9bc593622ad6a58a0b78f1f6f0da0291f54c5732df0b614e2e6f7d3f38183a14

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 06:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2cc7e81e83ba5ded6023581f478477ae_JaffaCakes118.html
Size

7KB
MD5

2cc7e81e83ba5ded6023581f478477ae
SHA1

f32387ca8ff8639115056825e1d8e467f5fdfd7e
SHA256

9bc593622ad6a58a0b78f1f6f0da0291f54c5732df0b614e2e6f7d3f38183a14
SHA512

a7e083971330631083defdd4f2865aabc68579426c5d528f2b2f25e3c1a1d14971703052bc8f419a40385e0c2a371040866e07ece5a7cee300c795c45722de6c
SSDEEP

96:uzVs+ux7u6iLLY1k9o84d12ef7CSTUezfCwdxCDdCCpdACcdScEZ7ru7f:csz7u6iAYS/qOQZ/jZaSb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434658977"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000c7d1f9f1957d8a4ccee449c745ad5bcb4a36a5168ee9f048c996d2743bfb77ad000000000e8000000002000020000000fe4be6562568994d705e605ac32d91b19c6c6a07346c35ea4ed8f5a5d0bbbeab20000000d9a1751a32a8ad14cb283ff91091b564aedacf87e356f3c3815ef3242cdda7c74000000009739108f0a54644a875ddabfc52c56107b6201fb5cf1c6ae5bd0071fb19ee35df192dacd8954536a326e450880b2be517f2c5d09b4186e074ff8d40b306d7c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000023e0ebd44f670eda3e9898a15577bbac8da2b2baf4efa7503b6130dd9b9a0b7a000000000e8000000002000020000000b4c7e4b52aca085caeb44db1ae24d062f6bb0eb4389fcdcadc91bf140f31151890000000ab34299d07c3a0e300a1111660a8345eee2c50c4113532341def565d9f186c7b164cd24c28717ae3a4443e28091d845cfb7ca003a5fab31d20b0f1e7ac1978a32830286629750220e4893ab4136940674854c41f6d6f4b9757b1505ec50627d17eeefc5657d43c56ecc516f98dc24ec18d0b3764e8dbfa811782255b57e8a08a44c153feafd60f8918d641809e653c274000000001117a7f8a646e8b16a13b2b3e6238b75e87f0b10c8ffe8715838b96ad91411b48ed0cb977205323a89f0099265fbaa4e5a488e2af1a4e75a01e81809e8a8e9e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01E57E01-8669-11EF-9B14-7ED3796B1EC0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e878d8751adb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	iexplore.exe
2888	iexplore.exe
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1344	2888	iexplore.exe	31
PID 2888 wrote to memory of 1344	2888	iexplore.exe	31
PID 2888 wrote to memory of 1344	2888	iexplore.exe	31
PID 2888 wrote to memory of 1344	2888	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cc7e81e83ba5ded6023581f478477ae_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3abe2109551af44995321a5e0c1cded1

SHA1
445a3910cc431bb2a6e2fc9600eb1bfcd5ca1d4c

SHA256
58dc57a9bd9b2ffd60db344b0d8679e1e52bcbc0d3eb49d5ed87d15a63ca7f8c

SHA512
e59944f1321d1602658ffb3dc50a0b7109c9022d56f51b15c919268b10a36dcb536f06071d5953597342c7fda8a0818b410d33cd7edc01e58f7c7cdeeddf4154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0f6b487042a37ec2ae0bce583f237af

SHA1
9e44324a20919c5289b2875234bbd14dbc90b4e5

SHA256
ef6858363ca9e33b4f7249e01313b541b23a5153cd2d9d9d078ee672770adced

SHA512
1d32db1fd7f77e2719d64aedf7c9376d2658364cdc86f97a47b568e0cb31095b6660451539f560c875d0c3e57b1efe8d15411d91eafec851cc5fd455ea83716a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b13c057adb6c5c7c93ff035c9a523a5

SHA1
cbe47053a1a2744c373af1ac082954a7c8f3c1ae

SHA256
96c68c23187e3ea2232df8c0526fec11c97c7d11573358861c5388b9f3192f83

SHA512
0b6b3810eb91cf1181305d65be2a3247712c523fe8d36c99bad5a24d3abfc88d63ccb844f327976b4930db7f644e8b38ac3595c7c85b5f6146424ba064fa76cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06c69fc04e27810877ce5ca647dc125e

SHA1
73a5dd32e2a69e0ec5ab86ae49eda0ba275a0bc6

SHA256
59d821153ff4075334b77d74eb4628989adf2be79fcd30ddae27632f6e5e8fdf

SHA512
97b123b9caff0e046ba1f69fec34b38ea38325fcb8a5984bbd349cfcdfa40dc15c6e8009c37890e6fd7b8cf3d52f1cc355e73916ad4303a5d9d5a9e2d2f3cfec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5322e0841dbee31dc654ddd141381fb2

SHA1
ac44345bb9cad2967f752557099952a58f919588

SHA256
18750e8d306e8863929150628df061c8a086fefc88f4b58a81705f07729412ce

SHA512
a6edc2f3af68c661ee203bb22215453573af6f5911546334b5aae79477f37faa615c24a0bca588603db736ec3e727af173ce71bf1315a7bc3c90056d1c9e2ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c76741c5db8fd753441af91bef6c0486

SHA1
37a09482fdfd0bd1294054a8522a737c40070745

SHA256
c802d70710a7005581daac64714dc7708bbc5046b4aa33f2427f0f6b2c2680d4

SHA512
48e76a7af74dad332f07df68c7e81939edcc9b759df55b63f1dcd53b956d976c12ca4732f00a85dbce43d05438fc80d9f5262cd0a1a02de5237c9555958c2d47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43cf324423d10a3c86867bd3de97268e

SHA1
3138735f6a403348d6dac61d45086d4ec7e70831

SHA256
5aee5b2bd4bbc6f440a9a9377be180afed1df0482503e869a939aa5ffa5aa02b

SHA512
8043bd85e901bd25499af05b2490a2ddab3905180eb188b2fa072f7d55d6a371e648fe14398f411bdafb5fa3cad0b08e8f5f97874c74c62ddb5367d52eb7e9eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
304e215fd96e7508c6568353bc7b990a

SHA1
3ecdb8137c13ffa975a8e543b9e0ed2e0c1e3139

SHA256
210ddfcad8474c3cd2036704444bdecaace57bb73a703f62f0a57c2680c66a97

SHA512
c6b22a0fb76245e59bd205554e4eb54909c2087c06d57103226b9498700b8de27c82a3abab6555b6daf85cc7c782dd0209b87b99f2c5a255e5b9221276d8b865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbcc2e2b699d32f2dd3f835ce32257e3

SHA1
d2b257a8548d3b9e872c175097addfa26d9c9cfa

SHA256
49b373462c46ca14653be5bf819394ac16478e72ed52a686a1da02d56154828b

SHA512
9b8b23aa6d7f18341b255196565b67b5434189ca8fc68d0183c79d28134d176cafdf9505117969ad820b7e62b252284910950f69a9e7020a2a3782a51e8e6ca6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit