e53e45627a6bbf6c149359496dd2848b3c4acba086ce7b79391d1c2d4e263c73

Analysis

max time kernel
138s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77ec8c222dc25e2b4d703584d2841933_JaffaCakes118.html
Size

25KB
MD5

77ec8c222dc25e2b4d703584d2841933
SHA1

29177178ec22036a17c79ebf0df9750e55693d85
SHA256

e53e45627a6bbf6c149359496dd2848b3c4acba086ce7b79391d1c2d4e263c73
SHA512

38080dbd8e8ec09ffd71da33fd87dd12cb659456fa832e3b268fda694fbfb4865344c4bf3a8c5e7018144b224f2eb435170e1b25189ff53c5d711c7b1c46c00d
SSDEEP

384:0nA4ywl7Cpdy7rztvukeKXXTuqwQ3wOq2LIWQQ/U4cR1LeeIYECdG55LkuxOk7gO:M17NtWkek5zAi1k90t

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428491251"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7EBDED1-4E50-11EF-A1BB-725FF0DF1EEB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000125999b854db020d167818f109b27110f9ab3b849981fb4617ddb507c2ba20c9000000000e8000000002000020000000aa7812a0749daebb013005a66a93803c0a850b06d079f177162b6e7dbd71737420000000baa7a332ed93cd45bc0d80e45d1da219d72c4c854714e15d44c6fa3b1f2bb97440000000810b057692d7ae543d5352211c7ff450fe63dcd1629d116b36cce7bb7ffa1c71b01fb97d0d2e48c9da375775a0664e8da96a18c98020117abfede9dce17b1a95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804c777c5de2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000653d6ed50eb2945fc532a42839ec0edbd4274b9d264ed79a70fafa80384a1fcd000000000e80000000020000200000000beb0284c2a669a9d799b9af73c1f04c4ea869f9f3d0a5192517a96fa057fc4990000000eb0f948ba9515a1cedd1d774feba000640f5930bafad73846d6c508acdc30f19589345b44ea18278b43a89e40e72c795d858cc548c2e017e10f433a884b3a8fffcb1e1e2acd7773e2ddac53ef710824770901d16788670beb52d1bafc506ae62c3195172ed4cd0d0e27e72d4cf4c4bfda38353f15a15506e3c58a1b777590c59e5b9d0d05e53b84ca809dd7e24b71f2740000000ac11d0bf03aa6b740bc914fc8d1f20b7d4190efcacf9dcd68bf47dfbfd825eba32547eab1813776f318f7f7aaf86ee290b293a246bb70fa4ac403db8f38d512a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2688	3032	iexplore.exe	30
PID 3032 wrote to memory of 2688	3032	iexplore.exe	30
PID 3032 wrote to memory of 2688	3032	iexplore.exe	30
PID 3032 wrote to memory of 2688	3032	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77ec8c222dc25e2b4d703584d2841933_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d64bf8987e58cd7e3b0aaf84ed1cb17

SHA1
97a1d93c1977e57efb183d16526d46438685fd59

SHA256
1c6054c1ead14f940a6688fec23485c33185504c0d8590ccf66b13f40957a47a

SHA512
a98674ecf8be9c37514d091774616b62d2850c69bdffbd7590c727e6f4f9fe63c8627a1a5b5832135ba536507fef65fdaf86469e4a5b1063ae938b18db95c4c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7048f7923d26d60dd7764c97307a3189

SHA1
5a4c6d85131588f11fee85b94ee8beb5b93348e0

SHA256
64d5d34943a7aba730282225b316d598cb70d183f925e62bd329b22ce29f7248

SHA512
b80b2844c6d68ec8d0949d79f978896caa0866b13878a8720dcbc5fd96f95cc0d45882a0e3533676205a7855a97fec4a900026e7055027e70032acf2e044fb26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9267a0131719cb4991053dd7df300ba1

SHA1
d3610a2d20886daf8241b0b6ab4618f4796de61f

SHA256
656aceecae68dd32b784444c28ca6ed88e76f6fd32778dba5653e59543e9ce28

SHA512
3a9e3b4cf86c693dced3de3fb7e749d7fda08f3db267a679c406baa4a301cff64f137b700a3985ebde5ca6c99c116d959490e9814c15d8ad415dd6c95a3576ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e6f8ed0c61997adfc489d65952c129d

SHA1
71f4bf3a99ee71edbe07a9908cfda33c0ba864b3

SHA256
36b0abd15d13ad4c40281e713badec1abbaa6db06767234be60d5604bd0a65d7

SHA512
5d0de412275a7359ff87b25486742a80642934594c532c4571329f29bd6a0d0f2ac37c2e59595afc49210b94562a612bacb96911a1f9bc656385c23882f10bdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
587730dcf9d61766bced6504505c7827

SHA1
9bb52da1ee4e60f47dded1c5f51dd66fc879fc45

SHA256
f678c70f8e487c06fce8dbc6edd7c7369fcc63f22c2a83089fc70129ac846ef4

SHA512
bb4c8d55ceca806d6efc7a75a217d679f5adac3a044304de0f0bda53b436dda26e44c941d8cc93b044e2da4fc2d677deb491ae9ecd577e4e26cf230e931bb029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e09a3bfeaf88a382aca70bccfc342c00

SHA1
5803e3e01b09aaa846ecf12db996a9fd85a3ae88

SHA256
c0a67e58e287c9ae019a7fbc9450a5272de19b4a578cef4979610ad20f705d05

SHA512
41cbedb60f8e1921776dc8c8ebf13d6544da0bfe63147aa3d4eaa819a67eace73989235201d82d06abd5ebc6268d41867f209309436f4995b187178469178e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8fca70ea51bae5b06659c0350652b8e

SHA1
491e4107bfebb692310b7078878f7cd0f13f7c9b

SHA256
565b65c45f8996327b5c93be3ade80af9659d7ceb94360f6eb25902841d5394c

SHA512
27fdd3ab8079a99ad5d43cb4cae2f25c124651e15143121094d1b0d6abefd5fed30b31bb6b9f175210874ff22fe1d5dd7e6c499013ef4feba09f5f6ad8f4ff25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5608492430256d9d9e23975def14f6aa

SHA1
4afba9d62385ee3e395284a50921d645f926bd14

SHA256
7612f8f173edbf93bd7f8bbe3a93eac9fc51da8ad1398972eb4f50590297f307

SHA512
ce7cf564d5a2478f8d0edbb32fada7062b745c60a1566da5655ac79b7a3eb5e49c0b6a58734394a86d82ac8d4203d596c5199ffe776c57502a6690dac4e28156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6aad15964673d316f0bed4e43f705ff2

SHA1
b9020a7a4aca04e04227148a9b9186c1932849aa

SHA256
73e2a93fceb1ec06ba0460e81decc35238292aae1f1806cc7d91617a06ce7739

SHA512
66759e3c0090a12b5f893b4d72fbd40efbdffa837100aab8b8377bafdcad1992b476363cc473744ab9c8238b3232a534041fae438fd828ab45ac715e9fc23cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a15c4f1a6ff68284296322e6f7d7ccb

SHA1
455e9db04fbc30502aae487a46697804510beea2

SHA256
1ccc03bb64073e1aa3fae196c3fbb6af09c242f36afa36600f61fc9216e85f2f

SHA512
362134a32f489ecf1bea29286ceb7a6b4ddd8c82d8fa8e391ae9dc049dd82702cb7911cefe6e5f5ae7a2d6853b616f3475ac2bb40ddb943f75cf75a0ce2b14f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18cc7ce861c4c44e556d25b9cf3db268

SHA1
02bbebf56e35a0659197e476ae37f3e7c30b91bc

SHA256
eab02f72009f2b8b94372558ee7d3c32c46086956280c2ecc9d9d3ee71ee94bf

SHA512
7a8bc96781d34784dbc6ad9b7136cad455483fb8674f8b92db40950f62660e68e7366cf05b3584609081e82a33d8f4cd7948c47baeba029a13f53a9b2dfc0e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ffa820127107d2175ff0e2129633ade

SHA1
7522298b7877e816ff8189f75b2f7852cf312fc1

SHA256
face6b6983fc339fc8aea75ceb2d5af2a4c78217aa67c9f64dcffb7d2c2d2df7

SHA512
60c2d070f41df13d839424b23525cbe2a2d9a2b03d20f8cef3cfacf2d54d040ba971a3af513f80fce5b57dd5ff0d0750f7bad3ecfc60e87e6a41d5387860b1fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bcf1da39acb753ef79675f8782df5cf

SHA1
0c313942b826f9dd32bf1f1fccd87d2bd060d304

SHA256
a5f4e7a7c2f8774aee6216f65d4043319843fca2025d61501f4436088c47d40c

SHA512
877dd296dba7ecc7d46fa91acabf14e861a527783116135b61193abf3cf37ed89ae87b879146a9cf1e5e851a38a1e7d660406d175a5633d188f033f0fc9580af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F0D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F70.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit