66473c327942c960f24ce1a4a1925971a1aca98e2055fbb17f4a83e718f13c20

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

274d85ff3bcb09517b343e59b061f7fa_JaffaCakes118.html
Size

19KB
MD5

274d85ff3bcb09517b343e59b061f7fa
SHA1

d0b3d1bc4d9d47a73f7750b1d1f3cea37e271b41
SHA256

66473c327942c960f24ce1a4a1925971a1aca98e2055fbb17f4a83e718f13c20
SHA512

89ca47731834af797aecb3c634c63ee051e9fd66cb7958966c3cb09387c523f2f4d9af694d260425818dc81671a6f4c2ebb132443f9c3a5b1a13be9828864607
SSDEEP

384:4+QfPFd9QZBC7mOdMw4tKfpC5IgSnbmFe7AcN8645LAPd:Zcd9QZBC7mOdMwBpC5I9nC4jPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F1621C1-860B-11EF-8318-F2DF7204BD4F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000a5c95cfc50222121c9e053df361ed963af22a8f26b24fc46ae014fc2fe3bfe64000000000e800000000200002000000089536d4f4d7b35e7e20bb4c7bae67968f523bd34671899bb249587e5abf35bf590000000c3dffaf49cf28e8da362e8d04d7914be5af1477bc357dde58dd95b9bcf36fc03d29e4fec8685088a4c63a2454fd246c25144644b6cc3830930b8bb5aa6d8523bcd96d240c6e009150b85df7833bb577d10a9521578fc97d12a32b7c812808473a24382c9f51bd11cb5a11fe886526cf2fd9c7a0fbd5f354a71448e80d3dbbd15a4c2fafe60047584a51f083e75b563e440000000ac7543ffff662caff6118886cab6fd93dbf1103f0f6eb85ffc396c0aa736c38bf3ce9a272948244997e1b4d9ebc7f5a58d4ba56e153b2acfa5e4b070ef5f79cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e6a414181adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000351976bc18ec3e77a217d6197fa1a2f4311c200d7f9494fb58326fd0c1a6ea2c000000000e8000000002000020000000c31f45cfc92996d1bb710936144683988df88ae42cf40b5f78ee555cf10bed4120000000fbc9c463b1ddd2af251e596cf7404e09cc763ab7d2e0c3e10e0544b6d1671ece400000009d0f0f80c8ef0253fb0353839c3fa890e1770d6cbf217460fa3d3620a3b87b8417adc3d22a30895b134b8e703fc81c980a497df9ee6ad8c9d5101dbccd643832	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434618713"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2892	iexplore.exe
2892	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2804	2892	iexplore.exe	30
PID 2892 wrote to memory of 2804	2892	iexplore.exe	30
PID 2892 wrote to memory of 2804	2892	iexplore.exe	30
PID 2892 wrote to memory of 2804	2892	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\274d85ff3bcb09517b343e59b061f7fa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2892 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f254f2091a556d821c08316d705d6f0

SHA1
3638d3c6bae49c32d83c7058c2a6e7b228103115

SHA256
7ad24a9504ec69b2b65f0ca804cf65b3f7472502a7d907c4278d29801b4376cd

SHA512
85863fbe74aed9a580b8153655dc924ee0c81a7885d4dca549df15ed8f0666bb3923ec6d8b94a3e70c414b6e1fc6edd100b0719d7793671a243d11f7b51a9858

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d279065e648cc74ac5943d663fd41f1d

SHA1
335a568cda103f66460b42d7d6742a5929ed24d5

SHA256
2156b7f3ebd2a64e283fdf0be3cc4137473af067ea73dc3ae308b317f24378cf

SHA512
49f3e3fd0a6bbbddc9cc8a09ac5f1c696b4d4cb813f627650a8df594f45ae6bfe686c17687b0e95e73da63483ce03a08fd0c6691da36b1be9548e16eb2af906e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d0112e0432c482953de282de6fc2ff8

SHA1
97a5950eeda3cccafe2cb011a09ce670a768a249

SHA256
1d1bcec512da74a85049ba64e53d690a7b40d2ee347c71c0227ecc07774534fd

SHA512
8633d48c529240ef97ab61a038be75c83c9c0b2439e08871612eaac02461d9599032ca09fd53e60d707607602a17b70c143640b350ac01d120198e25e75d18ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bc3e397858adcb9ae470a61387c841e

SHA1
23eef8b964e558a3078400c01dd2680d59bd6133

SHA256
f99329515364c103e8c673ffb2f6c3f7c0ec149a3a8b4ba685d12d874c4e6ad0

SHA512
e98b829f6ea1f923468b77e29db6b21755a5cb0e1bdadc8abd271075596730039e445b19185bf8741e3173f4cdaee286c17c24aae9fa77e292c00530dccc26e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
048a62b2428e69d9748c05f75a8384c3

SHA1
eec9be653241368288cc3d3cf15ad9fa1ecf092f

SHA256
e9426e03e6d9d4e196f62b0a40c2226912e6ffe1d9a7487dd9d927ebecb11b69

SHA512
188f65f3245924bd89124743a4cfb05beed8d0a664daea82fc295b6f40a21e85c4d51cca8259ae4f3b0724fd2a484d32500372d4537e55470480543496c4979c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
263cf2dc7729746fbd03ed3b405754ac

SHA1
d381f6e504a9a562250d42c56cf386f7a3d69afb

SHA256
4ca1fad5da8dc431aa4ea065d2582cd75205d32f8dd8bc1b034c30dac11d654f

SHA512
4a35a39eac1a8d75c6268802b752d893647af6807049bf635ec0edc5726c0326a3f5bda5dd51b4382ece6aa01daeec589ef5227aa4957edfe55e08144a895fe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
174f55b627359cc7379f8829b5041f0c

SHA1
66e4bd37dcc31ceff1c9359182538c1fe71ab2d5

SHA256
648410f7eef01aa9ff320f1d5436089ce17535c5e932d3acf1d1a86dad04ddc0

SHA512
9ac13d73765229d3d9f372af12c3eb71de2eacb79cf3f6da03c026bf083dcd1f0b00746a166fec9b1dd5578affa1bb7a37d8326c40d26bd6dad7dc7058965957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f07ee62a98276afb4fc499d3c03c60c

SHA1
5c7904722f1e3c96fa43d2813467b738aac92d8e

SHA256
887078b9f393e77bdfda9ac84e19d68f060810b9a96913d63ace4884e6949060

SHA512
094ae5d809b423396ccbbc881056b821072bee26744e52418018b9d1ce96f527a2171ef4cd2748bb0a36c8ccb61e66a567143c05a5b346acb9aeade15e22239a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bf153f89f9a413e4148f9b5bb374554

SHA1
31dfd1ba28174fefd9db07e108141475b8c92521

SHA256
5c5741e5bb12254a9fbd954642eab01690c47feb4aa0c14d9bbaea64a1205614

SHA512
a7b119793b6c70a6d47da2def043e4a1946d2168c742e7cf46d279cb803ae8e7aa68fe969339a8eb720e04531751732a8f3096d9e383724a8fdf1c1c6ff8b6ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d22791e834c603dbd4a920c287507360

SHA1
d5650fc3d6c0015ea36f1f38f373716f2a0588d5

SHA256
785740f56c9da3c768f38eb3e4e06ad60507ce7a87e74fa686cccef6f4538eae

SHA512
05c8e1b6dde8804e09bf91b1ca10abef44108b8d1e33cdc42b236d7110438c3d4d0c10f3ff75de35d3c47625ae657eacd28b4d95b73f0e3a2d332b50bb7befe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd995d6bb384602cbf3e4d4a7bbbcc3a

SHA1
f76393fc7db88e257baae88689c02936b5174373

SHA256
5aa42f5020db12a0c196b080b1037b180f84f4977bc5e93d42fea08a2c7d9c25

SHA512
dae708b8ef745704720d2a3d3f6f1602619db505f6487b5e3e8d2b06503e871c27b73cb3783b14caca6d3f097fc1267c6cad2fd2167cf5358029e52c1c25b8d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3d885919ca0d0487aa4e9054f287002

SHA1
110b93e8be494e9ea2f636c16e4c6c21074bf076

SHA256
c411300e45116cd642115e29ed5b2146ec6a255275c8e30a0700dcf384566f7d

SHA512
9d8b5cc048ea843a1b5e0a5ee9cf5059933865e42ad7c29bc50b9afbb85f23caa67fef97984773b5743897615e98eb92609aec831a5bc3a878eafd5717307ede

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab92E0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9331.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit