67f29956a2ea81059750b22c01827b7d229acdf9fd3b74e76b64bf75a0f9e4d3

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43149b3ef5ba1a070c7882ccd66353ed_JaffaCakes118.html
Size

57KB
MD5

43149b3ef5ba1a070c7882ccd66353ed
SHA1

da6cffdeae4a7ca1bcf331d859a718e580570016
SHA256

67f29956a2ea81059750b22c01827b7d229acdf9fd3b74e76b64bf75a0f9e4d3
SHA512

b4cf79fdf858b357dfcd01e7089323964a103397c5953503236cbaec4fd2c05d043729aeee22e8cc05504ec1c1589b09f1f5ac064da3dea71489dbcec32e05b3
SSDEEP

1536:gQZBCCOdK0IxCNxd4fjfHfHfCfufLflfnfxfBf2fbfSf4fufGf2f1fZfQfmfsfXT:gk2w0IxjrfPKmTNfpJuDqgmOe9x4Ok/T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8AD8F741-8A48-11EF-A641-5E10E05FA61A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000d04cae6d14d5df807eb86c76b3a8881167e212fbfb8a32369b4ea74e14c3c557000000000e8000000002000020000000cf61de5892b92cc64ac5f41cb0089924201483bb1ac7eb53354859ffc929887620000000b6dbeabef00e395c3efbabd1ffde0379919d8640f3b55d614893ae3829b80f8440000000c02258532dbfe788978d033dbe35120594149c624bfabb74a0fd1116b32294a828d616191cd5a7ee4010e49da0e5934bb55fe5db40ef14f0814ae90ce661fb52	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435084835"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b45f60551edb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000001829138202478e42ca4895aba0d3e97b157863e1a3ea8b831a2a7fbbd783bbfc000000000e8000000002000020000000d4f19ff7071dd8a7fb9648eb79c77973fb19700ed904fbc6d1421c5793cacf4e900000007dd9ebeba9d02d1b88e98b820d71140ce780a4eade5960ebe6e89c7906817fabbd1bdc562f36a1c1f2ef7a4cd12b9d8a86798badeb0e373a0ce9d0cda3b4bfa7f50d07f7536f56c2bf70fb971ad84c47a4b85078326a1b84c8203e3327fed1d98140972c95a7733921843dc5b0def316ae6b85de03f7ea43182b080e52d556ef2551bf4746a18d0650ae7345955be93940000000acdd3c0601876b1b68e8e4596362a94ce4f2cb1527c7ac5d6de9114c4fd151ae93675bd84d08aa572a3447825b237705daeef053eae2f98c1ceb462197d3afc8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1464	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1464	iexplore.exe
1464	iexplore.exe
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1672	1464	iexplore.exe	30
PID 1464 wrote to memory of 1672	1464	iexplore.exe	30
PID 1464 wrote to memory of 1672	1464	iexplore.exe	30
PID 1464 wrote to memory of 1672	1464	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43149b3ef5ba1a070c7882ccd66353ed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1f4729cf8c634677f13f2e5c8fbb6879

SHA1
0677b808e725b343fb41314244c337bed544d75c

SHA256
a7f0f47d65ee503a90c1c6199ad0993a3dac5de7a8d5fdf68b4dd2bc39baaf7f

SHA512
24ed5f2e401aad3686ada6247a6c812bc99dd72e92a153856daf58ea8c8e429eb2138b69a4e97cc06883e12a3c3ab0f6e671a4e23165daca7ac7d994203cc2cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd27daf9bad48734ed39075f82effa9e

SHA1
d934d923951517f59afbd155f491c3e7005a6211

SHA256
197de0dc11256df794e837eaa1d6792892f54faaefd88bab33fc1814912d2984

SHA512
c186c5d61ba4398354b1f84ea6f15a796ce060cf78a1668bf9b8a04e5f891af1aedb3ebec7ac52bb7ca9de8729e7e24842bd466e277f311caea76ffe32445d93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fc6b8434f494d32a81cc6b19fe98e70

SHA1
1d5a44168ff25de20295426c77d5a3b6f6527ae8

SHA256
9c7856e06b2b6b1ac1ccd333a36868b3e20028ed1fd37c0ddaaa7b1da35c5fb3

SHA512
37971af74416fca7f13a519d8e00d2e82efbc113e550e648a9d15333162a6bee56f587515ae13fde550b9730bfe654f937856f5a29934b18ce21023976c2d9e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecc2d583dccd457276c9eedf5cd75316

SHA1
bdd93d1463845f9280eea61a59eae4b545dd1747

SHA256
53bdb3dde56cd82ccf36129c124d9f91f94d9befc358d92338da709f875bac41

SHA512
7e577d6109998d0e7c12e0db75cb2e13966944e69b21a0d88a21cf78279180c48db343a1b8dcc23a2c0dfd9b6af9cc33c0bb1fbb8bd405e0d3a9ac7c5fbcf8d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
435a46b3c196ac7d6cf734b472b4bfac

SHA1
8709eaffab724a4a39baf2e7e205039ab6596cf3

SHA256
e94eb78ad6ce5c77f163a15cadfa5a5604cba75ea5a8b15c727d392cb83c4170

SHA512
cb21843fac694abbd760cd8c11e8b11a1bdca04f3cb4d81ad510fa32b6636c527e8fd9ade40e4788191d1e9577b07a9d379717fc3b797200f67267793616bad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c4dc59f731588078cba46382ecf3da1

SHA1
2f86e5198aea1f69639dded61ffef6812f59df35

SHA256
10b65268d53b3cb93215b4f26427d686dc75239578ede05c233f57d3d8c7649b

SHA512
8189b26cf17c33da0405b1632e8a0d65d71406135e25631e5e36baac31bcb3d9ff98957c227500c82dc597279af48ebee9a5e2aaa7cedb996e15385056b65840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a1083b44a355380f26a5b43f50ebf33

SHA1
30b25924501262ac1bcecefea429c0eaa365b6ef

SHA256
236bae2253439558a116fa66e714c880fbae6e3ab8ed10daee4e57a3861ff3ae

SHA512
0d201a2b2784742ad0966f67806afecaeecff4248b6cc66da20d22568c3b007c0000487b89c9ce316c123658102d2cf780c25bc5298559465ea80f6eb7c3b007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8caf293008e7737ea5b2b7afdd37231d

SHA1
397b0f6d9de781b48cabee55252cbcab4daf6845

SHA256
a492c3aa0ca08c3cc10f5055b7b991032a6014ce1099aaea5777162f91e8bc4b

SHA512
60430741aceff19da3bfa92b6c99ee8392859003c78431452b176533086391e8817a0d5992e4d94ea33015a62cc98d2674f19e30d738351c9bb861be3fbfea51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f615b288d7c57807f43f279118f317dd

SHA1
61d650de272150f5302537065a455c1343eaf84a

SHA256
8493e5611250a0fc421ab61317fd4b5807c34c48dc0fb54b6adf03de0a88dd38

SHA512
80ead8a84230b1dafc4cd4ecbbd4e395762310d59549fa22b9a1d9a7ce47c006b4f3bd356ce8796931afbb954acb8ec2c8c20131744e2fac3adcc6d412fdfc9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1d16f43bb327fe85eb234f8ec0331b9

SHA1
266c6b431d7984509a4bc1b42f5c3a57b6341b47

SHA256
b43ac0784e7faf8db53276dacaba1b322f7d565e53ee6856fbd7ceb5c2328fc5

SHA512
e22a42fa99f2a47236f37e7098f91cfa07e8a422099e3ef91e1275f6492f7c22ba1f963c71223205137bd3011f14946aa5863e0c6aec9ae505513da9e6c39672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3bf332e1c72d9a0bc27a77fd490233e

SHA1
b05245f4da471b188f01baad46112f40dda4a6a5

SHA256
8ff5ae4488fcc62f7d2badb7f17502439e87b61a669caa6ec1bce95c28616582

SHA512
ce2e1f9700c1e257053b821d49fa25dc378222d5266fc48ed2e117f21dc7bb4d5be855aafc330b63c20744b043aa8ff7b9166f5f62a1a85f46d55bbd536579ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
27b3b91fce3e5f702852ca2eaf2652de

SHA1
557a66487dd78e21a6edf4f171c8642385dff562

SHA256
77f6bc40d1e0e965b91ee2ddc2bd65a314c6c47ce8d6aced34991468ebb9a19a

SHA512
05cf8a6589255fbc37aeae9e9e30950e436a80c0beeaa8602c9ba26a6971ee0aca85e7af25811013f72c1d8b7c5d5e2fb6877e8813c9cc554602909bbf1b86fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab99F0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9A02.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit