6a198fa8fd3d96d35cc634dac1816be40bc478bbc4f48e84e6f4e89010d21f7f

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d71c7d5681c9dc2d8618daef0602fab6_JaffaCakes118.html
Size

460KB
MD5

d71c7d5681c9dc2d8618daef0602fab6
SHA1

1e747c7fa674a9774e499b0e516540fbd0a32384
SHA256

6a198fa8fd3d96d35cc634dac1816be40bc478bbc4f48e84e6f4e89010d21f7f
SHA512

3a112ce13c52312603c68e58cad62262436d671a4a5ac52d2280841fa37a18016f1939cffc6b11c8abe666f1f0f249f836c5cf328286a65f1baa26278082e4e6
SSDEEP

6144:SRsMYod+X3oI+YWQEsMYod+X3oI+YXsMYod+X3oI+YLsMYod+X3oI+YQ:25d+X3W5d+X3t5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000ce868a42d9b6a8027cc23b55199d657d87b17c4ee9731e7ac815d08b6afece92000000000e8000000002000020000000b5d45fd7d3826e2dfd5c2c952023177ebcf89b913876ff69da1faba50c41b04790000000e3de5c3df3f3a9045ca9ee4fa2539194bb0980204083ac1db01ba527e7318bbc4bca2cbf49a0ea167da9215d0ff3e83c6f5114778b74bdbaa2ac03cac222d7f357c65ee8685f64b5c28ab3818de72a9210a5205f94318359b99990ce4f9d293e396833db85a23b01143348902c954a9b44bdb649d0dcd461b11f83557936ec658ca32aecd44d83a0e245fb3ec66b741b4000000069980515a9f2d0ba83a1a42d3d14d74690b0554d7c67e31a72f53047f4a3306e4f6e55511899b96167a8bf0a131a8a929250394ce3bec8563a81e022c31af940	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000b10e542e07224d40f77bd78009ac06d2a87606f3694f3bb52f727949b662b459000000000e80000000020000200000009ea281eb6b32c4b4b75254a1fd96cc5404752d04f5e36ba16697ae1dfe2ab788200000004621e5328fce00dfa5c6e7dade1e8881d33fa8bafdf73c006cceb9c637aca24f400000000f5ec0a8e81dfe1fd24c7b987ed5391f372f7a68222a6f46808e0762db086d9b28d32621472dcef06ef74b3aad4c68382ed84dbded7da96ccb93474aed0fd8d1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d6aa31fe02db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{574CCF41-6EF1-11EF-B38B-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432078702"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2524	3004	iexplore.exe	30
PID 3004 wrote to memory of 2524	3004	iexplore.exe	30
PID 3004 wrote to memory of 2524	3004	iexplore.exe	30
PID 3004 wrote to memory of 2524	3004	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d71c7d5681c9dc2d8618daef0602fab6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9649d24a08de975626dce50b7045b57e

SHA1
779ef633da9030e8bf76c0902f43b28bb66d3d08

SHA256
51b74b82e92c6c131a4166f62113833732f366bb303880da65cf16a0210f29d3

SHA512
d11680ac4e3ad3c5aa6d7d098abd790ad0d6fe46735314d45a64748230c1093527f0c40eb6b997fae4dcdbc2f4a678d2838d2e8951d0878cb5ff1a9751938881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b22591a7b82bc1e2c655b3f61a8fffaa

SHA1
5436d35b9af6d7dff007fc4d2ea644d9fde50769

SHA256
10a468f760a808791e8b682bea3f05d94179d71fd33722528258411dbafa6e92

SHA512
716e24c1116ed53d08583a22c929cc53143e30edc0366e0599d917623f63019e30d1c0f082e93f9a256d36431c4a176883072fd5fc57066bd26842dc8b129cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cfed86ff47c717e3e975a1d8abf4e6d

SHA1
3fd38a156feb5a3ea282d634c003218c9e5183cd

SHA256
94c71f005c49a159719f7138d06c36ba41a1c516c20d204282283e95657865ef

SHA512
4bc27dd9eeecfe632b417d16d4869a27fb8379175278462fcb3b8aa533e33e84b2f87f9974f8a04f420b8cfd4ddd2371dd82694174192e1b4b2267c747fdda0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f32feaf1871b28c22b8ca25299c1ad65

SHA1
400305442543350ffea5015f89bbaf527491df1b

SHA256
a59504ad9ff1e74920383af5733613fcada65616c258e9ecc942f853ebae2207

SHA512
3a7f3aca23c8a78824bc8a42a3de684bffef623edfc8024670e2daffd81cf7729c7ac9409c280d601815067b7db45be00bc21954d716c6e6484f1e37b6d3b46e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a790adf9f5edc2667f3d7c1c4085e099

SHA1
067726977f758309022634c13f8fd62d1177fe7a

SHA256
d1351659977e4ba1819e3f25f6c7fe157b14cc0eaa3f424d5f75445c87a8b55a

SHA512
33fd908517855ead4d2b890eebddda9760d69415c5fb6585010db2dddbcef15523eca5b2431fee859bdd61fb8aaa08503be5a8328ce0e1cb500ff52bb0cf8cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5652565f7cc02c0401ce3b9a54d0764c

SHA1
b474f4bc331dedb8f790f0bb46b03879b066e636

SHA256
23c6293728932e92da5e1918f3fc71205a3b98835fae40c48ee90dba9f72a7b5

SHA512
7c56338ffd2ffcca60a06bcf42e96ea52c16dd5cffbfb572dc9cb1a8f71e84ac251fe297aef739ed0de8f03459709214be377ff708838a661e2ad5bc56525caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f05082ea41bbff3e902db84ae4f22dc

SHA1
61c28223f9cdf831cf12d9803b7b79a8ffaf1294

SHA256
dbddb67041fc4dece6fef0a52e87569f79cd8927ae70914440ad82356392dade

SHA512
19bcb253c6a6b6da9da9ae4fb0ad8fef8dd5afceb508ece726dbf5249dca73e35a66f0e9c28a7daf0c254b942c0e007264ba34ca8215579c4403f0d422c85e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46020896210bbc04d90c8ebc39c3da41

SHA1
06a9d0d465e48f153b90b4cfa66eda57e659d60b

SHA256
c3a4a7c1fb7d33ae135db6ce521cf3429aa9705a18e706cf981576f548e8b992

SHA512
56db929a5165a347926fc96c7830da4336e5f422fef81acaf334b43a554c45af3c6def3b5c968558f22c44f0f5e00b05961a067c7314a288ec003e86720beb9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddab813f2874453cbe2696950cae6f4a

SHA1
c079b6a576ad5794647714ebfc680259c3adaddb

SHA256
f72d4a00e03a15bcf8bb1140a08a87a5bef5eaa31c311ae3ec4ec3e15d3b8de5

SHA512
284bf9a30da61cbae4c5e57fe4e12b70a757f499cd4f01534dccbcc71e10e662df0fa20440a02cd2c810a175a8cc3c485624f9ad958eb3d466c0b9f946e85a1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b554b0fa0a5ca477f3978552b27ddd5e

SHA1
fa088605d2798c2c860356c35b12df13219eb78b

SHA256
4f3bfc950181232e22f44c3b5d3f10f23c2d4bf17d740d145114dbf9b1dc9ae3

SHA512
7185c433a3c7fb3254f7c0fd723af34e4944f9331bb5fb45a3ab7e95580f4b920695b9bbfef76d887c78aca0c20edeba3307806b86026aa3f11e21f5137032b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b6e7a9cbd2a1fdf82587985cbc66e69

SHA1
b6e90516d9497d68a5d88a078a59ba70a5bccbe9

SHA256
d4fe0ccda4e04adf14a43339c2cc1ff49be50fed39f5e60a065a893f6ff96ef5

SHA512
3efb1ac7497e576dfbe2641e2a9dfe53b8cfe0f207dc28e987db849ef82bfe7dba18f3258bee53f53b1b98631f5a09841e751290f588724d425d31ff4c62d740

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF0F7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF167.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit