exe	30
PID 768 wrote to memory of 3064	768	iexplore.exe	30
PID 768 wrote to memory of 3064	768	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6fd39681c5a768864ab38ec15976bf8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21d17a2be4f2bedcb94b9c9767598aeb

SHA1
d0caec12b571a56c8ef33789ddd7755be6df8fec

SHA256
89e1a276e1e122bbc60fb41da54e21c1e4ad75bc380e3d9a55b17cd0757e5301

SHA512
eb75b32b81f18735cbe1f187f29f1d066975b3b415629318a49c6f8e9a1cad1239615e95d7d0cf3d2849c6e7af8c1dfc370248e6a46427e916cf53ab94b16f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
990ec6f45a324bd8de148bb4900e0de8

SHA1
0223fef34381d309809f20095e0b34ebb080aa5b

SHA256
3a827f141f668a29204b26f0d7c8d27260b9877beb87f0eef58aa2b43fa09ebd

SHA512
ff22f4495e70754d9175f731a3a67ff63895c1cb8093708cefe0d35cd5f30fc63c84fa488881758cf9d4792beb25fb99ce8f28e1f688e4d39b842f7d4f31a04c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62f240849344795df0bc44cae316f686

SHA1
d6ffda3c58b8f5e3559664f02057608889cd8691

SHA256
61c8ab1eb192b039c53fe3a06494aa5b47f4c12614aa257f513b652d01b430ac

SHA512
ca5cc284d068cd4640ceec11deba4ebff3d82605ee4f0f8a91fdc27b097db76b708f7147447f158bfd646060020a02e02d8172c27ae42960ffca4ee491d7f8fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c47beb163886a81f7bbbe466eacac46

SHA1
0cf517aad231ff1cb75523436972906fafbeb0bb

SHA256
7f5e9c7387fb121b1e7473f641a73dd0511ac2433b8d6c2b7fd77454f78bbcb1

SHA512
7a90a9f0980c6b171c64a547be62e7f99688439c1c2a71adb9d391db1b22373c0b261eb76f689bc668a9bbbc85630582af09d04f376eaf5c6e24103bb7547de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8958f3fd777578bb52d0bfdb7ca03b36

SHA1
a95e46abc540a6b57cb9aa845222e144c1bf919f

SHA256
a6aeb37ad6ecff90e2f81de78786e168cbd661ffe64122808985527894dd7f00

SHA512
8cabd4cc889ca0a15f4b81abe58e1101dafbac890bc31ea27b032caa94888ed6220d965d8f3fbd281ef209e70773d30085adc658f7e468898ba285f3ddc1f5a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
129f0bcdd40a4c1fb52b5d99abbf0870

SHA1
7a919959118919f26df53fc67f118751ac61da51

SHA256
e3189119f81cb4a86d210711057972bbf69b71946b01993d817c6ed1b2730e84

SHA512
9eee567dfcd2174eb5bd08242813e4729d95b28adae72e8c28b95cd1bc513e261cb0b36076c8393ac6a34492ae6e124b642b0f3c40208ed33dbee09f6ccb6f49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a965f672503bf5a658686a24d6b435e7

SHA1
2a6838510342b4fd18f7354b150d66d7ee07ba0a

SHA256
71486d7a4d38e7a60512f4543192e550bb79cb3931293d760c9279926a358efd

SHA512
6b8b98fd7c47bb72fc42428ef436ca148d5ea689e2065be4f1b79c035cef0a45b27cdc7905e2d68a46faa88117dfd9b4f42e4240310c57e733858d21cb420943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ac30d8eb6fcee55fdf3fbb93db38075

SHA1
d6b09c2b806325eb334a629ce543ccd08bcdde11

SHA256
85ebcde93e1b2ca75fd479dcd8f2ce398517dfc440f64dee755d7b87d5697517

SHA512
29c64b9687e4d11a45f26029cc6c21de0f8f9a8fb2de906f24ed155ba8482be86a3fcde9a28e2236fe7415b7335bc339e141ded15080ed53a89a2df391b47ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a5731787cfe06a56c65dc403613fa2f

SHA1
af31aa7ba3c52fd0248e6df8b97b2e660cb258d5

SHA256
5451f7e89929ce7f16a3c855aec2900eab0e6bf98d27ba3ac92c2ea57879c468

SHA512
7454a5080ab57c89dfff70a8594bfff4c44810bbc920b61f1d298b289f2ad654dca00240c12729a371a85f336496c5166d885598fce94275ed5e2c36fc07cffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCDEC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE0F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit