366c2ea2173653a15c8ade22c51a1753e4a20ac22905282e245c372b929b128f

Analysis

max time kernel
132s
max time network
143s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

882577e409f724063f58b7344304facb_JaffaCakes118.html
Size

27KB
MD5

882577e409f724063f58b7344304facb
SHA1

9b163c2e952619f66865f65d0680b92d3bdad8f4
SHA256

366c2ea2173653a15c8ade22c51a1753e4a20ac22905282e245c372b929b128f
SHA512

e6832ebb1fd98b13f6179e4efb5747361f39b38cb9a6f33b13e03b4aa8d45b22dcf1b2a47a761f9754cf6ffbdc42b26ab7e891f93fbd46fe34c45e7c6c992460
SSDEEP

768:j05UrGtZgtv+eTbEfVAXCYW2uhHtO5E5Ui3ouDD:j05UrGtZgtv+eTbEfVAXCRbH0/9uv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429495251"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{485205F1-5772-11EF-93F3-6E739D7B0BBB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2304	3032	iexplore.exe	31
PID 3032 wrote to memory of 2304	3032	iexplore.exe	31
PID 3032 wrote to memory of 2304	3032	iexplore.exe	31
PID 3032 wrote to memory of 2304	3032	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\882577e409f724063f58b7344304facb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a8cb8a79c438136ea16d2a834fda6941

SHA1
f4bd3651ce6be1707bc90d7601faee8ae0bf0aaa

SHA256
7591bbf4a4803a051622d16b7bd8b005dc393a59f64cdcb5fd3889fa5b9aff77

SHA512
74bc3d9d5b9c4a323c71a597fd8bf6bfbcc810a58448b2dff3b9cfbc41cf02fb5396e34f97d2c3823e66aadc12e8734c8777b077b5cdd1b442b3d9006416cb57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72b06cfbc4c60906389080e3aa75114c

SHA1
25cb4ede0e6168370ee6fbdd07ea526105c36dc1

SHA256
fd9c29c0a20d99057493e865353e64d9761d7f4474fd56bc052259347d063aac

SHA512
064197992809b292776530e7d1bbb7698fa1649bf46b561a755f20b8630fcebd3ddac2e3feb6a72e04ef538e6015b45c28d8ca06eb15aaebc9b79ed416326521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f037f81e8359b2e7c9fa8249fc701d0

SHA1
ddc8d2d2f85c82f0d3c122e3324ed9962c38185c

SHA256
cacd878513b204a826a7ed770988dc1ddeebfc47d13d2acadd055bf575c163be

SHA512
2e79cbbe19541ef4435841b36bdc4f7d147099ed207f2087834c659b85cd104201b8453bb239edaafe47a3eb7f0aed1bab4bad6c6d4b00c78bffa5de6ed25df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
650acc79d3f4b5a85c32a59c98e1806d

SHA1
24d43452fc78fba5896003c6974a5fec7d61654e

SHA256
cf1a25741d49f5b2fc9db0c0aa4ecd725dae20c85580351ae6c1a2cd10e392e2

SHA512
67fd42ddd8e1330e0b74a80a07e6c16f1b0b64cc5a15682c4d10ee19a09c169a8c6e1fad7f1571a583e4b5bdfeb9d08a745859a5e69434803317431f689a1cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6880fb9dc87de9c73fd59269dc74b93

SHA1
0c9f4c136d7aafe13010c73740fd329ea0d6c818

SHA256
20462dee129b7f29b8bce3276202a292ba2f27f5bbb781b333c1a982f2eebc07

SHA512
a657af73d764de8386105105440996b97e44cec83056d2ce794c163ad3f3c8b3070177355e5aa83f726270470e7c4cdd9aa5b14a849f0ecd7eb8ad1c6d962c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e1883979fc37562027a2c7ea886dcf9

SHA1
82a4b928c4864cbfc8420a53182d420dc5cdc370

SHA256
b07f622a5dac8f64bc9b58bdf730f5cd5446fe719fbb154606affe104b19737a

SHA512
6ab3552e1d00fcce5cbbb4305c00f92570d8f4555a9ec598634fd10574dd10f8a66043ec2318881e917b1866b9a7c0c9fa3a68ce3817bb21c60fd677726eb865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4694a4b82a5ebdd52a00eb5619aa707f

SHA1
643a0f6a0955ccadc5e67e036181c85fef3afd61

SHA256
cee0a37720d7bd414bc81a5abc0e68d115a394cb56a75959343824624bbdfa2e

SHA512
c73360a4176d15c50565b4c1ae959c813febe177ed844ac8b95759b564ee798c8f244f3a5d0db84c7097e93d05e1596859b605618e6e89264f73f4df5695ae4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3e70f48151106af54d2bc63250fd206

SHA1
a153015e635a2226c364adcc5b757adac2f72e71

SHA256
0efe125fcc9d52c7a8759e45632e3c3941d314b14fd999d49c805112254e9654

SHA512
6c6996c756df390b4cc396777a2752a81c14afa43f71ea640fe62e57b5504ce66ee0a54bab3463b6058e1674fad3832578d0da05d535fc8e5f387a41df6e902e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c9abfb7d4036edc7dde4717f740a08b

SHA1
155327b1b415904260d4731eae6c6294be78173c

SHA256
37238c0cc9438b92bc49d66a69e71f5bb8052d7e11d582f4822cafda25add4af

SHA512
c0591937a9652ad34ccfc3d4a5de1294c728c182c147ecca18f51760517fd5e608ee85548d3f45d080bb4fc4d88f5be671f462c9a9c8513402f96a8407a9f0ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2c48e7cdc4f790e5aa1db7dfb8fcd6e

SHA1
bc07f8d9728a2f27539ec3ddda44c72407a656c0

SHA256
39d45e408a5875f5885e453ab9198b8d98ec1f982b32e3af7ce6faa8e476d719

SHA512
215ce83b69ad892c5f4a7325dfa62f4cdee45fb62d39f13e7ba072b64302252ec0bf15a7c639cd2ebc6284c430f6f12cdfb2fb196c4b3a4e0e2dc1d871f85a76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
98b8315e9a48e913bb2b168dfbcf4aba

SHA1
a3a84420a95a51e195baf54dd5052b401f7e8c51

SHA256
2af132d8f0c85ad06cd94d703a36ccd0a11b6945cb7c764a615570a6df396985

SHA512
b7eec82ca6365a042ec2b895ebc86bc8151e7650e3a3226876bcd7877242d2b9a7321eace48852a20000f4e48c6d70810359b2b3b62350c1948ee31158fd891e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDDD1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD0A8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit