f72dcfd8baab6cf4e1743d2685bd77a7e9752a0afe5d9250188a594dc0133b0e

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27d9f813121b4bdabb95caac58d86f34_JaffaCakes118.html
Size

6KB
MD5

27d9f813121b4bdabb95caac58d86f34
SHA1

0e59ffa78ba740efc3090c89197b2a3749d0a338
SHA256

f72dcfd8baab6cf4e1743d2685bd77a7e9752a0afe5d9250188a594dc0133b0e
SHA512

53e71b863fc170571b62f6956015a0dd9c3b5e18a05fd3aef8c9690ba8e6f5c373081f0a3ddebd0a4ff58770b146d7116e8fb4085522471d38d861c4b0628d3c
SSDEEP

96:IfF/u9PQbN+6a2FYNUhhG2poQJe/tJ22Wlftc3HjITyT/WemK:Is9PQbNPa2uNUh5hJALVWlF2jIWT/W3K

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fa34db7e55ab7e4c8ec5d2a66dd63095000000000200000000001066000000010000200000007bfb1e3195c610dcb0f79d79f6b4fdb664fde9109b3a1387a650389678c783d8000000000e8000000002000020000000170cf79b132752573b4bc7f554c3f2c5b2f830460119390cbfb654b7367e5c61900000003da06c9ec79beb412c93ae07a14b485fd1278632da1cc07b0ef4388490d2e71447f30bd20bc13b62322ba586fce4f6b842b51e1e2309588bace538a74b1d3b1cbf38c7eb721c3758839ad9fd54fc61d93e78542a372b3e42dedda1c0e024f645225ef3fb1a6f9c25f0b368c1d9c5426c984f4a98226baf64141de46d2b1bebf92489d7a709ab5ebd55a0738189c37e0a40000000d8610ae8d6d5ecd86f214bc4075a0b46bc18c7c2f0f8e1aff2304babce8d4d8aae973d589a51d0694ac3ee401ff4916f3bee0c8645784e4cc161c9f757f929ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7172E841-8612-11EF-A748-EEF6AC92610E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401aea451f1adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fa34db7e55ab7e4c8ec5d2a66dd630950000000002000000000010660000000100002000000065fdda8a4f38b715dcf2ae9b62390723fa844c64c310691dfa3e1198dde77eeb000000000e80000000020000200000006ab9d83a0af5d61823163b7beeca59ef92e238fae834f904508fed9b16f2773a2000000078c28fc3a6ee73d0ab6c834637952f149b8d415d0a9d90c4a1fd5836c6e1161f4000000026d37694c1051895e2a895ed7fa39d980ef15c299fc995072b177478dbb8be0578b6a5a6f9ed12ef7f940e6e904e77759cb3bb75dd4109665ff09d7e95c88245	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434621791"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2136	iexplore.exe
2136	iexplore.exe
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE
1352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1352	2136	iexplore.exe	30
PID 2136 wrote to memory of 1352	2136	iexplore.exe	30
PID 2136 wrote to memory of 1352	2136	iexplore.exe	30
PID 2136 wrote to memory of 1352	2136	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27d9f813121b4bdabb95caac58d86f34_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d71808267b3995e44bf4a2078f741cd

SHA1
b8729382ed253c831d3904e5290fc7e8858e9262

SHA256
b1c47571a3825610b96253b89d1e913a0278cf268a1075b65b7daab074e6f714

SHA512
74eddb06d447e13377b262ebba45f517b68b2eaffbcb509b554763345749f8f97e205a2299d61737b0cf43e35ae2103017f67f4b6bf8947aad6a8ad0a97244af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
613c79b2cc14475025526527ca6ee3d6

SHA1
4a8443ab8a0e8c37249c9cc045d735701ab9a3eb

SHA256
9654e63acc7fbfbb87282be1e7431bb292d282690ab5949b3983f873bc68af36

SHA512
993dcec82acf9ff9e27e32f443c070eb8398b871efcba65c4ea2eb5e3abbb274a1dd9c386a8910e9e0d439e204f1e3d663d16edcf1acfb8ce1079485d1974e9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
156510e5cd641302d5d9b43d1f8f389c

SHA1
dd8ab014480d6c19b1a6c44f4b97114e38a2db4e

SHA256
b830d3eaa9eae93a7e600d1de92a6eaad2923b0a435659873c2ecbc9d109a06c

SHA512
13b049b046dc9f4994adbe63cca93d6efd7b7901512ae31e10eb67ad1c894a064e99fce86a6231f90d224de6d85ab4b00d1bb90ea21991b9b6efab86a4a340fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21b48fc54d382f4399f16e99318712ed

SHA1
95c5f97063380f9949299ff7f4719801e9651012

SHA256
9350f3ac70a23983b344444889379245a6fff70ce5836e600306d63bb4cf4acb

SHA512
fc9961250addb8e0356a66c6dcd6fb15cf1cde348eacaf30dd748ae253470c1a0fdd6b68e1861eb6e517241a9a53a8d4d9d3a2e7bd9ec2cba5e077ccb73a93b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caa4f8f0161162773547a8a71c92944b

SHA1
b129a89c86967ad21d13f56177fcd8359686266c

SHA256
fba09b4ea72ba603560306c9cd200247f21423c34bd3924bff59f0741f82ef8f

SHA512
031cd596cfc2ebddd0158d739622c3835aad33a2c4ae7b396065f99bcc361f680708f2142a109e6df7697254a32c29a547419e37427720e94ccf428441ab0b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16f862835c3d85eb4c206b73143febc6

SHA1
917ee0284e5b1cd927cb8b9bd5ae53616aeaf1bb

SHA256
0ac5c2a011b1dc093ba91e91d898137e4f509997f82855fc1b06ddcecd970ce5

SHA512
28ffde3ff537b435e425672e15e04201a4c55be29040621d732a44b1b4d28c3b2138e67bf08523b8934c1f0194e3e889b7cf615d6cce95b9adc2d81280801fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87d4acbbb6da894612b06a32cf353a73

SHA1
a558b4b74dcddf606a2fcd8b7795065de7f46449

SHA256
d9fb2f46430de169f4d63237230e39f16a388c2c053bfd691551c071dc325467

SHA512
9531edeb4cad547a3df049839fa1090cf65433e5faeeb6c0a00d9889d54a04de972637b39cda8c9c9e88cb9227e0e0cd1d5f5999f9ef1179fd84703c8d09f77d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e220b1f0c3dc9871cb915a385e5ea4be

SHA1
a976949bdfcde82fabc5422b1f2f885a7b90dbcb

SHA256
3d8c1cdd5e0b0ca486b5f5167216550cf4b3683ab94b340804d44ac7d962c2fd

SHA512
98ec626fb842c409f2ca6c614fff57c5af52801778d9642a5908ee07f90c10f93331c1c8f8e653d66fba2278db25047d4f297c8e74050c58dae451767ad9ae35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbbbaa6b284522d3f6c2cac0d9f813c9

SHA1
7c49e40b89c7ab062f1d5a84f340e08bcf24421a

SHA256
051d71c8626c8afc989a4e9a54380039076b9ce9b54cd9c618899fcafc07cecd

SHA512
97eaf292c40ac04eb4f6f04be6f573874bdc1abe6f5743902eff2d8bec20c72af39cc3b5d724172d86962ff9d161a85e3e2e0fb87b0b417164471a48a312b9cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
767016eb5454dc880b351e02a92cb093

SHA1
d9c110f193106973953c9fce034b53c9036648ab

SHA256
ef44d7feab312f44a83af5b1a1b8fea1ffee771b3f86063ef894daca923e4da2

SHA512
1a5a133b79ba191c3a6a812adfe581de62d7ac19fb05fe80c5ab5e078193d050b8bd3264f67ac92be96ce42cf30767708db3c655c0bf8bc4e372c9f975340a2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a1b4d713a70803a6586337b6d886562

SHA1
0707a0858d16147653b6c5b888b8295f6a06f1c5

SHA256
71507993530f35193c8afd6503999d3cf3d3116631a214965ea6d6ed5c87f230

SHA512
6c34bf896ea8a3881b6d78cafe25c1a279b59802a205783c439d42e53a42ea13872720f08253c38588c952e47db57728ff148d1c49e8603e58e8293139a5cbb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE84E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE90E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit