bb9579dfbc05922aef514b37b91b0c01827e9bfc6346920bbeb560dfef9b8549

Analysis

max time kernel
140s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05326323a9e6fddd484376499c729ecc_JaffaCakes118.html
Size

16KB
MD5

05326323a9e6fddd484376499c729ecc
SHA1

092a935034ddfcda8db531d46d428ef0aa4a4ae3
SHA256

bb9579dfbc05922aef514b37b91b0c01827e9bfc6346920bbeb560dfef9b8549
SHA512

b50160cb0b4d1fb3ffd34aee29176978f9cd13c4839e76fa1c82b1adcf444e4a30c3e65582a0cf6ffd23a9429e2e89c433e8a9a3e3258cafb506360f8c154c97
SSDEEP

384:sslIcXte4u3THIjPxQuMv/gYpBPaneRCxax0kaguLZ:GdgFyZaxLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000002fd33545a4a3e0ee7eebc91a6fb20bc19f8cb5c7e93c4b317a773d652a78445c000000000e8000000002000020000000ec331c17f23e29a60fe21c7faa704f2ccb9e675b922a08c21b3c6fc9fc3299882000000045844734e51e2e9e90649bbe14ad234c91cc32ef1fac94e0b3e7bcbfb63275a340000000a039dfc03cca5202bcc2643926af2409650666f9af256f1281dbb89637e44db53a49c44d7580c127a7e588ac373fbbec1779a252f872459a75ee5fc7e4bedba6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000008e716a4bf1d688dc2cd103d53b60cf2ab740f4049c2f9551bf323b1bde0823ad000000000e800000000200002000000022f502d1161c4898685fbdcd5a4e59f8c1b5e04ed4d223cd27c54187e02b711f90000000babd406e6e9650e79454ccf713fe6a80699d4d9ede3775108c7ed49933bb6a3e558843a9ceb8863351f95f450785788b5e10979c721d349ffc27f348e95b648488d6c16f62eb145116acc0fc40f4bce2b7a1b4cbe9afacaad187dc355e0c2c594fa842dedc9855841250f602dff521de5a89c655d6879b76b0ca819bd5935199ee10dae97219925e90d6c7e90d50d5ef40000000640d9223c3ea1448269bdc31dfc304789ec9d336df5c89dba061120c891ef64ac384c673b0d4550e1e2ec777e3317949efba0e60d07cf5a178c05bd81c88075d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0060c50ce213db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6D36C61-7FD4-11EF-A1D0-5EE01BAFE073} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433935686"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2892	2640	iexplore.exe	30
PID 2640 wrote to memory of 2892	2640	iexplore.exe	30
PID 2640 wrote to memory of 2892	2640	iexplore.exe	30
PID 2640 wrote to memory of 2892	2640	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05326323a9e6fddd484376499c729ecc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
414e6a556f4fec8c5e61c372fe6778f8

SHA1
df927142b7a5da0687a3a392cea24b4dcd679388

SHA256
64941cace872a7a6fc74c61d9f44f84722e423a27c814f1782c518c0a5c5d26c

SHA512
c0c5949c4c3301590a006ef31191479deb2522c4d0adccdbcaaaa11e6c00537d6902bd3d44ae7b869c3dc5534090eae5b8cf1b562544c75ada5bdeaea4d67272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43cb8c7f763c8da16269ebe955df6759

SHA1
762631818753afe251791e5d298cd1f0b47923e0

SHA256
d77927704eb5de2d92ca4bf9700f4a7739a522d6882e00eaed335e0a00820c77

SHA512
fd78da13d857ffe4ee7bcd832e826af134802a1921f5eb2b2a753381ddaafb24206c1862edd46697e4703164be5b4e895fe7235fb7c6c45378f96cfa4bd61840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6d51f689763574883df623cec524e79

SHA1
3a7d17cd25d9d98640bc953b5ca0ad183b400f7f

SHA256
e38e0db1355959f530ce2dd03de76ecb8a30085e62774e9e61bbdcbe692d3d26

SHA512
53d255c733b7144cf4ca50270e847402711bc3b65c0ebd9109ef857209967b499d96dabfc2cd701046776876e7569f0d457932bea92b3b5a0e74ad96608338f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cb427bde1df9b798b0168994752fbc9

SHA1
fc6261c268a839b625dfe8faebd492ef1cd93a27

SHA256
42ec2fcf3fd69fea4d3b61971a7c25c6a5a1095eff221911c472214f643e5dda

SHA512
7dcecb72424a20ccd2e830486fb59f06d44d4c57c8a7f8f77b5679a994baf779673a006cd0d90692a8f312965e9afb4378502ab0feaddbcd0c31dfee5164be05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c52359067a8c88cb38f54fc45a76f619

SHA1
f3915264389d68091c86f436506901613c71be5f

SHA256
632287eb2b1e823cca6d2f09eed4fa888105c2711abf2c3be06f0d1c39241107

SHA512
91822d7967cc1695234736d987aeff06cbc34ee9559b1bafde086fe47f4c10ef695d8fc4ca2453067c929cc7d4c1626f97f78a5439a9f6659c1f0108e17f035e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6391d2de55a098dfd856defd80c3098b

SHA1
ea3bdbb7bb8f62b03efba8857b4c14294c3ff6af

SHA256
279ae6a6c7718c33bb29e034ab0ca25f38acd910217cb610e8f5c34d148fd642

SHA512
8f86e97002be732e410856edf0cd9acf169151724e59bfd3a9b3b3c557f5252bc87e3dc707b92481495e0edc6eeff2eb2e98d76f6e46ed59e6d57adbb55df19a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6d4d168611d3756fa8f2fc3b0d3eb8c

SHA1
97b15aa627ad5fd848364d4273362ac84cf14954

SHA256
1916c2050d01b13e3516b87938f5b1956f4662d0d67268d720c81bb5f42f903e

SHA512
855c7f3b2e1e769712d3549b95224261231ace389a385d6143b9a11e9d1123c754df1b4592fcf2a356f1f3fdb77502f9cc8e10b802a1bdd54f49db12348755a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85a4c9f87f220532bb8882b76cd96f7c

SHA1
545614894e5721783e60fbd819417f198edbe6c8

SHA256
21d268a75fe31c288288a918cb859b1439007c548a68518237c3c1049c9f763e

SHA512
96654ee12ee14bf1b720ef283f299040e95fd7ee0850e2829ba034a55ce465da48e94864ceb873f44b9291b06300c0b76628478d697d510587e11aea3ed1b016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5f0b860c807cff63ca2831580a099e7

SHA1
3c7a3219eba67fb79ef524821221d1f40183f6a5

SHA256
e069bedbd88fb5457bed8b69c07f394248f6f1ec6d492cd189d816f35324ddf9

SHA512
d58669426a07e044ca21cc2a24e9e932fdb1cb7cd52753e888eba88bb2b8e7836ba4b2cbfc467dc82df3a51b356401ebd66a0dce4e5459b7f3db4d982be44f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6583892df2d7743a2902e57a4b772b1b

SHA1
5d775c605662806479f8dce7851c0525e50cf682

SHA256
74d0a1ccae4a750957f7624f6188b5cdac4943f215d797d8a6d72df216142eba

SHA512
f613ba185e81a15882262ec12b40bbb4d9d49dfc6f423fa8d5c4355cf6e2b002fd7b6fe461d453c0dded22d8823eaedf50e8fe9a31594ec1ea87fa686a5d3a97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4911.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar49D1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit