d323221fbe1843417d5fc0ed3bc0ba7dbb1b78eb89c8e4d7abd8d46e8a8ea6a4

Analysis

max time kernel
84s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd0953f49b83275f4f610facb386f8a5_JaffaCakes118.html
Size

21KB
MD5

dd0953f49b83275f4f610facb386f8a5
SHA1

201c6933936fdc1369682ca7486aa1639c90973e
SHA256

d323221fbe1843417d5fc0ed3bc0ba7dbb1b78eb89c8e4d7abd8d46e8a8ea6a4
SHA512

3d0db6d05a9cee1af9e5828a03318951c0d573ff8532d91078a0badebde64f08361b031b45ea5b3313153d39e85c276e6848666285a10e504f57119766142fc6
SSDEEP

384:1d0CwRqi/odyxStmbp84ZKLxx+xmKt07T47qIk04pRXK9Fy2WQ4Tp3QZX2NrzaVe:UpRNQdyxSt4OLzOtCVXXK9Fy2WQ4Tp3p

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802131595605db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84050701-7149-11EF-9DFD-D67B43388B6B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000edf9df263056e35db5a4e7aadebfc20a1588c98da353283b5dd7aa21f2bbef38000000000e80000000020000200000000da61a1fced27652fa713ddfdad3aabfffecf70df3a4f07b459a571bc4161647900000007744649f53feb90dd17c1412b19fbdc15d1f162a4909cc5fa183d2fc7d0d440654efc311efdccba0313ea217995380cb127ae27c1b6ae68188d55ca5cfead592a2a468b5a95cb41fd3bc8118ad1774e9852ef1a4e0ef0133572e44723306599a0e33ee71599f0739f2f9b7f498bc79297c68c62b41fe0a17bd6126bd1fcc7c78ca278275ee16d0d6fe5b1eddb35c96cc400000000366822e6efbf1af5961f7139223eae9096bca9ce3e16d5a26b14e943492c95caec9c5be560a4242ad4f21cced453524d6337c3b528ab29c7ae1e03c54e412bd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432336473"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000002e8bf84e6045aaa46611a8ce6638d540cb81ce0b70e64ee413b91314ce1d2cfe000000000e80000000020000200000004d415424c8a8954695958b1d17aebacd38eff6fe446251c48d4f504c92bca211200000003543fc0ffa48236b30595a7224da847d69451e44e2955822a34ddd8cc6f0fe504000000031f736953291531a04d5a63d56cacde732a6aaab8da8de3eeb810a486d29ee8b515488118fd4b3a1da23f8856b54dbdc7f7a90d56509e5e9d4ef9a43711b2317	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2204	2348	iexplore.exe	29
PID 2348 wrote to memory of 2204	2348	iexplore.exe	29
PID 2348 wrote to memory of 2204	2348	iexplore.exe	29
PID 2348 wrote to memory of 2204	2348	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dd0953f49b83275f4f610facb386f8a5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3c776a5001761dcaf8328eb4a737611

SHA1
2af58642619caa23e0e0cc0f5b58d0803de9f6cc

SHA256
1a05ef1a9a88c0d7f64eadf5bb780db8159e24a6edf55d7fa88725f91c5da88f

SHA512
ffe65bdf82ee7ed465683d44ee19ac90192ea6bb6cf42500850065b07866d2885e3ac53b103ef424a3b688fb43c712ded8f925ccb79072ad2c800cdb22fa029b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f75934d9903491aac721e4fd5cb5369

SHA1
901782622f06eb08cccee961b31f6e86780f5c20

SHA256
71dec923f5b4e8725ca0846ad8ffe02802b2b7c50ce7bc624f65bdb30d74ea41

SHA512
c7ac17c7d396c0adb5aa99b5942709dcf27bff07909900ba883c5eca0f819f3c87ca6c6264e6d04ec1962d970a74b24a9d6dc5bbdbd0b779259a021957c10ac5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1d373e28e31d3d8b6c30a853c069617

SHA1
4055dee41fba816bfdd69f6610998ed5915a95b2

SHA256
4b48402db096ae949c8559d095145e72c34937a3ff3ae480f314ce5cc78620e0

SHA512
d53a7796ef993557a768aafb234ac11667d98a6090fd31cdf3acdf469a4f4ee8234bc58a1bc84efda2b509d35d11d64c7ef9136ad25282dd65105940f39d620a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43856963141e27cdbf59b3c5da5338c6

SHA1
ef6db69252779e6a813ddc143b52506384669e6f

SHA256
a7ffd357174700d62c9aa8735b8cc9be7060d0c824d00382c67d86a1a3da51dc

SHA512
184566240863870e1051eeadf750eb7fb881b733efd5d5e8fdcf281a2fa47b5d6136489c692a6dfced6618287324eaa6fecd5b8f98ff42b659e0e8854ed45bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d43af6df88d04d8b9022fb31eecbd8b8

SHA1
8b1441418d9b1fdecb88e3fe4c06ccedfc7769d6

SHA256
1fceff31afe048f0b17cbb1f47d617c069f2f778a15a81b10262b75eb0d5ce83

SHA512
6869da4a75e7a3d9b9ab470c522428ea7e853feda0018cadb3224ea821bf87225d2296d5528f51ffa26b3f49900b65ba57766f6a3bf45767c7d2ca2475bab945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a769aba466dd2fbf470fe5bf1db93b8

SHA1
4be04f8b6666bab40d9ab79b3f4b7e8856b5991f

SHA256
1fd1121e6e1cb88fab99588d7fb414f333a85ca18ff0048eaf5f27c8c473ec08

SHA512
189675346b2ec9db31637b5db1c1f5b878cb29c9124b1415178ea937a0e41923330ad700640eabf9ad035c1ebe5c82ac45830f1c49bd107bf16b2c4a411541c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afb4eec704cf033c679f080cb84a7822

SHA1
5085a2cdf048c25d460cc9a345d2534369cffc60

SHA256
7a4911b3d01c549ab429b2b08bef09b600dc7324236686339cf731f3552390ce

SHA512
289be0d7e381fb3837ceb74ba65c31875c4fc89abc7b5c92f1056029a23a1a5126abc1730b8fb9a8571f1e6f805bd85b525533820857f782d893d793f6a354ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
659d6d2c305288bc1e25e8e12f6c5687

SHA1
9f8796a9c4142b620ee936da1b2c2a73a4d7558c

SHA256
d90a5e8f8f3e93802f0b8e96a1f9e1d9796076e36e27588ba23b681fbfeeeeb5

SHA512
62175fff9ea38521ff9fce78605259dc70e186a3f509803f770241b00c9880387247dc552d0fb0e6b0fb2ba2a4147a1df173518ec8ffc66b784edb2164629a08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ceb9ca4225d23afcd075f30a747244a

SHA1
b5651e423fb05233c2ae5f064c35d43f0b72e6b0

SHA256
94cb5b6c33ed88a3e1a2c03afae36696e634ad860ad8c85705bc47716f93d437

SHA512
e2e13f708fb3107dc5dc36ab4c04ef7d32606d649949f2c5516d29e12470aa312705ba713db2317b3c574037ba16595dc6bed5f0175c77d6536030950f26e8f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89748c73449f48871cac9c8084bffd08

SHA1
c8ac1ef26dd5856ba7a9c30c28c0bb22a71f2ec2

SHA256
d30a1046bb392e580f46ed191cfb22eb64f30d851959bdb937f1342052821a3b

SHA512
1859d2395b03d972cfe2c009451fa82718dc7fad38dfea1147514fd0deb09de122578b319e15539a46cec813f009fb06f8165ba1c850bc6d4292e0558cefdcf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4fb9c35053a885759e8ab4261f3a520

SHA1
909ea9296b024ba4e6f50dc46f284c6db9be3567

SHA256
b1e27fe85dc7fc8898928c08f51e8d28c16d60b57034ba6812b057c5ab58d9b1

SHA512
0c661f11864f1f011fd61f8dc006c4c5a66539b109318e59b738220605c3b11389d58e462f354b236941b455d897428a35877d265aac10245cb1d6517127ce4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b465cce222a7115eb65ac4846348aad

SHA1
189264345772859e68643852797e680cb6ff84c9

SHA256
daa9f2b07c705002252f2469f6e55be39a5343c879e4ca1e71ebabd67ec9fee6

SHA512
d2cb769ca142bda45f5eac376ee59ad99f01c501616f1842dce02970238ab6d122f91bc35f1dac1571cf4be58bb9bf424bb7e76d4a20ebf440a176ecc5a378f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c26fe835970961e1cbbe215934578c16

SHA1
2f4e021a06fefacf0013cd1f5acc8f474fdb0561

SHA256
516305379cc4147c4e0346ad3ce743e0e22fb3018f3c0930bc54213a97ba4aaf

SHA512
c628baed5c0893ca71e6289fef2bbbaeb77374a42e8c49cec66e5542d7f283bfb8c305d81cbb9cddb40414dad2c13f708e243d6b68fbc6fb00682199911ff2e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
514058f8ccc553b191dc6298893071e2

SHA1
c7c07bc26d94cdedf2ab59ccae65032471eec95c

SHA256
e0b3b2561bc1aaa55f7eb60619075b06586d76df12a28f45c717161c4542bd05

SHA512
ee3f2dbedd707ad46c568423447456246e0881de44593ed428ce6e7171235bfcf886e785ba21b17f0a10dd1daa878210cfef1bf8238d52fd2c790595b9d52796

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7603c047fc0176c4a4da16a269e5ecca

SHA1
b5fff365c217207efcb404c1de47d03b418907ee

SHA256
dc421bf56185a15af16bc923c16ac8bea863fc8ac061ef4520de979540fc0a20

SHA512
e52f73d6d8a07e12335f2616798d460890210f29efa092f3ccaa11d078f13ef769a94b6ec9a98b9ff11f5fa38bf9b14b9b703fa7a21f2e9b667956cd158302c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1E4B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1EBD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit