59d3957ccb3b9fc384837054554848128e55206b3c650073a6642004039cf6ee

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

877d6147223f8b940e5724885e19b98a_JaffaCakes118.html
Size

43KB
MD5

877d6147223f8b940e5724885e19b98a
SHA1

2fa973278e5a0a409960f1bf555bb3284a878100
SHA256

59d3957ccb3b9fc384837054554848128e55206b3c650073a6642004039cf6ee
SHA512

5816b6d8e0a86fa549be23c4d80dd723d2a130dad190c8a4a57307957a429c9ed90c82dda0b1517e79241f58fc29e9caf6776332bda6117874747d3a65b089a1
SSDEEP

768:Zcd9QZBC7mOdMpFpC5I9nC4uGvEj36QPd:gQZBCCOd60IxCvGvlQPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000822d1f947f4a21863245e1fc792e61253053514f4f647b338ba87336325b961a000000000e8000000002000020000000d215c347d7a5e93ef8c984a3f67f0d3e85455d38ee215e43c15d2686af20cec89000000072a0245e1e4c1af95397b4c8ca9ff1fde4de756ea6b1521aee9e64043aeb8cbd9daa272bfccc31a82917d22c22e4bebf91fa8f4cafc31c7317491c3c56fd93652aabdc9bb7f76d30f216eb04cc7851d66e37308fdb97e88ad88ce42156210998d781b5bb0370811cc1256150bac745123336bd305ff150622db057fea77bc69ef4d8a2af96054d9586b2fc35a12c1e3d400000009590ab84a22b6172068d6cb282f93b3aa13db05a9a807c79b8c50eb7ff4de7c8d75f19efd7b0daa2f3dcc5a51823daf4683f63f00d307df693c763dd5f285c25	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429482362"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000764c630de59a68a19bb06c96ecb6f4a767518fa48d2ccc46dbb61d8cb84c625d000000000e8000000002000020000000872f3430e92b8d8da96c1b74af82c876e8d2ad905f8434ee7c39c141ca8760e62000000067ccd8b8deff580448fb4c7898b55f3bbfd9f3433434ac698ebc4c31df8aa73f40000000bf6ce776e2c50c34658352baa5d016858f1a07584fe1b6984e451e1ca77310339aa59648f63f6f42283a35ae68249717918f18880ffcba9b32d5b0f2b49a44ed	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8080861d61ebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45DCCB71-5754-11EF-B0F5-6E739D7B0BBB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2468	iexplore.exe
2468	iexplore.exe
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 1848	2468	iexplore.exe	31
PID 2468 wrote to memory of 1848	2468	iexplore.exe	31
PID 2468 wrote to memory of 1848	2468	iexplore.exe	31
PID 2468 wrote to memory of 1848	2468	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\877d6147223f8b940e5724885e19b98a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9cb262bc0f3925fd088b9ce792dbc5ca

SHA1
b9f8def4086f8c8907a7f70682149c94688dff99

SHA256
285daae3e2df8400040c1174a20023b53b7b4d3f371201765014d65c5d288d2e

SHA512
dccfda0011561d8d42bb0effbe6ff264cb53bf71dec6541c08db50b865fa5d748222ba3233a9e499fef7144625f28b25a40a8a576cf2a502aaeb70e2204f0fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f3292e002a37ef375e7f3504d30478f2

SHA1
0295dca74be1d686f62020dcadb5af0c1fd6a686

SHA256
14c9bb2e3859d660f305b46de2b1d99ed4a4c4891ca6957b4b6710daf28d16e8

SHA512
6d6c24bde297f6039932761d9f93286b96b69efdafbd4128217ef151378fab3052111ce5a5fd39495a71cb433a5450c08b77aeda2ed21787cc8743567c3275e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
78152109b4fbb7ffd1beeb502eeba5d8

SHA1
6ccfe1454175d1e229584426a0ced7d8f9e89878

SHA256
f133cadf63205920ede5fe6c51b0654081157dfcb11bcd83e967d23cf7d8aee5

SHA512
e2b721ce0b1b17b679611394a950563c96a4aa760ba6b2a0293c44b863e5c6cd62d4dfb8e2d4deb42d9fba41e0f00e6ca061f91e43d52f1fd61b6b01ead7ec9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
648099cf126518fe8fa2e4f86a873146

SHA1
1dc3158f459c23eb6f6b9e736ea4ba18d719d58c

SHA256
83255889ee566f41bed58a3f5ce82559dac2421af1589207f01b6528a0618c9d

SHA512
9d626de96d7af31c9696bb527e59b6c9ed6672b23913a47015a84b2f701cd21ce3a2c2dad458ae80309da39abe871033624e30a51edcc039e5a1665c2567d492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cf8a0312ad8e5c90e1f7e03e80826aef

SHA1
b1d4402b53daecdb12f2b6cb9fb7c5ced04df106

SHA256
9521aa630139468a64da181b61ab154a97166d2976fd1916209d153cc3115d5d

SHA512
a4c85e038f1356e35d1f845a7d6a8bbc23f8a05e4ae10e81713c4e24ee83a089cb13506b2d4242597987e9cd7cad462c2697f452e8cc975079d54390f93cebac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c04bc590b703c48d0e7a2aa31749edc1

SHA1
c291da2b1a4e1ba9617d58afec9661c96ad81b92

SHA256
2b0e0f78fb9096501455d649da1c4fdfddcae52cab0b9274b496511d2329b953

SHA512
14fe210e9a4894897eb9de32b4b51cf42c9a412d25e3b15b865d294fefaf72ba69b0f0763cfcd8b05a3255546223e236c1d8f35a498a8f06c4ef39cc3455f55f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c9e120e9575e3d25e21a8444df16b563

SHA1
d327ca0ad814f1a41df1d6df1c86576089dba54e

SHA256
33f251c7ed077f4b2f10f56f611be759d4c4781b0e11ed881d0cc80e8b10a411

SHA512
9976c5a53160febebd4992c687ac73bb4491e880d0e074e6c5eeb7ff168f6b1b836f9dac95f5ddb9445dd6f3453d1323fdbf5309f2a47e7992f89dd5cb9c548b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
de4d0a65e39a56ca80abdf5b145a5686

SHA1
cb9f3ff1ab21ad8954cc881a5cfcc06c30db93ba

SHA256
2b073a89c03a5fe81fe0b3adc9973eb92b7a1d9a7cd7599ad461901e83787b11

SHA512
0c381ff483055a11c00862998b81f193bf6e4675867c6d269a9f509a31c21ce33533eda52c08e4904a316a822f5fc6a955376ddcf7b4dc5fb4e77980422a1025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
23039a1c817a43112e685210c1f59550

SHA1
8878e8aac561a1b474a6df42c9cf282c7f75131d

SHA256
82feeecd429634dafe6346a08c62bb34d9dc07f4f538118a28bee42fc3f54c59

SHA512
160611e644b15138a62a17cccec09262da3f2c9a8d7b02e6c4c0a21846b7def321bcb1baf3df127d818503c027fe9633669c563629627cb907f982b388e33e00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5e87ec598dbb14138ccbe0d91e3b21db

SHA1
303fafa2db33ee1ba373259cc8d692d5d4165b09

SHA256
a58ca4e1d905f25e4c11d188fecfc7ab20bc95d3df06ca801040244811083ff6

SHA512
04c17b7ecfb75800bff4b45df8feada762d7f8ce67d148817350c1994428d16e6a2d07315051c701bf39be3a59a930688dfda1ec9592e77aa4277ca85799d08b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dc7ef4a524f35ac257d414d9d7954071

SHA1
e7092252f13788c4a46d78ed889de04177260fff

SHA256
2d275c3c192e24e745241630b26c0964261244ee9a3f8c5058b8c81133ffd01e

SHA512
5e1d0d5da4441fd15fdefcb40eb4ad50db338e350e7d5d25c9134bf4588827c640dc0a91148d339401b945df0bf87f642d808aa320022d1d36c43699a5b16530

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5164acd22803c123273eea536ee3dc84

SHA1
4bb374402bcc5ec93ae2eb80307ab4be48bdb688

SHA256
8c3945cf87560e6236670c66dacab9e918cbe0d0043465da2a0a5358a5d127cd

SHA512
c4589ae648ffb4ab988252a7c79fa2e57ecf75bf0d25834aed6cbf6cc88dd77236bafc8425c9076c9be59c4f1abfd7862daed8ab0ac4f3ba0754221ccdd06867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f521721dee43f1a8cbfd870d89e588ac

SHA1
f58c8d627e6258c08d7eb4101aee66fdcc96aa25

SHA256
5f1a2a987c8fc8b9ba919b7db7e4b5e8c8cdc0b391438b93d512a6c22b14b545

SHA512
da69902b8a9eef254c3afa196fd7574aedcfc414ff654e7848b6c931afd414d1a780a98c5b33abe3d70725089e43e07e0db48965810b119fe793189898cb9801

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1141.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11F1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit