258a888d670ccd517242a8ec799d94a95a34554e51fa98ce60ff14f0b129de0a

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78ba284dc4c143a92f9f33490f117551_JaffaCakes118.html
Size

32KB
MD5

78ba284dc4c143a92f9f33490f117551
SHA1

dd026c3ca711b8f87c2029a9496eedd9a55aedf3
SHA256

258a888d670ccd517242a8ec799d94a95a34554e51fa98ce60ff14f0b129de0a
SHA512

5ee8a1d7df884b836fa3fe771f1685032d0f46234da63ae44d46fbd07aa647646d091be9d85786b05549e09046eb1f72ba416db8e0f1bd1dd0fc8d540a365a8e
SSDEEP

768:PIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7S4D8X:PIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sq4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000000043eea15b72a9913c6467c6a4d2e4d403a3c844378760da8a4b0f6fdfb07e5f000000000e8000000002000020000000c3100803d16653d32ad6763bad63b68358737f472b246d9240f0412cb3261540900000001b3c5ed14f3a56c338e0c3c83fb30c4ea6ed7ec1c958b015cdc6c2695ce5eb9495956a96936043cb4ac257ad7918410cac3a164e106c20c53dbc500b9b0cf014b80ef5d392e44164b159e0a55982c113c1376af04f052205f1a30bc110db099a4645fa2712463e1ac2c171a376251a5090a82f18ce19d59ab4ddbb22191c3b984881b6bd1d7f6119832db7febc6191ac40000000ea9f5f547d3cf246c1061de96284d5acf8e3b3dfeb71391d56091d03dc90c7483bb9742964c73ddeb6e79ba6caf13ca2f21f8be08066f5a34b006b08f66ca2ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902f6a0f71e2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000035b93b0be67246dd90ae08820fc23f7eac0b80d823c03f0c1aa6b21edc46e6a8000000000e8000000002000020000000f36a47aca6245b38a2ea9a95b935d7e16e834029816e367f43a02832d11b407a20000000fedb350fb7cc3adfd64ab22168443c3bd796ddc689d25bbdf1383f14063d0c87400000004fbc66b347bc955b59500cc39c58fe1c84a49b1387c240bf2f7605de9bc437b58ed6ca71bad7bc735d863303921c5183dd59a140df1124c57a5fb340999a5f02	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428499652"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{388001C1-4E64-11EF-AD79-76B5B9884319} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2604	iexplore.exe
2604	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2488	2604	iexplore.exe	31
PID 2604 wrote to memory of 2488	2604	iexplore.exe	31
PID 2604 wrote to memory of 2488	2604	iexplore.exe	31
PID 2604 wrote to memory of 2488	2604	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78ba284dc4c143a92f9f33490f117551_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
87a6b3fb18c70f8e43656d51cb3c16a1

SHA1
e98d5c6fbadd6a644855ca2c529ea211d3a9b2d5

SHA256
5cdc1154443aae9c1fb8e30ee2b577e57020aed6f688ceaf890db61adb8dff0e

SHA512
073c699c24a728eaf16f7699554390a79432b3b23d125306a0507017fc923aba7a398db7dacf44d3ee6538f51a034816787fbac67e9453703249302f5d77d50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4495612e0e4be7e59a5e1f9f3b737893

SHA1
46b3e3686a179b774d432908cb28189aeb453ccd

SHA256
cd33a84b422ccd31f798730be7ff1fe09c11ee1f3844f21d8e47dd737a4fa0bb

SHA512
b429f26142ed5947b52fe3596ff25686e75baa019c64076b4e58c6883aa7244e8867b09a718fb318dd226ebd06332e1cf33ba1dca4b755aa21c3e47b78ebccce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4a0ff45e149b341a2d5d57d0910b6032

SHA1
a9d9276703556cebb98b3c900822f477e3a37632

SHA256
4a301317f10073cd5c9a58e60c8b59a0c1adaf4812c4fb0ddfbe787c25117cc4

SHA512
d063986fd08e15bd229b71ef473482b33657cb4e61947956766e4c777996f0f909b71da719b7837f2c8d832b1decf77e87a5bd605cdbc1be7e0f91376d8f38b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
20a0168beafdcbbd9514f6cafe7b1a69

SHA1
8f6d75e2e412fdcfbae7d0c925b0298bfe749dea

SHA256
6d04ded21a936f7024b426310453cefba43c4300ef47973dd74984c20f554710

SHA512
83bd34c2b6fdb8228507056ec62501c1a0c4037a1ff90aa14b9e43353727717230b1de0cdffb1271f1a8b72c3add8bb4b59a8b7e99bba41e7b999d580fb9df8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5c908ca551065bc0be0c276338e96237

SHA1
8d2d8b29938062595b1d810b791840bf0edd359e

SHA256
40115455ee26c08fd3024f225d859f0e4402029d6745b35108b70a50349ee2a4

SHA512
43d052476f0580d6140dd37d7dd0017f35d2f6a2d01f5c3ea8985aa42d90e4ddd06d03652521f36dcf3c3206dbc2ca85a7ba7d94b024b8d6d37ea8e4fa4bc056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bae64ac08f189aa3b61440e138a265ef

SHA1
743fea5749c41397163653ecb568b0b1ef03c19d

SHA256
77efe2fda52153409f2f0bb29a7f7c9f0e7a7a93f6d21caac15acd0f7cf3e3c0

SHA512
da87ef5c6acb18fcf44e1fd03c8a76d36bd5c9a3d709a51582c3c71f6a60992c9dac7438a9eb5c0424d54f72dbcd7d0c0c2583bdb1d3c8b0d6761335fb7e96d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0bb61d6bad8c3f254cee62fe46e293a9

SHA1
3853a874fb58a7e39356f1c1846dd2454f38a06d

SHA256
d68326ddc2f939dc8d0d845035fb2d1871ffa6e99f2816f74fe1d6f35a48b2f0

SHA512
3069f4e6476372c389e5cb0e30825e2dab609d9f212eb29e584dab353c5bbe6334dcb378675ff6f9054c94ea3667171459d9d95a2fc0d9e0ce783b6869b51618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b1abb02c45ba6185febdf0f5d482078c

SHA1
b7c136f7efe5ca7d2f93fc18f7c7cb4100cb373b

SHA256
29d5b992ce87f9883c4548cce1a5c3a9e6913968f44560c23ab0f876cd7fe16b

SHA512
b8d473e5863363d66d7ec96e78784ddb6026359fd1079444173b2a5fefc1ecc4eaa20a3eaaa36ea1656959fd271461ef23e499bd2052b7e70f3a1fe0115dc2ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b79443c4d81faf08534ba72b7783a737

SHA1
29108d4640ba0272008ec8d8cb398a540108db24

SHA256
9f38062b47a5a88bba0a78a1788692054f3a8b6830b90d80209f24bef7e61ffb

SHA512
bf862d4868580377fb587354f070347f596e32957d10029892ce1da7a9591a8ddbdc1bb98161af04deca8acebda09741ac58eae8c94652da8ca17008a4349d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d23390e38cbe3389083947c1030eea37

SHA1
0a63f13d23c5a7dbd8b0467bb730dca0640ef0c1

SHA256
317201e3659ddef9964a78657c7bef98c19127dee3febc8c44cdd5aae94d3018

SHA512
5e2f6b1dc591024d0aa995ca69f80f0a90335bc3e6af92eb2918371664ca7e9159f6e2fcc1f947fe2fcdb7a3473f0ab4e2dea074f6b3666fe69a3831d944801f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6778b21d2772f65c997a735f6997952a

SHA1
5bc0331ba87cd9a9297b5f5769ff33859e40fb26

SHA256
084cd13d5696aebc92b3a20aaa33018cff4f391019ee3b2df81459a77a9adcf0

SHA512
39c4c846906b8add17718e61b89859879b445b85ae99577adf256cf5b652eabe3d6ff7c818f9b5e0ca896e4bb8a19411f5a505522d25fcad963e8480c3247caf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF8E1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF8E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit