610de794f4e978c5c0bb6cbf8c91419aefa895001bc2f49281befcc927a625cb

Analysis

max time kernel
136s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

857dde2fb90857237438addcdf3c5831_JaffaCakes118.html
Size

124KB
MD5

857dde2fb90857237438addcdf3c5831
SHA1

fdc64107a19d5f31d40d4614b9bd99e15690d6e5
SHA256

610de794f4e978c5c0bb6cbf8c91419aefa895001bc2f49281befcc927a625cb
SHA512

de1cb027b23c662211a6157c40af6e6eaf891344f453ce1aa8df84b968a376d23e2a68e5455d0b131ef683242526726cc520d6a2aab25a865a08e5ff495f6896
SSDEEP

1536:hqHJMdmtLJjdO6TofgqhtzICuESLVfhObjI/XfY0aWlnJJ4HK:OqaLXsTkrrb/9aTq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429441924"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000b30722924bb583984f6ad9dcbd6c6f76046a182c136cfbe9b0878c323bd9267a000000000e8000000002000020000000adf6b98534034add5b69bfd81f2659e1d56f81001b9567eff58d266c6efb827a200000008ec5a97d9a25faa2a5b0298f60955e71f35930effef5e16a639f2763e369f3a140000000135f0d5ebe0f380729e6d6a5c376bc9cdd252624c378d7e12767b829a62d202e803f598731f5cd236efb0b323e974e93a92a5a3cb7ab25bd5d701718da45c068	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F883351-56F6-11EF-A2BE-5E235017FF15} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000007a9aa6b428b22b8a6cf383a7fe7bdb1f3661e73eab47b43a97d5fbc79f92441e000000000e8000000002000020000000ffbe44a0e2e717d81ed21dcf7b5d2ea548b061094c0a461e76934de01ceb0f1d900000001a9020eecdc4a447e1d309c670d23e8d9cfdcc384a3b20bd860a1e8d38c1b9990197c617ac730956b14ee943d58067f8679705c4666e0b1eacf16c7de7f34ca0df5fccaa6fb7734830247c957a030a488d67b6d9f8892640db19883f7e57da1a5c5722da0cd7cfee03491b60f8c947d2ff0c6177f7e31420d06606d0dd6ddabf805f74a9ecc28ce5159709ba726627ea400000007369bd40da593cee0f1cbb7c21490d844dc44fc7fa74c19abc66d0af00c7d737bb4680a63b5c5034b7c3c77f01996fc45c2713990875cfc2c6a8fcbeb5ee75c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f012fc1203ebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1328	iexplore.exe
1328	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2548	1328	iexplore.exe	30
PID 1328 wrote to memory of 2548	1328	iexplore.exe	30
PID 1328 wrote to memory of 2548	1328	iexplore.exe	30
PID 1328 wrote to memory of 2548	1328	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\857dde2fb90857237438addcdf3c5831_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1328 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f568adf89f3ca7fdedb8ac6d24ac0af

SHA1
825d4706b113c208c285fad165f18f6337f143f0

SHA256
69ce7f92d1ff17669197106549c09c56ffe22ac05216e9248b0190713f57def2

SHA512
25f37ca68cee10f85d94e225c424f0dd559302882f25272c8678b2cc5e3310aa6f20d1ce495ec8bb7832300173d97e3e0592b69de5bf0c786d3d0bf02d3ccad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb8b5555bb04db0fccd5863138160969

SHA1
959464633266256bdf9599d8cf6d4cd0db571cbd

SHA256
f58243c9373b1d956e9711b5fcf058feef6d84dc19dfa7d6b050f6d264a9a381

SHA512
58fd9e6fa6053300a36f7b00a24ec1318e09bc7389c0e6ee57c3b74014c9be59346ca3325398bf288419ee358763b20e02c3b0e720200b3e157f7f006a805cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
904f7f2eed67ff099e0eb3d7f4ae0c12

SHA1
4b64addcda5d6272734308800f3075016fac42f6

SHA256
5079203c2162a6cf5aeb2cdaf1c9a1c708b0a4e9d90cd7e067d3326485f0f080

SHA512
97ea9d64720f4ecd7e3b8dca695be1660692bb84dc557dd99a41ad02f926c62b98a1ccf34b4325bbbfa34d557017a50c5f8d1c1c06439b87d3c37b783fa6bc7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6000f33b71e20c0d778bb551963dad10

SHA1
588f0813a2f3f89619118180e9954567ca58d0ee

SHA256
bdad1ef8753bc9b650ff22dba5d651a91e7f730d16c00d82835a907ffe68b40c

SHA512
ee62998f4d7229c525e5bbb51cf240702a92c30c9399c8686359a3b5749b7f58ca9f080898e40667ea501de81d07c6808debb13119a4b71197070c66729482d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
227db21f3c6ee1323b62ff8accde7e45

SHA1
d574bfd914d0352f653a3085295e5489e556a0c3

SHA256
d50930eee9d650f3eb82ba78ce250cb69bd88404ca5706dd551cfeb8df91e488

SHA512
c0468d47b2c6c9f2a87d4b2b049b7e768efab0ef7709587931bbe26b9969bc9bc106198c05dd9e6995a5274e8e140b7f18d032065293ce47d455fe1e62d89fc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
222e4bfdf464235968cdf96445d45fbc

SHA1
a489747f737118d2702ce3582b8aa14464387d77

SHA256
6936d54096cec54f7cf9856175c9ff77e851eb394c6b60236c1ed56411e7091f

SHA512
72f950901926b7a29b128f3e5763ce0cf7d2042a17178b04566b7f446a8bbb856d165a17147ff84912068cc44b4060b183f2dfc9e538595ca54bd334c616c8b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d253edf83e0849bde8d9797bd4b4b605

SHA1
0ae6e50bf0c03d057e93255c5c11a422ca7b816f

SHA256
48421c0bf19b96e7ec2612532da36703f745b40e52c1636dd1cb5d8cbd1e3c13

SHA512
ae0aba18053627708ac3dd886762e96bacc29a5e11ee5e85144ed8cd8114f627feb7c369330aa7859381bf8c52810fffb4135d7c481326c89fc91356059e6c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ba6bb1e5a0dc1bb82e65b011daa6554

SHA1
998c730978f7e0aff80a4de45c070d1b17aed4eb

SHA256
c621fce45ab4e6168d7367a99e36c0bc95bf3ebfa81fdbfa1e233baef550927b

SHA512
919c91287ead57c2d582b014deb1cfb2820dd1c4415783c7697cdbbfcf72f2bcf47bcb4458632daf4826a050b0305675b8cbae10e64113ed008131fc29e522c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58f3257625ac5b6f6ace5bbb959363d9

SHA1
0a1322b045e6aca84efe8f9b955372a6b2e12ed6

SHA256
d2705bbc6c18ca60331287e1fc5784c8448e9df6203545e6f2fdbac10f2f08dd

SHA512
c628194ecbf85547f49566282bcd6005dfbeef19ff38b614ae6d4edf166d8f945eea76cb541394dfd7e57b63c90267f6b2b9587651a2f00209e679ce7b6599d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7616db556859c843ee65490c3db1b876

SHA1
fc06902691e333e271ffc126933ffd574f64d347

SHA256
864a9bd5a0c76e696ce65203915ee21207b31fabf65ee9a7d4e4e73c7782f162

SHA512
70d9a49f813dad5c17e96dfceb4e3c1e911d78d0be4019b612a69b5524478c05f0904fa4a60d0a94587ecd2ecbff5a568a585128bd75a365d76f57247dd0ae5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
261e802f9c28da41ec216bea0b0b2b07

SHA1
b9582cf772d0e0a76ebead7dda44cfa0179b13e5

SHA256
10fd20178547fb52af6edd08f38294a8b77aa0d90ad2f2a78ab73ca0dabd26de

SHA512
0520c9e6f5ffcac60f18f4c1a35fcf91cbad592594e1e46a698ff038d46f35f15466cb55042026805cc5d32f3ddce871f256dbab52b140b7e18998dd2d2b9779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79ae2a12083638090e9c282c69b87e02

SHA1
953fbed62f1e250a894c26799c34daeb5b3e9bae

SHA256
dbd43123f7e556c0ef015270947e3e856b1265d76ad2061aed1d06758fc1db5e

SHA512
3d58a620c87bd27bc3f0b07861b353718e6883f97a0828d896c6fe013aabcc331ed01b63a47a27a0eb63fe2b4ea275700abaf5e97df5a5f1942a24d341ea7799

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab827B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar827C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit