14a8e4fc55edc18898d77254b8d2070638a60e952db4a5a9287a96f82557003e

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7362cd2db1d159b97f66470cd1915027_JaffaCakes118.html
Size

98KB
MD5

7362cd2db1d159b97f66470cd1915027
SHA1

f363573b4d2cfae7fb269b3e308d0e9ab6940109
SHA256

14a8e4fc55edc18898d77254b8d2070638a60e952db4a5a9287a96f82557003e
SHA512

43a7c5732a69998086921ed1855e9b9d34e02721d693b965442dcb917c8f4b09f67a07323ad01301f455dffcbd990e9fff87f596e52c60390559c943145667ae
SSDEEP

1536:st2WzD6bitRBQHQzA6H3MLC3IAeF+sGyPA0XJiC:1JZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000002f74f29e988a8ce9ac258c25510ccb9128de1b65997c83e3d7979900375400b4000000000e80000000020000200000003d82fb1d18a898dcf1374aac0068822bf1898eb388f1e74389ab891fe45f057c90000000de061a814f698b81eacaf9ecac9a3835b06cf30a0f1368ae88ee200f5e78de6c79fa20e58a4288f9d6ecc8012d34853f6331562220ef89e332d65d45174ceaf45790834c21570e221df25eb6fd363e61bdcc42c91239fc5607d6b5ea9e0585170cc8ba373a105d332ae6d1efa0e9e00880d1147a74b4a2ba3666559160ceb3931e6f80c5354749a53191c967b1d9473b40000000beea5c8b9aa52a5e56f994ebc2b5a9c580f1e4374b11746c0371935341b8f866ed8ab2baf62e93946426ae0cc00db5426abdf8a493c9b7dabd978de262414214	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A6F02C1-4B2E-11EF-8ED3-72D3501DAA0F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c0086f3bdfda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428146768"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000009f52a36a26bb9f18b6ba17d234e8c6c77695bfff73d7b2d2d313fdfd500893e2000000000e80000000020000200000004a78c38abcd18ab699f5f06b34790e5010c89addd441b7f7266f7726a3b1a77420000000ac92b820da369c78678c629491b72df35a18db46a818cff2087b5f466a0606f040000000ffb68398a0fef1c2ed6423fdf56c5f3dd7bebfb4797297f16b0fc4c6d9f1f790296e013bdc3108c2db545e609f568b17cee4c63fcdad1898eb97297369f1695b	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
1152	IEXPLORE.EXE
1152	IEXPLORE.EXE
1152	IEXPLORE.EXE
1152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1152	2180	iexplore.exe	31
PID 2180 wrote to memory of 1152	2180	iexplore.exe	31
PID 2180 wrote to memory of 1152	2180	iexplore.exe	31
PID 2180 wrote to memory of 1152	2180	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7362cd2db1d159b97f66470cd1915027_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2eeee0d37d606e4b910eb0a8f94282c

SHA1
cea3bfcbd78662e241efed541fc2f68161774a64

SHA256
d062794319ef3736cea0a28cd2482ccc5a0dfd1e5aa813824edcdf8986d2c9af

SHA512
d9faaff9c4c8b068cab8b88ffd4d5413f69b07ab73d5eebfc304efc01b3667f55ae9be492e909f3bde470e18f380b732a5aac85b9156f021723a44f71b6e959c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef27f1c9ef557b661b52198d90b83d92

SHA1
a2a23419329d430b556b094dfccd9d6cceeda029

SHA256
5540a566fae44cf378eaeb489b239d92c49d189213fbe6ebff7f8843ac2dc94a

SHA512
18ed3e7146fb71075b472c48c4fc9ad4c140b62fa31f5d921f32f88cfa9b02892eecc103e89ef0efcc7e6937482e6cdb6ed23ce844fa86e975fb4bf8175ed11e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
757483074fbec72bfe388ec9eab0f35a

SHA1
71ddb36a55d4019e969d13baae09db4c6a761473

SHA256
8a182979c678bb16716150af20b175bc245df4f7bbdb2f0f5a7ea177a23bb781

SHA512
9b774ce4278a909ec7453a2fbc6260d914a22013f84ee7b9a7db45fe7cd994011e2b451d8922335b8a2359ad1549c20c04bda7fb657ef19be71c90813221f8d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9b6c35268c58ac2f69cf590f3bcb21e

SHA1
d4cdce3810cd211a8f3662faa4d034a424a3b042

SHA256
21cdb171f7edb8aeb10adaaecd8a042f2610423c657c2370990a9ce1e4e4cfa1

SHA512
d1b9c935dacd2517cccba6a8f4d9d1458d7c224d4617ccf0c021fdb8051b5acb76fa37e1cd25445abd9370527e02d07793b1b38a2d0f94df919d3dee0c30d1ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cf13cab7630f4db7943dd822647cf18

SHA1
2b82fa898931e549af757e83426e5dfaed78762a

SHA256
efb81090e01c65281ef2b247e6bb9bc94aa8cca31b33646fb21a0fd9131d30f3

SHA512
f6b13358a4c128f2edff98548aa5724d3b1516ad362f2fd25f6a512dea79accad61826bbdabd3c792a761ad69c3a5452f25b2559f1a12bd8ec97220e3f7d8e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8a2b6117f539710bc8c80a693086abf

SHA1
7a8b4f950549ca29d2d12d7bd2708d6a9a3daa00

SHA256
949536c4832176686f67b45b0893c01d42d4303593248ae6a4e6389b9b3961db

SHA512
eb320dfc1c6aca3523fc91829668ad9aae34434c365ae312cc60e42fb911c4b2840c4d765f3dded0a1a95361ea00a93ecdcbfe8b7720b66da4b737d835cdbabf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51766977f7b26a77fe1fa207218b9a7c

SHA1
b7534a54954f0051d4998296d6512ee85b4480d6

SHA256
3c441b3c34e73492e9384061f3170b43ba1f2afdc03da23acc0187ab7ece2705

SHA512
b0e6909e16673f66d0123250590aa49c5b7ca1c74ea04b7d86ad6d565042f13e558d978b5cde9ee0ecc9ca78f7dbb082e837fdd4706f22fa08aef04c881bb401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c724f7bb154c66db0218bc89b69c865

SHA1
5d0ae750a1dc4a58128c15c2751600946819619f

SHA256
be8da06186b578da89c5092b4e04a3d0695569480f93d94998b2a8d6be396bd2

SHA512
1a8f75715c2eace411e885d434c80504c7947e565ec7ba47ac198ea479745f92b438d45b3153d8f8f588c0ab7b3bab870b50efc4416c437b5180546915fa59b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82453f6132f0d9245777b140425c689d

SHA1
ed39722c39f44145ff9570514a745264cf3e56ca

SHA256
bd618d5a96c13f21ab553ecf38b16accdeb91444d9c05fa905784ece9ff5d516

SHA512
96306b25947970161b2c864fef593202f4bcd55434b1aefc0f42f20f4a639bbff00bd6228f28db6179b3b0277da7a77a99a7d73e726035742d6107330d928cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcaa9abfb033338f742c406a4635cb73

SHA1
a274c3d106a7d670b7c950cf3e6bb155a888b0ae

SHA256
0429eac465401debdbfa36c4169b7f496f6f8819406e6ba04baf7f9045742ef7

SHA512
822e3dacb3c76430d42b841ef7b90edd876cf8059eeaa4d7de2e1e31832734213d00ae2c7db1a145bbd7f497cc678194eb7932c3827f6fc87c4a90420e964192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e892841eea44b9df4bf146baedf49abb

SHA1
97f661105bebd07f7f400e72f828385e17d0f15d

SHA256
18fd789baf9f1d846d5569e654fa17df42d4c9849d9e48bb75730d8128852911

SHA512
28a23b5e678fbea733c06e12c538a062b8011c447a31a7337e000fa48294944d5f14cdfbc621e5496422efd809f4a485eba261c82b2582eb886964f16eefa2f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
536921c1be6782c7364701a3f6a24626

SHA1
c28a19f7ca63e4069ac416ce18a3d9604e5c3fca

SHA256
f0982a9bdadfc09536e4885b5f9b611d9a95cd67f192e22b421682973e288086

SHA512
cc3fa0eba03677e59fb3d2ed9e9a04a116719bba885a9031c409866c75ebb5e5d20dfea4b669e7ea3047df28120d335381f24954ddf8fff59bc9b2fecbc75e2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9c9534fe9483f176077c89bd9cc07d5

SHA1
bb278033ff1f6eb9145ed0d44bac5844c7fa9206

SHA256
8a269fad0e19e8021abcada9d2739ec964875e249dccf38918ea3918cbfcc3f7

SHA512
45d8d59c98ddcc7587117649faac22a4969331c78aec5209f1a38f5e53e71a13ac08e87a793a0464b23ae80585c7d38f89c3dd2deded5e2535dcf817fef76215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12359032e81d37ca568ce23e34683787

SHA1
26ab3f44de61f7c50d0b1f682e4bf51ed0400fb1

SHA256
c74d4f4262800c33d8cc14f9999da28cf64c1013fe046556221b6bc133a72ce5

SHA512
a87960762f4a8691bab647c57452eac0626c73eb8c417bca166eb592f74569ee6e91aa117203aab8c1787af68141b52877d4ba755d85ec0a945961d5bbf0e9d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07064d68f36544e40ce11dd3f3c58d33

SHA1
6cbf3ee20edd077f7278a08386c2154703917571

SHA256
59ad7b21aa9abbe9234b0e5a3a3956fb549187e37496383e5358d85436afa62c

SHA512
19319535d2ec4d276539730519ee077d384f240be4fee1906bba2a7018f839edc2109976404f97e1dcaebb8b948b9104a7361a4c9bcc672ed8daffb1f0e6de13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a5f6f96c14445844b5268cd3ceb534f

SHA1
edba9613d8b631ca1b5a9cedd87bd09dfe178f69

SHA256
6b840ae8de28a82d9d003472bfb060bdadcb7dda9fdc33fc662a97b395cd786f

SHA512
9290885aa5dc741f7fdfa82a5d45397e7badc779204ba8f14e68f1b970493bf952c12beb4ae6ca09ff14c2c8bf7380a0bdbeba63bade85d446844a4f09b0fedf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C29.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CE9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit