b9d94bd924303555ff77d5cc638d6f94970665e1bf7655b394877e9b5aa6e71e

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd592d4b5e0b8e4d2ba0874c831c7ba5_JaffaCakes118.html
Size

73KB
MD5

dd592d4b5e0b8e4d2ba0874c831c7ba5
SHA1

1c9b46f2a7c8a11f5a3ed1a7b00538ab0c1f9982
SHA256

b9d94bd924303555ff77d5cc638d6f94970665e1bf7655b394877e9b5aa6e71e
SHA512

73bab46705399a685b2f47f961c173bfe2fff005c6e71c64a4bb0d1e5d9818ddc39114ecae40dcf4c65b60ef17c6aad235882307f69abb5a299792b5fb9e02cb
SSDEEP

768:+zlpGtiZXBNLdJhOFbVxdBeV6t7VIdGpY2CLlqghFvBhRdnDpuA815vpkWxMpTrL:m+ue9dMqghFDCke8W03GxjSQ9FC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000d25039eb9dd73647486743ac0de92de3ad6e1669b1dfc3ab673e8c6626e4696a000000000e80000000020000200000000aa821dd5742187c694f85524f911544dcd76d28b69139b148cde45cda5c9bfd200000002f0e0efa1852a957b5b4cbd07b9055d23e3623d32d070e9bb28a1efff62b7fa940000000916a3de04995197c91424dc64e856e960c92e216b567b2f688f7736eb5be167b215296952bc0fe6b5586cdb752e4b5bccd3a7d1aa5c173297dcd5ad5b823f561	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000c1f3529856c183116af8ebef984726e8dbbb30e460256d10a5457933d9a5bd20000000000e8000000002000020000000cd4533a7bfabc51b92ee98ef11f9e9686bb0f23d8db6406abe95f12c9197d1d690000000f4217d17c31b91c5cd2ecaaf23f84895517d2383c09241227c3a4e92297a627ad1b096dc681c6b46f113d3dfc34141088bca786f521c145eb5004320522b84d2ceee0e87908e954a863f5dc5916e85126a02e222a49349c50f7e897b918a8657e534ef7fe56c6b2a3471eeec77965cae8afab8eaa1f5cf507a35ee7b643728edaf60c8db6402a2b12a28bf782976eea9400000000b7164df0a3809b9ccede3cfe1f3dbf1093dd384ac1537cadc8f56e5f98dfe5d4c7e9d8222cb4c4d6f1c4bc0828773bb1d5ded140836eb26b56c3b74714e0901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432350315"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFAD2921-7169-11EF-AB3B-C60424AAF5E1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504fef957605db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1452	2084	iexplore.exe	30
PID 2084 wrote to memory of 1452	2084	iexplore.exe	30
PID 2084 wrote to memory of 1452	2084	iexplore.exe	30
PID 2084 wrote to memory of 1452	2084	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dd592d4b5e0b8e4d2ba0874c831c7ba5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
816c61e34f177edd0eab95060d469113

SHA1
f714137d6fb5b945b642cda7acf29f56077b82dd

SHA256
8262cae12dbcbb53425ffab0878d9c3e26c274d8fbec372c60412d40d5f3d2dd

SHA512
80ccbfb9d79b9a3d86105e45ba9356547316974bccb30d41f21f8adb946c3e835f5d72ee1cb51c71110c4cc3a45e660a14da66af720ba9edc51b0a35eb96bcca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
693039dc3b8d2f29730c35849b2dfaef

SHA1
f2e450342f535235cc8d91cf6fcfee8f57769162

SHA256
352767b76d8597697914345a258f181f1b072b66e578317d83e8a6994ce084ad

SHA512
8c5709e0b55eee2531fca78499f60d7371428c6dac83f8e889402352ab0590325c161f9c376e82635aaa130da070c5baf283ff97e57a6115a6b5d070755b4101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10c3839fb9c3758fd63b58bd2ff5dde8

SHA1
442421088e50e6f04ef7d45e1eb546fd1863adb3

SHA256
1ae7ece79df0e43e89f8dbeaba40ce4be3545769b4f0d00b47ac818a5c7665cf

SHA512
95c8033b16b4ff030aaadb3b43594f22ffbb36ff24cf48c8186e77cab6a0fd31208d489580e013f58f96e7a103669e043d4a3d66af3e295b0c5bb3f21a59f8ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e97acef0c825743b22fa3e5b64a2bc7a

SHA1
73d31a1924e17d15b3fdfccdec400898794ff694

SHA256
f02cb2c8d4a220156a29a5cecf36e66ebee4da7f3d4eb078f6d821d4b63daa6d

SHA512
1eb51244a7c67259550b558bf3c95ade59f72accb7257bc9f0becff76304cee83d71b4e9ce3dab2b95e8bfe8c228915d72c16176fbc0d1c7e1bd282e0fd408a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bf325223788d6bad29562fb4a10f624

SHA1
8070af164ed4b619660665bb5c5a59338400a9b3

SHA256
f24cc1722ce1013b7294666e6ce45d6109ba12ecfe8ea1ac84179c965031a157

SHA512
7b18cd46b21ad56253f57ba8a7847aecbdf438721e58a6b8f4229a004a44c7339638557bd5e0ecb6069398ba6b7f08060201ceaa3ad995c15bbfd569a08778a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d601e5a091ec1aaf6f47ee5922f7e0d

SHA1
a6a1b1b020b149e485fd90571f7bde8059c9aa90

SHA256
27cdca29eb89c9c90bf59bda8cc0af8bc193ff7f0b4e43dcdc7539b2123abbc1

SHA512
b6c1f963eb753a6c77dc0307f3e3b4d4d9cb64c03b3b6c5d0cc465ab0676aed487ed632e57bbecbe06bae3aa29ddde837d42829c594893b8e5f004c41007cf1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
323f8c625d404b6c3c2e7117f4db2cc2

SHA1
9131c0c2933d66fb39a6c5005d380ee22af6dd4a

SHA256
08b45737afcff4b7aaaeafc598bd63c4069684700e1903425e83c8b20828ec4f

SHA512
eb23797e7952427bfdb062a05cd00b9563d080e04bfae7e1b1b96f8741026f42344cffb5741c077ff836579221c79ac72c478bb26e81ed8184f96b6f1b8a6896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2678c3ee597166c185dec0594a31a09

SHA1
50917d75a37baf3261c1f8158f1890ac106969aa

SHA256
17a4076bdc0bbb57260de0e666db9973ca47cbaf1bbc20dc76c4624a89685328

SHA512
90a591e923323048557dd7c6a1265e6552b1d3224974b30ee4f4b61d45179277c3333887a4cabdc248a22d1f6d6461bcf5a1dcd375c565f8deba1f843ce3959a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f52877e86ae68827d9cd2fc93d773da

SHA1
513a14ccfc774ccb488e8a3110194ac56eb6c5c7

SHA256
ebf96f185d58cfb0422551d8ef6d7c353e7ec106f135e74c08875159ac1de1f8

SHA512
1d27d9234b6d0f7b5652e366505a50534866408a7e15bd1bae43b2e181971ffd327e708dbb21ad0079288d4f5d469e01c439ae86844328d65c688182dddb7ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6acd226702dd109b697c50a236eb3d57

SHA1
079fb6a95099c9e68a4ffc94695cd76a447b6478

SHA256
11a61fc5a4899aca050f44a87b2dfdfd36f9f323fdf9521ecaca3a1b083fddc1

SHA512
b7ece8ecef64ed62b3557d87c9ce929e95e44aa95882dc5b361ebb7a39667917b3258432d4ccd1d644159f4190a28acb8b1d87a19fd0dfa6a5a8a17fd018517e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8605d6d15d21573eead168f5710a2899

SHA1
2dbd1f89d86b488d64212c140828a362e06bdfe2

SHA256
3aafa1dc015841630a97739ea70f848585a3ca754133f377b67f9c413e921211

SHA512
8586f1c09b36ecc4f5fb11671cd06c2a08c0d46384340a478afaaa09ac64634d682c1e864358a8bb51f46bd3034cf2362756dcd74264124d40aa0cfec876fa5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d5ad5899491a67e4a9123afbcafe341

SHA1
bf767a9b894f0197854f391141f006abe1f9ef9a

SHA256
c2cbf6ad8cadcdcd574775d62033aeaa2ee758a5f53d378a8f8e0d00f7695786

SHA512
307440193e40dd8796b30c73825599aea83f9f86ddeabd1f208ce8e6ab64543d9bb8d5d268aa50a56b5b141a3fb21a15ccbb977aa6a084f14d6e65eaef5395e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97b231cb5aea4dc93848e944ce63a0db

SHA1
c9b62936be14948a82e05e9940121a33b493bfed

SHA256
eb0b512d7ac794a656b4479143c54934130474e7eef4901069bd3916751db385

SHA512
2b4eb13948e459073e33a13fdde01ec60504f561cf9b0a866b7638857ed5d07f840f7f26e306c5f975b8f189d5494cc1786d1a6b7aac08e6ac18db68a7e0ce0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25f07efb51ed95c350640535129b0b13

SHA1
c991f97b61944ccaa29b8b829fe6e5c816f75052

SHA256
8d53dc0a4b58a99a19e71fa6c0753e40c5a00548b8d23dae2c8482901f81fb6c

SHA512
4ae25c377cd417c347c302ddf1f4efc8bd55a5d79c7070cf1984e663d61a97b9ef50cb3e95982dbb3c44c971818805e204424c4eae042ee6316eb368debbd0b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14b762d92e3eebd5e5313a804976562e

SHA1
11b42b20381980e1c4a96152c124390c3258eefa

SHA256
899cb0a3982a3213eba284ec819feacb59866e43eb1e46fa26ca2bf39b62035c

SHA512
b2af5d0715db9ef50c7330b35ea9266ffa3e3e07deccdf98ef7926962190c3737f9b028ce8742e815583d9f73d794e0be89744f6eada7af690e8b187f8df47d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
830fedd1174f1a3b41ca05785caeb9cc

SHA1
e18c57afad4cb6364f15b6bb65e47ba877841f6e

SHA256
8008b03a4222cf3b396b75218f0aa701c3b36c65632ca3c0815504ed7eeea000

SHA512
e36525f9deadb40689c104578563ef3c6a987cf4a27dd344fd6b1ed4ecfb83977bb97241de2259af4e868f0efe8ac62009f573871bc1c6d7652da50a8748639f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD03B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD10B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit