298913f39b7c807c6691f204ef7b7af1a954030d41ba572b73c18eec316e6b1a

Analysis

max time kernel
67s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78554bfc320f69f8cae3bca1a770f381_JaffaCakes118.html
Size

13KB
MD5

78554bfc320f69f8cae3bca1a770f381
SHA1

59fa999bf3471e2794bd0cd7220e591fc376534a
SHA256

298913f39b7c807c6691f204ef7b7af1a954030d41ba572b73c18eec316e6b1a
SHA512

a1a293e885f619f71018937bbb80a644fff51ea68d8f77e3d7a208b6c2faa79a4bc19cc45231627467e060c2710e88fb71651afc83451b55c8b65ceb225155ee
SSDEEP

384:ln8uqnGDnW0q7qJ/u8NtV+tYIffIvC1ZCqJlGF/qzVX2/bUmi6iMuFg0z5GueCbi:ln8vGDnNqhxfrgJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000006f50447d204d310d3b9baf61d5dc55a6c7a08d86ee69738ec8de74f44425caf6000000000e8000000002000020000000e96250cd279992e3449ecf4bca87473f3f8e83dfc10d1d401aa3e8904dc1938420000000fcb0fce63d8a2eb67318642cb20e5c1bf7fc55de946567a48c0d0e12f76bb599400000007be3dcc0e8a5c30da7c390c7bfd8dfbd48ef857b3af283f7e13e4f7935bc15b94a40c9738c08a1c76237849bd9db86f5bcdb39ed33999ca064b6972dc8097820	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0807ed566e2da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000a8dbdc397c5cc3688cb5799a3fdc0c08720d646b2f81f2399035f54a617ef7d5000000000e8000000002000020000000903913ff7f9e86a4754f121addccc90467d7b964b49f10bb1559d2fc2fe92aaa9000000065bca850637a982179976c95d6cb436f74200bfecda1b11f52f478cac01a715d4afa61b42d18b358141c961d00ae1a73f552eb7f54342aa1449d050a4e4853b8519b7856b5dad6e1a67e2aa99b2c6991502bf9ddec55e14b5a580a463c80ec0af2f4c83ec376b2916c29e1f067ba9c4643e2a9624367cac7b2502059b7cbbd572fe83c43a781904ea2ba948e7977fe4340000000238b07574541498d3f6489be3efeed5dc533c86ddef0b2078d8b196216df8e48b134dcfa8b338a63247ece73ef254a4a09f518e35675849d019d5f440ec56e56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF382461-4E59-11EF-BC3E-6A951C293183} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428495259"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1036	iexplore.exe
1036	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2472	1036	iexplore.exe	29
PID 1036 wrote to memory of 2472	1036	iexplore.exe	29
PID 1036 wrote to memory of 2472	1036	iexplore.exe	29
PID 1036 wrote to memory of 2472	1036	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78554bfc320f69f8cae3bca1a770f381_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1036 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4166073390ca8e0fbb36da4ebaac2bdc

SHA1
cf7eac799ec11473a8f7b795b0610a2ffb605c8a

SHA256
84813a6d2a56dd02af65c348b208bfc3d8e8cca3dac00559012e8e93cfbf86d8

SHA512
570fda4c42c8fd0e761c8b11e42d308698f297cbda5d813f580c52e5e3bae3e7bea2d1b2da87ce337f3ac05a3f7607ffb06cdf2f23813e974e17069708b1478f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75c08fcc6a7764060676fdc20c863b92

SHA1
138e30b2b31e405b9da7d2a4aa93d352ec1be3ac

SHA256
310572ecaf42541b9d446950715bb775fa8af0e59b9f1c6f65ca3e34496e90e0

SHA512
b2959c04f314cddac783531d6e566aa1a4c9744552c8048362b24c4ac9c20da0e2f5500ee15824ba5a2cce4a243f8cf9f9b55afc4d4ca519119f59424aa14e14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c52fcb4a0d8a901e969952ec639d117e

SHA1
8b51289e585a974206792717769cda9b0a1536f2

SHA256
2afa0168cfa2d5d0cf502966bd3ef8881be868a8b6e1ac09d234251b9bc5f4b0

SHA512
e6885d2b77ddf7dbe4f2c53cc0cdd2017655574d0adbb2b53617eac8a913bf606cf8e9366c1039df832cd5847f3eeb4ac508b7cc52bccf47a268dd614051bf17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f35ec938825e93916ef7ce7a143e4001

SHA1
106ec9eb1cb560c503d32bbe8c9037b6e531b2b0

SHA256
fcab5318c3e12421c0779cef4fb824e0d23e59791e46f1b4eb4c0b63c54cec0e

SHA512
83f095a67b91105f954614fb66a98a0a67e753ce56264addef19a04901d41c0bf8d3a17add7efde40eda2a92dafcf0bd6ef4fae334a4355eb09161337f9476b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43ea54a80ff5ae385f8cb39e163f7413

SHA1
2784e91eca17987950928d78a500be6a8a33f2c0

SHA256
a35e606a7abb3b7cdcebd48744045d376dbcd50b22833cced46799b0a3f92328

SHA512
f5b38766a057c64354f42e923470e9549bdd11fd25befd90a394f7fc62f597faae82e309e2b84e9c06ce8239f92218fedfb123ebe57d6537ec55fe5a53b89445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
832aa9c1515323368d6504b58ecce2c8

SHA1
410a6f55a0986f2e83fe488c58e89031346ae638

SHA256
b19317e70e4cd9720884407f210a533ca98703d64fda6fe4f45ad5cad5d9d4e9

SHA512
03dfb648dc8399ef1a662197b1783efbfc0b932421d72cb27f950bccc2051e6b98ef1fde76706ba1f323426b7b12e17696b1da10e9317fc52578d865807c38c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6044503de5ee1419ed8616c4db2270fa

SHA1
1460749371a808d59fe5013e20895f324c15f2aa

SHA256
2451816f2784e0c2eabd275a9f186763e9d69e3599967cbede32bf1c4b8293ca

SHA512
17968c07b15e33498cef990ac12110accc3ec1815fcbbef18f5a322d237aa7729fde1af4cddace91d677043d04a0be5b157929e503cc47a027045fa5e18bf86b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cad4f718a320bba38d9121afcd481cca

SHA1
d4537234bd30f4e37ba74fb15c2ee28e2a544383

SHA256
bcd5127015be06e879ad03b93639c403aaffe88fe7d3bfa9db114ae876d9e500

SHA512
d3451de72cf90de76e6f61954050fb43754c75afd0a6bfbb0eee2fb1afb62e354182e150c4c6e513f48b8b13da30c86e2901d5df165e6cb1a4f203132e86206b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9d41d4e2fb640e22e257b191f46eb0c

SHA1
5c87a23aee4d387d2b821aee9c17dc0ce45b126d

SHA256
af63a9124498fa7596181f43cc0a09ec26e0c52cb992a2667f16bd38739cf60b

SHA512
c9f3b9d39afcb63424dcd721ae0aef4b2eabf03e4fd816b550cfff13fc166028195fc9aa7a4e0f6830546be276cf4451bc8902e34d410237a12436d50a655b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98d3fae0c072d638205cc51289a81da5

SHA1
afaacd0269c56f64a4d6c2ac95957293daf2e2b1

SHA256
16ff937344259df1bf582b97eca80889a66d3e14450c44c685d40fce1f7201a1

SHA512
32b8613b6552538cd4b42f8e447316373d3e8486eda4a896de3fec39c920709c89d322aec7cf3e80973e0470317091fea7208e4ea8f56b63ccf5a3213591f955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6cfbecdf2812e9b672276b3a120c7a6

SHA1
d94e4abfba7302733950bc2a964d366e242b28c4

SHA256
c1c4b2ddd31aacbd748313805356b744a26ebd4446a29a5d6740db6e00bb8f6c

SHA512
bb0cb7079752cc1760c10b954ddb8da39aa3f314e194774710087d6a764f622691ed818fd6c160f492351b91fdea6b70c36e29474271e6ebdeb38698d99154f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa9993b9ce03f3188822d8fce64abf6

SHA1
2b06b5cbef08882455c9c74a56e9e316c23d078c

SHA256
1b1791759bfb7ea8f8d5000254738d18ba6540f7d324918d2e1f80abbbd3311c

SHA512
1336dae6de3fc8eeead61b14e0d7661dc4d75780a237ab84670d7413e54b0aedca4cf0aaadb4bf5e3aa5fed1fe7f520224a100355641938b35ce43d551069b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c26b377d5aed8d957cd63f851f8cd88a

SHA1
28c34bf6a1acb3047329c8eb1d0c685f555d8464

SHA256
729c12bd1c36f06b5ee9d97a99411b54e82904458f5104326c7b540b2d022353

SHA512
b74c048fc579c49bc23c920a6ebc4cbccf5463083d1f349b4c55e0f05ced31fa83abcb5e56b697684709e42f20fc4317e26032f7c4ac941631fd45cc68e89115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
175a0d74498c44238daaf44eb36f0f19

SHA1
0d73922ed53508a04398029b52f56ee7709a1438

SHA256
803f552486c4aa8ceb3094af4a0cae64dc63fe81e91e1789f714f84cf302c0a2

SHA512
b30d52df28fb15868cfea55dcc523225cc4d6c1e4440a70021ec92e2d582f5004b3c8d29bee6c6910a1d8a163f8f6bbcb9d4c33bcbe41c62e2c03d8e7a1f2292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c18d71ff98553e43dff1e450425edd4e

SHA1
d3426ffef5745bf47f60f5ae0b779dd81b1884d8

SHA256
9a2a042cd2d3230d412f2bc81826a62e18cf55dd33a2f5605a92a91347d4db3f

SHA512
c2c9b16726a156d31a6e53de16fb000d182320ded032af67d131de2f9a79bfdb769887e0c1b8bc8930e1beb9273a696b397168fe2a4e98d1c596ed7c7969c14f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdec7aad03638540b8215e41a4dcaa4d

SHA1
993bdd6f5f79b7c072b25b84c5f21ea114fb7e96

SHA256
17754d60781aaa4328e7518fcfc45022bc7ec600e816bf0cfbbdc62342bbca1a

SHA512
29b1efb569ec152e73b082fba87821e799ba8fa5af20b3be8086303b68999f915ef9b61fb2a093839d529b519f7d753fecdc56e52dd03a5bd0a0e358981469a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F63.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F64.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit