d254ab7a38fe6950eb4f38abe3aa23e3ff53bacec950d51467b409a598d23a0f

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dcd4072ea833cd1a3e79cd272e606cb5_JaffaCakes118.html
Size

45KB
MD5

dcd4072ea833cd1a3e79cd272e606cb5
SHA1

a59ff4ddcd50e18569e9ab671df27ea2fba50698
SHA256

d254ab7a38fe6950eb4f38abe3aa23e3ff53bacec950d51467b409a598d23a0f
SHA512

2d4524bbfdf2535743f568a4b9084eb6e57801bafedb109f4c86ecec00d8393da41adedb9549fed0c1471a072824b4d67f00540cbe0636acac3356eaaac7ccfc
SSDEEP

768:Zcd9QZBC7mOdMgOpC5I9nC4ejV6DbwMt8ksQ/xDlI0IPTonvcVnd0kIDHeCLa1Ee:gQZBCCOdu0IxC3jV6DbwMt8ksQ/xDlIt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204762614305db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8AC0AB71-7136-11EF-8EF2-FE6EB537C9A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000741af1fc44a6f0558ce4a639152a7930f2e7635ae6a6a9165e9dac47535fb88d000000000e8000000002000020000000e1977b89af45bff0460e5deec57ba99e7cd875f803e4a91434cc1cbc077be69c20000000eba2b7f7519bafdd044cd5342d421c378eb87d2a8e1582f675c7d688906cd29440000000b593d2e7e20b5427f58d5ca324741e0ef05493072f38c868ad80ddebfd34d7f5f13daa0d0631a7fb412ed81c9cdc2c695d1f350683d0b4428326b1538f219a85	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432328331"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000c152912d96303576478997bdc99f21eda1a55116c82561f52783f8b1a666acc9000000000e800000000200002000000090ec0c1141204203ac30467c255ba160fdaa6296539a728c4e121e4ddd049e9f90000000df0aad8e1bf500e0d42b1348a7b46b0b7f7f68df8f2962beeddc24e02def9c07600cdbcaaf4269c7fdb9d67e8d21dc185f7c4164eff00690ea6fd147ab1c3eb3e519253dc4313089ba3dbb574d55830f4e7966d96b45591a0ad70ca08a8f7684e0e3a3775a06f53a100bd3e6fc2586acc769e2697426cfb0044643341edf7e014bd74b3eeacacb6595feb88b1aabee66400000009871c8d384749ded73d547a5003b9a401fbb4473bc2460f41716657c7325534a3c4284f9248a2768f0433b7e7a5fd42103468415b641556a008743deb1e66e43	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2772	3028	iexplore.exe	30
PID 3028 wrote to memory of 2772	3028	iexplore.exe	30
PID 3028 wrote to memory of 2772	3028	iexplore.exe	30
PID 3028 wrote to memory of 2772	3028	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dcd4072ea833cd1a3e79cd272e606cb5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a94cfb64828399f9417ed276a6bac44c

SHA1
2cde6d5374fe38494a5a2ee89d708da6c8ff81e4

SHA256
5e47d55573c012e569559f92ba74872acda94c59c6a2360c258b3698110d411b

SHA512
4a13b7c1c05de0cf01796d0de345851ca80cd53f54d8f0467327fcdb3e26930cbafb73d969e0bd125d407d90ee4fcf778d169464d842d3ee8ca5dce14382edcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
245143949a3ed4204b68da51652cdc55

SHA1
63ff13bbbd49048bc46b1ba5c26bce54ae2ef77b

SHA256
1a430db18590868712498a765b097a3480357dfe420be8ea2194402eee9646dd

SHA512
fefa6fddab26a3eb8e84beecb36829dbb49ee795e9d751e992856b80689c4a34eeae64310872a66eb4570f98c42383132608d45e77f3e3bac6860272a5c2c8ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
347482b91e076a8c242379a1994724f7

SHA1
edfdf4e554d916e11e80d26393a82f8e8bbed34b

SHA256
f1ff4e505af9822b239eedd997ad8ccfe6a570e176ebad10f529eb620147dcd3

SHA512
39a0d8619ba02a764fb3b7cdbfd6e6ec723e733e83c977e7c45dab054da8ef8b69b6a071b431b9c0dd8af41ab2d00e3de76b7346585833601d06cabbfa84249b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee8ba47e97e27854ca090ea98ac6240b

SHA1
96bc64f976cde4320b8ff503ca79c921e3506eca

SHA256
1410b8db3bef170f4ada66a29fbbddf07ed8badbcf5fe9011935a60aa0df7fef

SHA512
b75253e544b66ee494fc30cc308c8ec82d2ab54fc2c23c2bab07f431139b201f97718557c2a40dc034218520a3c390d21beb96ef71e83f0d1fb84a359646a447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebc4d3f3a198306215d5ac0ad3eed0a6

SHA1
dcbef7ade1ef796a11f57416a7091cdc30cf70d6

SHA256
65b602e91ec103f139dbd8d13a15307f86bcf292b7b86cfc5bf24b3ae5dc80b8

SHA512
0a1b349ebedc290164be9630ae4213c31df32a7d19b519c2b19965e7c1073f095889d46a71cd4f62b72c665b98ec12833dffd671b6bd39b75d0fe20b62e90a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09ad22820ac4fc6ba0b26498ca2e027e

SHA1
3e4318cc8fa27a866111b55ace048c889741bfc5

SHA256
d00d04e5601390930535ffdf78f068261089e50ecf15c0f383bb18192ab76317

SHA512
9e4e2bc7902351c9a926146ae7686f9ce9b6c87d5370014cc2e58905b9a7b0e448dbbd84e1d48b4e758665e1f029c6d67d0e1803e984cff4d238241f51cf5d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3152d8f4067bf4eac0baed72e975e31

SHA1
d1a6dd4eb96e0d1760c21d5df340f89e88375b66

SHA256
a953c10fb27363600681bd8e0bf251a20dac6e258f382095a8ca2b3fb94e4cb9

SHA512
9cfae4156651ddcb290aab57a40597f2a80af1b5311190cec1b15a5db76f9cf6d2d59811cad774701baf0f3cd29e02937e27ccf57c6532f307a5d518db5aa306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba6be61d48a9deaa207123113ddd1fa9

SHA1
dce7d569005fab1c9854faac8476b0c1dcf77a39

SHA256
d80a767d57f6054d4ce3bd50870f3f64af7d107306935ce597862c366f6c09d6

SHA512
e4f0c4c7b0d19d59290421c79df5b97fa8c99895966d575cdd4cfa74e7a02f29c8be4c5e4799334707d48b66143ddfca391b0e23c1c5ba8b7bcf055addc19ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f1910a86c8b5e783bc96c5248c55d8e

SHA1
bb9660f392bc24fe5b42646546db686758d7ce39

SHA256
f42eefd73a1249674cc5d31da0dc372b0c81f072565154ac93dd2e4656fcb6fc

SHA512
909621a212257e4c3812e8479f5c0ffdeeb43401186d4b74bc806c71bf7c154fbde9693e81aa8ebb6e0c5ff30e6a19dc67e77a3e3ff8b8f5ebdf1acd5a715275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fce63a1a3921ff32b3f99cb40a99d22f

SHA1
be61d6ec3bbb2fcf4bfabd4374a743d78b822d2a

SHA256
72fc08c7f799c83a54f4bd99e07d5279a5cab574107e9a7be23354abbfc11867

SHA512
5f7363d483b1749e89766deee0badb4f22f73a56937d02799ec0881d429e303fb661c7c00533b0b4b174eba159bf8a227b52d8a06d5e4a2cf23af791ca23aa8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e53d1ec7feacd2259ef9ed01cedee595

SHA1
36bfbc529d6905e75cebce74614636e0540c02bc

SHA256
7bc58ee42e46b0b0c3ee395aee311843bdc39e905e562cea37849fa4df71b3e2

SHA512
1c81f4bb54cb24fb919fb7372b5da5b9c2d436adeee21aa615e8862f09758a81fdbf0ff87eb05b1f60833b5c3c88efa660f45326f9a512ef23cf2990493b906f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a3b51cd0d717da16d63f80a1de35926

SHA1
08768dcaf23bc708165ea78bd89ae8419d3ea66a

SHA256
d01873ab29f05f11e5b4ca52b68f4016a17b214311a580916eae1137a07fa925

SHA512
2abc6b5f4cbc0dc31eefd7255a31f891657f9280a1030e4b1a402a966aa6630e1b8c556ee6f9e97e457aa27ddbef36f152c760ec06d083b870a5faf96389b814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a132b2f395ddf6c7ac1c23bebb4f8c09

SHA1
33d6ab3466bd84373666627bc2ee20477b18918c

SHA256
605b586a851a4f8957d2d6a7f6b011f96b93b381d7183b2c0b6980751fd29cf4

SHA512
3afd60298285c848743475ca50f6e8185ede4c4d5d761700b2bb7463884b0d98d35082c057a3c7cbed4c5c5df7f859c65dd5884c22f3a8240f9325d04b1ac466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
820a463335d8338662a193b23d6f5ab0

SHA1
1a807cd1e8f03bd63e297e96cbb4175566926fa5

SHA256
a06e53a822fa64c0310c87ccf43c44839b54027e2cfaa0e162f9f1c67af41a92

SHA512
a66715d8501854539bbdcd6c73ee275ad1cd7836c3da7237cd87f76b53d2ada6011cb9417d7b738bea551b9f34f0d91eab9d03fb9e24c7c03b9505fa1150f8c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57e7ec026500915e8a2946d29c5d8893

SHA1
68da8b5a059e2e1d1ced8ec5b79ca958105e1984

SHA256
906612efbede2697e5141345046324d4dd0c01786d25e05c0b7ebd260979074a

SHA512
792ea6a705567598f71b05ea1faeb3cef5ce0ac3be68c8927ff9763205473445e82294513daa79a065046a1b397a97eb71a0d7899888629dc72e770cc26cd88b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e014acf4533059c788199a0ce3263176

SHA1
239c9f8433d0544c18c229f77b789229e8f56b63

SHA256
ad6a81b7c734beece3c4d483de6ecd840d346c3f43419614eea0baa5775c2e19

SHA512
d61405a00b48148ad2d40284b854b1785281e52cd1b8f064fe7a06fb22f007a8b16eefda39c061061e13b00ebc285d31176f3ad77bacecde05b0fd236b0675c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6681.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6684.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit