7aaa6a22c5a89d6bd1830bcf8d35ff53aa44f8702ba9cd9f8c691ec82121aa64

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cd940b12e43251fa10e18cbdec02578_JaffaCakes118.html
Size

58KB
MD5

2cd940b12e43251fa10e18cbdec02578
SHA1

196731fce29b5f76a26b3989fe3a725d3cc3e67e
SHA256

7aaa6a22c5a89d6bd1830bcf8d35ff53aa44f8702ba9cd9f8c691ec82121aa64
SHA512

adbac861e096bf27c620189cdf77655839509e4f7ddee0785fed1516af9a7455183e70982c5d4ddbfd7811bf5f88fd8fb6773bd737b82f495bb2ed65d7af1cda
SSDEEP

1536:gQZBCCOde0IxCN3SRf6fcf4f6fzfEfifFfhfzfTfXfkfcfAfRfXWfVfQfUfpfofF:gk2w0IxXi0gi7MKN5rrPsEYJO9IcRgpL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000b4b38329424361e2f99b603344273347aacd2407e0bceb9c24e7e0985a73e1d0000000000e8000000002000020000000cf631ad176f37a2018135d3bc772cb90b4ab1774d3c53e3490816cfcdf9ee60c90000000d08aa956f557a67edd1b4540eebc13ef0100e14c6d203496839aea73e2904d47e8fa37e5059203fd6cb362e6f686d593c130bb5d1869c9e619552cc5964cb5aae2aa066b9511a358bc5dc6b0229b3ff19bf69dc32482a1f347ebd3f7811aaa8ca73f57e93c1979565a0f2ba7edf9797f54efd4e2b72f93f20a86377694f3fd2dd24e4a7988141c022ede42b05e745fc940000000ee8709bcf2ace12077705be391e17a0f9e3c4fc77437e6dcae67e7e18a31c0faaf9b4b5f5a982290357d2c94cd545f71027a4ea293673691e8a5e9a9b23a5cfe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FEED4CA1-8668-11EF-833B-EE9D5ADBD8E3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f006cbd5751adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434658975"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000409c1b3776c05730e5ee6d66d12e2e667d0220cf6f037c107fd354ef5bf43fae000000000e80000000020000200000007033006c153f566aea68b03db09965adebdfdce36e36f3c83f7e5e81c1785077200000007a0f7e5bc6ca064c7bbab721f5bc61c1694c3a705ce27d2c4680bfe93cf7747a400000003e64c30439a3baaba5b32c06e0af2ef5b151b3d3ba9de6158104989e61133c750d19a5b9443aec706975bf5a04daceaf6f88e66203e381b5a0ef5111896526b7	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2196	2216	iexplore.exe	30
PID 2216 wrote to memory of 2196	2216	iexplore.exe	30
PID 2216 wrote to memory of 2196	2216	iexplore.exe	30
PID 2216 wrote to memory of 2196	2216	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cd940b12e43251fa10e18cbdec02578_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c571f16babd548a055bc20502a4d1cc9

SHA1
abbae4e1a1a63e9e91f07d25237a2990848dc4fa

SHA256
419b515e6302b5a96b89d725599bf8e43ada1eff45c463e17769b6a4235336c7

SHA512
cb7dd7e8e2ad3693fa3298cde1af33543e54b17c6e6dcc0e0f016bb5fa89390ba1c5ed7646847fe5d83a4ea3b7be4f8397d7223952284e2e4f8dc48d6928d602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8534a4987d6c5cd4d3af5639856cbfd

SHA1
99fa98637828718c37ab135dd4e38013857046d3

SHA256
2479cd41382c752c0a4b890c1089471c08cf8b0331961b59ec82fb249cc279a6

SHA512
ad332b418d570fd52af638f8aeb30a900a46c088e25fbe19d30da3dc5a9426229db02f6edc4c9d72e04a0f2b900b14296187e444be94db6888b976951184e0c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2003d5c841bc9fd56ce93b1b75d7bff2

SHA1
ca14aa99cd04269971ef58f307c1d92d74364331

SHA256
5cf30e80e29835cf577b394c8b2f5950624ed7be73e249298437c28499d480f1

SHA512
bc1799a8e10da0174dca88160c8cbc50ee7f215180385841e00045b862daf8bc0e0ff619e1e0d343e83494fc5101344f94e8e100e61471b84eb628df96b00bf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
160c839f44d62f936f7586f42f5c5ca2

SHA1
8e40ebcdeccba56c217e7504b4f2bd27c86e1d86

SHA256
6a5cbf8b263a8226f7855202697b6305b97d98d5a101b8820b8aeed2a5c7d2ef

SHA512
1196bb36c9b4e2e640b790754d635955cff6fc8e2b8f07bba70c3b529f9d743c208ee67867ec26a90cae9c394491801feac635b38d055bc88b487dcec1143826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0add0bdd10e9800a54a1676204fd6324

SHA1
65c9aa28e1fe260ae27bdc924f44c2537f290f5a

SHA256
ab3d1f7872569247ff3c4c7a1cd372875efbcf16e5d56bef2d5886e6abbc2c2d

SHA512
41a022aab98e45810520c4358342bc0360ff3d6da389ce24feb60dc2bcc8c3f21487920d3bdc7919b413cee63c6654f903e69991b3552f344d9a1c0bf2621e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27f44316190f6ba2aa977b39a0f7e135

SHA1
fc3eb17e89c4b2851ccfedd7257034e35d7245c0

SHA256
54d49861af0bb5c63207acb5586ef2645179693186b856b5698e515e30ea2cc1

SHA512
02ba5730202085563c012d7b11c6c39434b4893eb867555c9732c68a715b1ef0be07d3eb45e74659929112075b244a1a83db7f9cca65f5da6a543fbabdbbbdcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93b343e3a339875ed5690cee864b4658

SHA1
edf44c99fec7a2b379eb99ea3a49616eec4d8e5a

SHA256
f1e1a28533da975d6e8d567df67a43364c930aa51e3fa760e3f889c4a7785c59

SHA512
c642acaa630c033ed8af372c7038d1ef6722da966a98268dd0a572df6027ea8934dbcec3a2062e23d78f4eb89614cc29447a783c7f4f19a072b6ee60981a6df4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d81fb0fa6e51215de9305667daa3f3fb

SHA1
5de6173d21d343c523e9a1ff37a9f4828c20abe0

SHA256
4c84dc7e01f11b9c57a52870badc4dd79de3bbf2cf494448b454dc1c4816a1f5

SHA512
094dda31b44e370843615b1e19d2b9aeac0240e4be2a588c168efb168de780f6e850f565625ab644f7272ff4f8d159a87f0d2240874f8fa6f1b312179defc62a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a973bf5e6a768efe95501e762e3770da

SHA1
8c1b3566bd1fe708626fd3701d544e774958a48f

SHA256
9e8740c04748bd1a43327b00659d1759258458d65b4486ce4308962915a0f32e

SHA512
4cf4e720254bcee6733852f5b29fc62ce51c2d80e2f2d783e308d2473419bcef83044bb197b8b319aa9f983c79bdd2bbebc15452cf2d07b08ec3c0ee16bb8145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
03810b4c2b4b7f81e8a730db128df7bb

SHA1
b7d3d0c79e27b63e77c7a497bceef82c57dbc052

SHA256
315cc6287509f00724a319797ed831be7fa0e04fd09970107820c4c525bd7a81

SHA512
7ed4e031162c66164708de9747459c52c1c136a508494ee0a1feb0456435d4f22149298d23a9cfd2bc5e55544fdf41fab0998b0ccd404267ab39f679d6c648f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF336.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF339.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit