399c74e2b7c8d066d5c502702ab4ee29d4df605387c22320c34218589e131f18

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd291837e634c9599d2f01176956d214_JaffaCakes118.html
Size

53KB
MD5

dd291837e634c9599d2f01176956d214
SHA1

c5e25d3abe8e4fb939748c91a63396b9b83c4464
SHA256

399c74e2b7c8d066d5c502702ab4ee29d4df605387c22320c34218589e131f18
SHA512

c18461efe7373184a94a197b64c3cdec77debc3a1004dd15377f5b4bd72bfc5dc1b84f891bf48223f092a1437a53f6bf3794ae3a6d15695cb2ed55961b0715f7
SSDEEP

1536:+C9NXEF8z38cS38O+cmb5Cn8KFj8UA8pUCWTCWCUA+j8YpZVNqQImTtt6CCzSXXN:+CHcmb5CPwCWTCWCIh0C+SnC+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43F2A3E1-7156-11EF-8252-C28ADB222BBA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fc6d1d6305db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000d15c455137109f07b5e725ab1aece38381399477c77d5516331a283574d1af97000000000e8000000002000020000000b8e86e5750cf1d1358ab08809de815ca73d9377a833f1f0ce17d0c2128f4093e900000004534e58844a099c4bc168f18c3889216c96eaf43f1edffba4b84e0f31a8d63570061f0330418309ce11c97b052706ecd13fc5f70898ebabcaa0757f2fc5cac0c8ff23491d3f1df8402b20504f13292a932d6c638eafb73c93f63a114c8ee2d4a7634be8680a51e0896af898bdde30cf285918293099069c0245a6390da86294528fe8497c1c64f0c976e2e245136088440000000693ac0c05bce3d0c0a4446bfb417d9937668bb6f0f20b2ae2ffdd6805458dd90fe1960a243b16f370ad60e08e8b73988e92e2d9dab0944395c38f406e4c3f9ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432341947"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000208026354c45b16be010fc62edb61e9083ab492e0f2f6e88c34b86c2deedabda000000000e80000000020000200000006a56ea30993c706576298c2a1e985aeb3e9e2500f4fd08495e42f370df1560a720000000e0e0324fe943900c35447e502740bb17624d05cfb4a42f6df2bbe2c9de5723ee40000000f038e5349263cc1d691df68a7c9f735256ebf06f606848969a8768110cf68f883d9269da6b59286fd69d906b5170e7f1124f2342a7797fc5b3fb86a68639bbd4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2452	iexplore.exe
2452	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2708	2452	iexplore.exe	30
PID 2452 wrote to memory of 2708	2452	iexplore.exe	30
PID 2452 wrote to memory of 2708	2452	iexplore.exe	30
PID 2452 wrote to memory of 2708	2452	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dd291837e634c9599d2f01176956d214_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d1671626ca21d242e864d12c850165c

SHA1
97d7f825cab2c72327b4dafc175bfc0a99605e87

SHA256
9db889ca80758078ec36658895588ddce77042b2668b4b6e5f8ee9c5c7a9d74a

SHA512
3c7865876c813bc393e34f54b40f68b0ba6878a5b1d3d7ea0c05f92faa9bb322dfc0f8a73a1f175c84444e3b76bd6e093564940b9203466a735c82439a3b8b61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
680387cd25ef7ec72583e4f1f333cf98

SHA1
4f96295708715a7055c8bfbc19f62e160ebf1995

SHA256
00a5edf02d2261cf83782557ef5d59d8ce6d8ea215113bef886e9856aca00fb2

SHA512
257793ca377c6f7aeccb2e09c67af6177048c7be9386bbaeead2b68b6065d5ecc85e8fecd98212e820e00b836f055e84e3a41146990ab40315bdb112b40b87e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c89e4e25d94f4bfaa3eef4d40be4337

SHA1
63890ff95421c12d535fa0fe366e78953695416e

SHA256
c8939da3c0cb1dacb3a8714812e0b3b5033c1a1e5d6bcea0aba414672cc36bdf

SHA512
212bd7f8ad3687f8d99b5477a878e952156267dd8350e3ce0c844818af7b5f31bfdef59f36ede40fff8465467c2107e23d8c71b0049fcd246dba63aee3ca4339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaba1cddc4ad05945e2eefb7e8964571

SHA1
0706cc3bedda834006ca7554f59dec390a0f8a0d

SHA256
68c35566b4e8ea36fe45c35e230a290057febbc60ed87d18fec41e8b53bd3017

SHA512
fe9b81442113c0cd576c06146ee8694e61c11d21c8d76432717fb491e052171baad44d4483dae24c33f9274e117145c21b9b61700c4013b7546bdd2d315a7275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf2c9e9d0b7ed978d8200929229f3673

SHA1
d6ecce78818879d831ce48bba56ac48b79c10bfd

SHA256
2fa336adfa411d18456bc6f8d8d9aa8ba271888e8bbac627f5064f3c178996ce

SHA512
bb89419a553e90ad9bf18b79f166ed531f1381ce674eaa85fbdff4aa129b7522a5e0723cfbc57e212b4f4f6329378475c771c9a260de30fb605313b69dce8de7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9c3030a6c0ad8c0efabcbc63578a284

SHA1
52356f7ca337a9ac261c1b83b3b797c042cb2c7a

SHA256
76fb4c752be8adc3b549915c45901398e6aef151a08372208ec152386a992596

SHA512
f5bad53c657c3ffc460b77b46fccce741b3f2283985733d9b29bd1b3bb4c839f4d9cda230bd4390c4f15acf681685f5cd203fc9b4a08df75138b996b10ec2645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c787af011a87194d1554967530c6efa

SHA1
0fecf9ea937e4f4ca605bb8385cd5b983d5d9250

SHA256
184a34740f01ee1c1aaba9696fbde7e001bafb4bcc464400e99483a1bb2261e2

SHA512
8df94815040d93fb3fa6494122b82545421ed29c727f93eba75a4c3125c3080863343a3e94380b3dcae417be704a8fbe45e6a9d0582103d29591dedf5e906ea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcc2a1d7df47b4a1587e7601a4550e1c

SHA1
e9735b8cc2f6312bca76bc9751ddf905944b764d

SHA256
da64dc2c8457241657027c4b35e463992f65bb527a926759b21c54883326290b

SHA512
fb6ace956361281001ecca76816a830a5d675aec8975b714895480ef1864f037c8bf3889847c80ef5c381e7d1d2adfef7498f98e1c8766f9cf2053e4633e4a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c79a070e4af89607aa9a4ca128d3fae6

SHA1
7ab0507165fec483b4e4487c2812b2b5bb32106c

SHA256
24963fcb581161bb204cb57219cb2ead12f15ebb64557f34d49ac520af3ed8e6

SHA512
e1cd05febe2e10e86768282294a90c2a1e195fdefb6a268db3f78cdba677bc5770302b0792bcbd2d1f4dde5f6b609a9638f9c5ab5716f27430f9f38a2e218bd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00823539bdfab3d595a54724dceecd0a

SHA1
81dcebf70dd413f1de02b24f7a5c6ba6b79a2ba2

SHA256
911dd7fa2e4c4385e5b9a2e7c182aa6af484f8d4e045595879e10fe3c8ae0c96

SHA512
4c5577f2ea62c29afdbbcd308d1286bfdf8cd703c55030c70b8068e38493e34051fced9a1b3e4071fe9293ac0a92b1e8acf1762d62a7c8812d4b97d1d36eafdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecdfe4f31f2535d1209b4a13c75fddb7

SHA1
aedebde19ed282cad58e73a3173e9ff4a6621b6d

SHA256
8768129f89c7647ab6d75c911823578be7b707780504cd447e58409a94c83775

SHA512
97f723690a463e35fd334946ce1e0e6da9dc538f1b0603fa1173fa9458244b8667281224a986de6c5e3670c908e93ffbc8a9311daeef7b9c0706b0b157b95fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41a7cf0dedee8f1c57a2d39242078c63

SHA1
704b20b09ed2abc154da2164e5af9c407f96a6b0

SHA256
522fe34e945019c1261a0290d8b8c7a1abc26cc7a61d4a65c64b29d660fea849

SHA512
308c9107f0ea52d1a241ed5718cf4822dad99eb5cf34284158af224549c2322512a327954e46b9d80c7317c780b45b7bbf0434868efbf38b2ac1fb7fc7e47835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
554f0246eb7d93e946714ad8c49f789f

SHA1
3db798d2ab769a9426e803827746dd9be442393f

SHA256
5da3f2501453a1937ace348f028bb93773bf922e419d5e07f7ef97a02e989393

SHA512
00520d85b1566233e34347d9f894ddabb3721aa9158624d57e00988c1b5423cff2d1c9689080ecb4876f8dde97835bb8031f8fe60eb77afa069580629a230aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12ed9692f5670313bd0af7ec9f9672da

SHA1
99f3c5265bd419b246ff5d1f3d594834e07dc9d4

SHA256
861a58f405cdf8a2a528229cfc1aecc2cfd8ee4c9c711e7fcf161f52cd7979a3

SHA512
c9af822209661098b59844bd34b6a5903004ae45e1cb5e7d1ff3dfde791e37ed94b8af6095395cca8f26073c4ffdd434bc4dd524626bd493c9183f301c6e0a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0d6f56a93ca6df2969cf41d643908f0

SHA1
a2aa902a8f4087627bb35b4ecb02330dab561300

SHA256
051aa74561d7f80d5a3d2dfdaf612d11ebe19db1060371abfd38bc9370390c9a

SHA512
b7c352047bfb25321b47f24b63966b8e45724819775ba027ca70c366bd0edefbecd63b3900b8c9e9c59383891f0cd2d774e3cc97dfba084169732d0240e3c2a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94867bd2a239dca779f2701e3497d271

SHA1
6cbc08fd6fa96e16b9898cb5dbaf7b3b477ccdc7

SHA256
681ed4509832f2c1896eb833480c01bda821c925b56fe5d3fcade1ad3d2a26f4

SHA512
c25aefe4d6c87c8ca97d239d90819166e6a18de1fd9da6cbf9fd3a57c88a0bf54c6330a380eaad78629c745943971993152099b02749bcbf65513f226801d620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b27e56145cb22ccf5914066afac1e553

SHA1
f2c2c732d5b697859ead57c3553be9b8999a2e45

SHA256
21b8f0d2ee057803240b753e414dec043aed9a5015327777ef4d172359db48a9

SHA512
1500f9291cf460afe7cabb2a882ff4b0bf048fba8f8fb8bdca98c9979a349fccfb4b7226cf5f17cb0f3724853edb609ee9c3e15bfa26e3b06129713c0cc76441

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF365.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF425.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit