d2c7f4fb95c54cf66ab43d9e6dc1f916e4eecd6896f1f70a7e2e6f3f2012ff35

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4320258b70891bf814da2197ebec2031_JaffaCakes118.html
Size

116KB
MD5

4320258b70891bf814da2197ebec2031
SHA1

324972a7c0c5aa96fc8ba204fca0b563818af67b
SHA256

d2c7f4fb95c54cf66ab43d9e6dc1f916e4eecd6896f1f70a7e2e6f3f2012ff35
SHA512

0a69997f36d7371992510088303311091b454bc56b82b0cc4e25127af991a0353ab50e4575b31a9fe9d6f2a532d9543f4e5ab6b1864a170b891f3cb744a7184e
SSDEEP

1536:ScAZyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SlZyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15653531-8A4A-11EF-B5A6-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000037ea3dbd909da1463e167222857b90575d87c4887eb01de10cf5325cc439b86f000000000e80000000020000200000009255f774d10bed4a0d20358e9d7fb3b987dcb55b9a81357334db1e214e981cfc900000002a519442157ab6bb436ede40c415ff8253b150a684eb1729b402feaa0350bf7bae01a8acdc3c724059ac9d50805dc6d9e5d1b0d2c1ae48d6328705c48e8d25b5ff60387797dd71fa475fc4c11dcbef6ad0b821c33d29aa5efa8bece8e9a1157dd7474c32a7eedd03c043897b40f8dde9f0feb1872e0323f23c978e011c904aceb73d374f3e4adb8acc74d3d7832e6876400000001223aaf9b43faddb15cf88645b611ebd9e229376a547d5df83d2e05d4a8ef4eded1946bdaab9ce0954e9fa062a0312d42b04ce8a69582acbc76d8bb72feb7cda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000fcd55fa9b8c0d64ffd9d7b026281295958ee38a0b162cb5e7e1cadd53fbc9da9000000000e80000000020000200000006c9c058709438a5f49ebb90098477740ff84c0c2e9ada70580b4a1844f7257cb20000000a203196eb798de223906ab4400a1e8c47822e3d2d78a5b2811c3a572fc996c9f40000000f7618a6e43767d7c27a7b4d5f6e42179af66e9f3e76fa8993247304fa2b9c6cacbf36b3c4b823358e55168e1c7eb40a1328d0e6d9b2ef2eea2b5c0e3ec39d62a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c4fee9561edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435085494"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2360	2092	iexplore.exe	30
PID 2092 wrote to memory of 2360	2092	iexplore.exe	30
PID 2092 wrote to memory of 2360	2092	iexplore.exe	30
PID 2092 wrote to memory of 2360	2092	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4320258b70891bf814da2197ebec2031_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8991a179da9994753350521349ada2ab

SHA1
b34bc4ec5887fffc5cc96ef19eb04d9ba414be33

SHA256
0d5e01c68044ba8d4d89f5e57b1bbf14c30d51410db1a7a12e553e20333b5780

SHA512
51bd4ba3e89aaa367ea5d7ef2016a458286dda7960c420ebe6a4c42dea41eea10d055535b18324a951a8a8d64eb87b8b9b3a17e361ea7ed1c17190f6307828c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c4172f054b1c2a799b0ef85213f4ba3

SHA1
c8fa7f38d7ff621a3a734d1a2d2497aee0a4b8eb

SHA256
82721ff1d4418c93100c86f8bfbb887c9979e157e34d155a790c022ad41bc1af

SHA512
e56379b8d06bc64a0067ef9b3bf2210509c929b8fec5b29a4ac5ab1e20d60c08222dd37adf8ab29cad67fd0c123e6759ed686a6fadc5134b14ade3220f3726b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e457d1b3dcef37e283a95894e8cab061

SHA1
f97e79a518c329a3bfdb48de44ed379bed450ed1

SHA256
d98d38fd1e5b56530949a227fcc9ba9ba4b939d09e0677148f82e404322e34db

SHA512
350b16f1d599eb037c56cf3240f830886bed40ee58f74e00d2e734a19bf16bfd0229b853eacc142d4d7dd29f5e3277cdf86d65748b71e7a9ed1d399a4e868c85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7ac9b9ed5745678fc287b2f63220c1d

SHA1
6d50b55ad699c08fd13ef919a3604362080a6943

SHA256
e2319b5c6dd52aaa71a8ef407c72d83cbaad11beab0bceace4191fc61e100d67

SHA512
31b42c5ed8adab9acbe064785a919fd18bb15dc434af4c8fcd234509f8fb163af6c17e7b859b250aaadc262a79e81c6165a868760b0526f1e45b877c1479cd20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
beb4f661b859e46cfe04e337dc3d3ec5

SHA1
84c054ed7ec64d3f42188f1218016041d57eac17

SHA256
3ec4e0d78253d3f301716813a3c5e255e1a6b24c073da0c435bd4f0389b5636d

SHA512
038385ac8d946254a0a095888d0c48d77c41c3ec6d9225c057760e2a643ef079de29d63ce6b80480f345d93f0613b2fa7b9087248f33d995418b0fde33e3e5e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2be0618e6e3fcc031cbd7dad47abcd60

SHA1
75d0cf1b0d5017c787de6546919e858fb2c08c2b

SHA256
e0451fe87f58a65246c5cdaf47bdba936e558016a6658cb82ffec49057b38447

SHA512
2b518c0420f7218b0d045231216d24bf88c0b4376eafaf3e84cdb2d5a1776134054b80765547dcd75928cf511b2572cad262b3711920335f3401a1bd78e618ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88a3b7bb39ca0a3d0b2b3f0c2770dfac

SHA1
374f4d3b72207a730fc4a80a2ecdbdd8971beb82

SHA256
fd1b8ace9a00ce8a3e306b45655a858aa782034ccca1d17494524e22f780427d

SHA512
e77d9bff0f6457e20cda69699b54cc79efa63c51c7d1fd85d8b25b7ddcfb5ee1ca245cec77f4c94a745a0325770aa44595e2a1c3a69f6061defc059280a4ff20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a04a94537ff822224fe6a303634d7b8a

SHA1
449346a8f512c072817499c4be273bfe9df13381

SHA256
6c73603f96a614f865a4182f9d024c727039e50a2aa2786c835c4b9ea98c6dee

SHA512
7511bfed13d65d791c65cf193ee1ce2704788576d5735b3be1f46ac48253fa5a06071bfa811a8373c9f64d0d3c293602181c14ce4020b95c807d034d75894700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ea95056f79136b4bae4a831221c620b

SHA1
9608d2a53d6b4d73adc39abf97e9a0815dfd90d6

SHA256
4d157f3cd68f6d1bed21c1483f33a20781a9b532d17723e6eae63d029158eb5e

SHA512
0af1fdc49f0467fabeb006bce97ba22479e4b5a8fa660d3f14be94109ade2c48e247af6f39bf8da68a4057c02a3d462e0818f7b58c2975b8ad9054ec889e7ba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a343156ea13a994c3564c8a39e1bbf6

SHA1
54971cb68c955cc04e13adc09acd90a6b9377b59

SHA256
1b785a92f10583b40980b206d6fd85c1f7c85654502781e73f8db591cf9c7157

SHA512
501d03f0ab6eb88fbb5b8cfd5c7b4476545d393e570dd560593f65f7c495725df10214673ff3f3c5b8b3df2621bd4e42f42977eeabe8a7eb2c57a99a6981b2dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabECF1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED13.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit