4e169915816931f57d2c3a70dc2e939d2622d0cc9366ffea4c44292b4f95a8b2

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 01:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0842d2c294ed6dda2427f20ab6c1e57c_JaffaCakes118.html
Size

119KB
MD5

0842d2c294ed6dda2427f20ab6c1e57c
SHA1

a402e1dcb5ce6b9004935e0fc61c22d81b83e128
SHA256

4e169915816931f57d2c3a70dc2e939d2622d0cc9366ffea4c44292b4f95a8b2
SHA512

4cfdd551e9d99e013a8e45160d5ed76d7aaf3b0d2f82dd772e6bb7d6d702c96a279c686a128a3ea55d7b6b447ad93eee617f09cbbca9d17d7713c039efbe740b
SSDEEP

1536:SWryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:SWryfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000c7be0acf3e83f431164d6db6f3c51d7c2430e5e79678b746c4cd04a4a7dbfaad000000000e8000000002000020000000af473e4c4d559928271128e1dfbc3d53ef4a32b775e4a706200057df39d607b220000000a3c2b041d70de589758f784f06c6f15ac0a01c63432dfc91bfe122af95977e7240000000cdd0e3cdab93f54d71876b3861f2d9c5f23eead232d91bd926b70adb192136d2ecb8509d84374d203f7e6a8603ca28b12db637162e54c134cf7bd9f92fbb8288	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433994525"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F934F531-805D-11EF-8E54-C2CBA339777F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b3b9cd6a14db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000b0d208887d82545bdf1eaa98557df8063e83d371504253b0a75d05cab22886b6000000000e8000000002000020000000f2501df34ca1450b1626b33329481013fbb629ce14c36b4b40e6ce89b0404a4a90000000391a633767191957eec6cbb7e74816168720a156df211c67d49b0df46c09182d28906bd2574b3f113271201f030b6169244f01c2fa119da7d7cc79b13a7e4f54201890c64bc39473754c6a7b8ced3ba6d9839c2f620609137df9bbd4d12e55ec68015f95279ff71661a62ba1ff89899d8c2fc577cf615ea8bf293c227e712cc60306f551462838797ec4752a6417285540000000da53a641d770c0da758f57f7dce033a863af4425fc30a8e4000728292fbe8b33011cbfe437179b9138a615b35a66791f1ce0f9691d8b8a6c400cb6611d362c8b	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1884	iexplore.exe
1884	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2788	1884	iexplore.exe	30
PID 1884 wrote to memory of 2788	1884	iexplore.exe	30
PID 1884 wrote to memory of 2788	1884	iexplore.exe	30
PID 1884 wrote to memory of 2788	1884	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0842d2c294ed6dda2427f20ab6c1e57c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
265ba002f55e48a73b2e8d7c3fde4d16

SHA1
4a02391f83387e70d035bd7df3616340eb252b40

SHA256
fa4cb69fcd912bcb99d97c7138469fb5bece63abba097a5881a7d8577ad6a60b

SHA512
778361b1693234f388eaee3b5b7de3d19b1c7c28757e747c3fa9853e5d989e280249a2bcd81fba3303030578e89c25cf93805c80905c49c7832378bee6eb678d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed30ed37037dda9ccb100fb2020737bb

SHA1
e0ec15273abc5a3b91816350497a9f84e1668cf7

SHA256
b52769a29ca6f44cccb44274996e2d82819f35a318d8ec4db3760d82c8c57847

SHA512
90efa33f4142217ce1c111908ae5fb1d7fefc1da36904564fb2a969693c70252443f5d3b48a21212934810c688b8ef9c2be9cce42c7380a7c200c37d4a7c1b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc5426a5e787b26f6ac4399dea795d86

SHA1
97f2f85c79c7bd20f6f81017970ec6d80046b354

SHA256
b1d903bff50b83a4713da55ae545db3f361ee6e4492189f17dbbbe8e762d1742

SHA512
01b966e965b1870fe5932c97f7e2785dc9fc94c32d643199b2a20e3001f6abc3accf9713550994abbc2bf0971e7820592a5ad56308602d4573a2ccf4cc189900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f86ff66cce527d02167d8d1e9fb2e69

SHA1
332fcc9aa6060e598213ad21f83ceef3c7562ff3

SHA256
a12947c68487cecd116ad4a1068b5a292f43b2b2e098d11fc0d05a5322cf7c9f

SHA512
7e2d56c8885f7436d272512ea21b4043d3426e284f56aa9a175b117278485f2fcf9368433a2dd96f5faa7a88191ff915e9631b0df3885adf829f56e664a7ad0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54c8f56bc822f12c336d06580c07f0eb

SHA1
6f58d06d177e0c1fde6c4a1563c70ddffc73e061

SHA256
b5a7e0da1fc936440396e3c44499d0cf377399d7eb5020d7372c383fc6888484

SHA512
225fd980d5f360459706505226cb57a97fc0da6729aba11648225c7438da4fea12a76bfc6ccb5d3f902aba9f1617352eb801ac37ebc3f046bef3b622800bec9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58ff53e625a42117e37a8454d8f48783

SHA1
7ab326104812578ac623085c45ae07c66eb6b9dd

SHA256
a046e0c7707ed5202df1145a648875883ab22760aa2b4fdc3ccff5cae3c8111b

SHA512
e886ce588f1dbab34ae87b4c9c8c5a28f0293eb8d02394bbf745f4301310f64c639f735fd0fa8c2da041ee9d99375da280a12af053c5ee3cb6cf67d5b7653486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8661df05137ac58bba2706056fc8a88

SHA1
7054fb7c6b47727993bc1582f7486922e16a837e

SHA256
46ba20271f19eb45f7079a2b24b6e484fc84abe6ea51e51dd883485b48580ac3

SHA512
2bfa6aef914344268684fcb620f9bed252654b3017b73e3d09609eebcb73d4d0b1f69b6e897db094cdc10918aea92d35074cb34dfb4afabafa87f054ba386195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
189f997b8a266b39db26745e548f2dee

SHA1
82c4cf0cda1a135d873c808125567963385a499b

SHA256
c8d9061d5d7af67d62fe63a6700c2ce45aad29e805bd8564d1bddd23562cae43

SHA512
2b1f2598f951073e7f1b1f26d0de09a8f6fd7d0173d87ff608fcd1a17060d1be5e29600735c91c2c42cb3bc06c62d672f78a8b9114a29c9bac2152648485bdf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
686317be09ca2daf7aa536968e8f103d

SHA1
f5c9a5127d80725ae42855be810b42428d1a3b24

SHA256
f6a80e0cd335d699ff5fb1c965d5ce083c4e309b07c477d5750ecdc8190746bb

SHA512
7682e74626e426adfac04e20bf7361eb5599952c783fb2072b1f802fec6088d19ddcf3d2a6d8211b1bc64eb9a720181929c66b262af5032b2a53a52e7c9e2c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08ab6abf0eb42d6da573c57d70ed391a

SHA1
36746078a39c4a4803f65b98cc0861e4e400a621

SHA256
5d7567b9f766a6eff185f8de03f60c64d489bf4a6d0cfc92ecc60b7e90b4cf19

SHA512
f46fa7999f2a4057b3b37dbd9e66aa0ed9d0ddb1aca31de026b0dd45fb0cdfc28c6dbdd81deda61caeed997d660237fab6919e6c0c92987d64a7a3f186ca7f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab41F3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4273.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit