dfd6eaddb407935ffd77ee44d83083b9905fca0c3bfeb6ac2910ca1b3e2f10e0

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38a6a4a7ee2da5b72f30c02e11b0e58c_JaffaCakes118.html
Size

141KB
MD5

38a6a4a7ee2da5b72f30c02e11b0e58c
SHA1

37b97f94cf0464998e74e50c096990d04b91b553
SHA256

dfd6eaddb407935ffd77ee44d83083b9905fca0c3bfeb6ac2910ca1b3e2f10e0
SHA512

095ce48af5056c2eed0a3d6b12aaa9a5216898a4c906dd6d5b0b8c0da1938c03bb14da625b8227deb8f515b15d1e1a6f99027df029197bf2681adb616a42baf7
SSDEEP

3072:SPztBq+9GKx7dyfkMY+BES09JXAnyrZalI+YQ:SPztBq+9GKx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7297BB51-885C-11EF-9917-D686196AC2C0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434873478"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2780	2400	iexplore.exe	30
PID 2400 wrote to memory of 2780	2400	iexplore.exe	30
PID 2400 wrote to memory of 2780	2400	iexplore.exe	30
PID 2400 wrote to memory of 2780	2400	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38a6a4a7ee2da5b72f30c02e11b0e58c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5881ebc0c9fab6257d5c9a86afaf0b52

SHA1
85d0562207a17fc6931feab0f16904d62ea8db46

SHA256
e9d94085eec66a7c83775d53a68125637d8b57eae1d58f848eeb3c084e4d2222

SHA512
4a0663e733d07b2a049ee83ea41d679994c349b0ac17058f861756483be32c2146febf2b0c27e4e3e1f02887c3d95f4466a7a7463a1d0f8b81e0dccdf80abbdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea67967f7389a8a1c09092f77bbe230b

SHA1
9bffb855001d1960826e1d9da9d7a28bcac5c3f6

SHA256
1ca9e44e835a6224f7dd0c623ef3016764eb0c0518126c533f637fb00fe6d4c1

SHA512
341776ca3d48f6f15933e0367d33ba71c94f9080065fdcfabe3b0aca160a4306a11901556c34fc622f3809d85ddb3cc5e781e57e663cd98d58861343632ba6ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a66faed57f8acff9c57d8de4b62ab52f

SHA1
e457ec5b65d376b11fd05d3d205df1bbfc070354

SHA256
394beed7d447ff9bdbafd1ebb2b98a520fc85744130d1fad3984caf315a5025e

SHA512
b0b62aca38906a72590f9ecf24e046d8dce0cf50f9473672bbf070a0740e5fb2474e807ba3c8cf19bb744737f234de231b788fcb53387491e74ecbd2aeca17b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad17a70a2b8a21f5dbdcc977ceb08d25

SHA1
b32c40938bf16f4c83269054e770cef79f17c31c

SHA256
2510f492abaeb031c1fb0c63f2a6a268b9699b25f804c7b3ffc02f9a4abcfbd5

SHA512
8002a036e16a8c8d15fc77304c8ff4f5f963b26b5dec736e53d9bd2bccc62968e3bb9be4f1eabf7fc135674aa041e092fd722aad4c791a2bc910149db97b5ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74ebf8a3ba0e695c049644ec435d195b

SHA1
f6375ed845c7be3dfcc7310b7b937cac4bb71c18

SHA256
a514c04e9765aee5575c06c5c8fbd36d2ed41c0db6557247072fb867fbf11811

SHA512
6122103db896d4d48534c3344a3558d7e60622610322e3d85562a4e525565ffd9a44e0500393c160a29a4750f4bd07c15c824485a52231669894280228f12d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a04c522fbaa524f446fdb4b285c1797d

SHA1
d434812ecfac67589c0d544e24b454ea38f90656

SHA256
c336f664fed3be967d1d3b34fd5c7cabde5c0b4fc55194bb9d82f3d880ef4c49

SHA512
faf1a6fbc1e0157d99e106bb922dd3f4c8129bbf3ff70e491eefd050f9437d191aae469f515ee73a3275c48499bba1815b5ba0e058cc489864ef2e8d84b919d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3768894458f568a7368095c96e516d1a

SHA1
5113ed0108e0f75f326b586a67b7048bc6a6c91e

SHA256
863fb785208ca4d0b815184fea437299189af209f85df82a5cfd933cff4c0b56

SHA512
709aae4fbecdeb9114de0d0edd03c94e7ff2cf0eb2bdd74542d93e9d0fdd06cafe8d224665f610bbc1442a7f8cc8b253d3092f9386f9a032151233fe6dd42873

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8edd5c118a7c2fc00df6cf57c975d6db

SHA1
47ce6b51d1dff688074b45bd722735bfebbcf4c1

SHA256
1829eef384ea29c8b7e3f149996c2d3154b889d4409a75cab35d26529868c407

SHA512
8fe563af44fdb69b9502813bb2f065158b74de5d43ad42a19e42c6a55749f3eee3d81101ec99ad44cac42a2aa88cad1a3dc4591f0f4167ecfd017ce341986d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0758c13ee27babf5ea14361103ae0b55

SHA1
54eedfbd96f286dcc2b14511e38b33747551285d

SHA256
50faaef36160022c16e1e7f72c65e361630ac7360da497b496ae2b0434cb8915

SHA512
b0560d0334899f22c020828fe016fe7dba765198747dc4ede43d97c66d348037aeef4909c247117e7d2644391c5c4790b1d76b151bb77350d80916940796cbe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de0510d9070f22ca7c39b9db6c9586b2

SHA1
be8b4aa0ccba481f92fceb70048f18410c3d7df1

SHA256
c86ed83c379bdec153017a2cc1d1480869e84ad50fa41c00e0312baa1e127d2e

SHA512
9243357d64181124d762c03612eb5ef4dececb356bd40f626458380b491e5d0c237d67b6da9a5c37a8309d9212f070fe937d374c7dfc96b1eb4fe5147cc67b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab737D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73FD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit