257ab1dd9b436762494195b4618b077d2631def0ade7295c4f092f7233bfa76d

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f06bc17cd24599def674497e294a77dd_JaffaCakes118.html
Size

29KB
MD5

f06bc17cd24599def674497e294a77dd
SHA1

1a882d85b62eb2dde34dcfdab7a9e4983659dbcc
SHA256

257ab1dd9b436762494195b4618b077d2631def0ade7295c4f092f7233bfa76d
SHA512

e221d3f8b0c83acd5c5152c3c39f03a48d811f16ddabc90148a3ae8a8bb21731ee64e9b094b163940e2ab72cbcea41c47fa00f9bc4646ba4d0ab156caea4d13c
SSDEEP

768:X1npKVAqnd+qq9o7B2wwP/1o3RXFo2SBzr0:X1pKVhnd+xmBdwP23RXFb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433106018"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20449918560cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41C3F611-7849-11EF-8202-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000006842661737d07f40138bc9a2c0521432f991d0e28fab6157d841a4051d92eb94000000000e80000000020000200000007c5eb00fc9370e53f9b1f1708d8eedadaf1bbc21e092545e81799eb70aa01828200000007937cc32c6df4e013c4ee0ef2e879be8cbcf0a665ddc1b7c6d1c617d14dda178400000000b13feec67339f06305409aa847b721d3bf6e6268d8dd54e9a80901c10582ba00284eda07d89b0c5b11e070472205069a90d8ef5919959552e2d03b319f3c2f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000225bf24817c1f66696ef3eb2db6effd2c1768214e1f43671a16e9837d14aeb05000000000e800000000200002000000073015181787cd801690458f28048954c9f21091fc339d6740712d74e0e7571f09000000079ef5ed9b3e4309e52f8a1e80e0b8547581b2a1cfb02c8b0dfb4d0e9e063a666e7805ffa21f423e7ea997f708f432df8335121707e0928288007cec8b646fe6327c02b4439f3356cb8f7cfea73403c8a2de5414bd2a1cc3a44990e50d5a563c408f15ec133577e3b49fa72cba27798ee76bb21178bb739e7c299f98af548e86659b7001e88215f7a79754fb3b3abc0344000000091453bf5482f8e15d111e2cdfc263b52ae11a1fd7ab1fcab607c6a23c5dada6a116ce908e15b0cbe194b710bf7f45f1565b8a28df3b8d66768e5e898a1b40139	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2544	2132	iexplore.exe	31
PID 2132 wrote to memory of 2544	2132	iexplore.exe	31
PID 2132 wrote to memory of 2544	2132	iexplore.exe	31
PID 2132 wrote to memory of 2544	2132	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f06bc17cd24599def674497e294a77dd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
82df2edc28e6f493edca68d037e1aa94

SHA1
7b4f2e94f1b57e014d03235d775e4841d7afd2f7

SHA256
c4ede3644a7c6f7046208c2b0802fc24c838f097192bcf2cd1abbc25ff65fac0

SHA512
56f1de1acc3331fb59abe2a1903e7c893c57844e4ca121afc37d0fee72d406c0a528adb21b2c5b399447d392aab58856962d59c6ea9b6c89ad14c173bafadb93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
114239458b84d1c7b16ee5e1d2a69e44

SHA1
e5e6f9bc567a59d963126a929931bfb1acfbdb95

SHA256
8aa0ab28408593d975ff49270df19d02834bda7aba870311d555bf2552158737

SHA512
16ebfb185224cd2fe11b090f2c5827b750623d7eecd7f496dbda15bdf8b7d2021f9b4bd47048a7770f90ac79359b01e77dfe4c7ed8adec60a73280f7309fe707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
88cd84d90aa67bb100c6dd1d8c74c6e4

SHA1
562c91cfacafbc3b7c68135252205a7cb27808a2

SHA256
43df72d621f53cce35ea48d181b56ee05b506b34f3ae57845d72187c47204bea

SHA512
197e17aa148a466be93662c2439fd6258d74eb0a14945ffa425a5110017b9e437b2c276c709e1aba619c18aa286762f0701be3977d50e1d3cac52651d4515f84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1770c3cb3ea6ee7b97a2caf6b52cd430

SHA1
5269a012139a5843921d11f33da2ea2069124623

SHA256
23d11fe835c7792edaf3be0febc7002b2835a9fe8cba12e264d00cc89ee70314

SHA512
b177f37019dc0eecb0b9abf5c943d03339473eea656cd3ca3cc017f410a4cdc55250ab286cba8dd5866a8439fb556d6d3b576aaebc619e2d062f45131668c3d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a21795117288590169de0fec643e1be

SHA1
6ac6c77c375a3079304ea326da2b019a22bfa08f

SHA256
973bc437399a11d60d276463c03661ae09327e278a7d3c782f3451856c1f404e

SHA512
ea15874ea87ee95073112b1b69a97bc203094db22b5291eaa4a2d77dcd211940f1d32ce1b0749e7a86d92b9d9532478ae3e8e9c1bf55847c3548216798e09ff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
309219a80618ea1c9ef164476970b42a

SHA1
389456b94c29d78491b1ef75e4d28f8112a940a0

SHA256
6ff84d681806a51f36debc3cc34a46c3e89b4274408c17523661f6aa8d787f7f

SHA512
4187ea7d50658ccefdae51b70b153c612e4bee1b903fe4267bcea3a44cf669daa7fa737fe0a061978b681d13d0e9668d1b39bfa33984b7cce000382f72ef0a0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad330466c95340d76d3fbd38fcba86c9

SHA1
c6d9265f63093b082dcb081bc857018eea6f045e

SHA256
dab14cc611abb7ee3b632f2e97dbb38eec6b3eebd506408bbac0d20a37926537

SHA512
39f19cfab3abd57667574b4a24280f6045e2348148120f5de71edd4fed0e67aafe07824d497e013f2778c54b69c22fe79124e8dbf615d6e9635e2ab6ecd266a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
196edf11cc6db02d23f2c085c3b670b5

SHA1
90d963458e7a95ea0c5a797814880036085e4d18

SHA256
6e466a84893918adf4168fcec45ca7334572d5c089b78a8c657e8e62caeb2bfc

SHA512
637bd43bd34e5aaf49dead63db7209fa60cb2ebe5efd443930400347d189ce921f4a88036f9e67e76ff36c70f874f616936eeb70e2b263200a0745c8928cd226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69bed2eba67835948e73a7214f6ff650

SHA1
4138c482d857f441d1360d22bbf0dc0c100b9a88

SHA256
f884e6fd3fc85d6b0f71e451c61a6bdab1c45c5bccbbdda365bd1c968fc0ae46

SHA512
4cc0ea5a79fd0c262baaece13ffd6f7b261493bc480cccbf5ddc0a9660dc5524f3a582f9b2614c16b97510e0ecebb20ea8c4195c4283532bcf0ca882a618c5a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b0682799f13a85341eb114d71c68817

SHA1
324019c2f3221c5ff1291799cae5113198a5a645

SHA256
1ddd368fc485380a23abb2aac60d8419e47cdeae6d658ef80aab9e80427be36c

SHA512
486442fd22efdfe30a18f8cd01f60254f868ac776ec9dc08d7359cf0eba42824f5706179142de586b0dbe9fa553b56c1e973c407ffc326f794997579d07933ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6950bcb3d723a6132c7b360471694867

SHA1
2e518ff8619aca0c5af35a5ef34e88dde73d7f47

SHA256
294ce505abc397689274e5d24bfef71265ba724ab409e0de0d983e401e720a8c

SHA512
8d65978272f98b3d03559fd6377168dc9f847e81eec550fa5b433f34747b3c593e06bc77fa23a3d84fc3b97a3477cc0c9152004e5032ee5985c8f0151c32460e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89282fa84600cadd744b814802807ef3

SHA1
d0c2a9a6f1726fbf2db3f3169452da7e25e078dc

SHA256
8e3247394c8a7aa4de15e995063100f625f588a84e39c3f2d83922d9ad34a654

SHA512
72bae127a74e287a036064a23194782ce17aa2fcefd99c91c4e9390cb88bf12812cca4beee93659309a29004fdb12250017923f386ae91f9cdcc9e5b32947391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb6aed4b4a2da49835b3ce61340b805

SHA1
605b53581c03b445fc5195001e45ad556c2ff850

SHA256
e20900f82e21a4a706bf299f5c88c3b2cc104290efb79304b78a0dfcd05f9508

SHA512
6845fb274d290f544315e19852ea503fe45011b8995749f87d713dcb7f05a69eeced2fa6814538336c63f7efd6ba32ce7757fa6ed1b537a34efab71426bc0daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80aee9da3b6c60133a4bbe0c4b32a2a2

SHA1
25ec0238a995cbe1ac97b599fb56b79895ac3d5a

SHA256
fb9805990776b1f600305cd126f0d66aba6de68ef7a9717f66ab3606e0201b7e

SHA512
c81141aff76ed9b1cb443e5fb2cc042abc32b8f590f12b0d35dc5b6d94eb4c3649fc78903cd1878264f4717ca527e273990915d401933740e4b620643c606c8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF29A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF2AC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit