592a20b0c60bb2143fbc015b528fdfcbcc258452bccf8dd8270cc479ed820050

Analysis

max time kernel
137s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c1ecd4101c2ca36b33d693f81d5fce3_JaffaCakes118.html
Size

6KB
MD5

8c1ecd4101c2ca36b33d693f81d5fce3
SHA1

44afdb1b8c877ab203e54d1a6ecb6991da27cce7
SHA256

592a20b0c60bb2143fbc015b528fdfcbcc258452bccf8dd8270cc479ed820050
SHA512

b44e4907915dc9747d18d8c74bf24ff50af3b4dfe057945aa128654e60e77b81d92feceeaf33b3e3a3846b29d6009def8fd99663529af9b463d3f9173beb202a
SSDEEP

96:uzVs+ux7+ofLLY1k9o84d12ef7CSTUrZcEZ7ru7f:csz7+AAYS/2b76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{531A2B61-582C-11EF-B3C2-F67F0CB12BFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429575158"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000dae6fd146149d2bda8d8901c503f2a02522de85f099fe78b34e7a101044abc36000000000e8000000002000020000000284fb6051b9bf2ced86dbc4bb0386c79400a0946c93efa3e274109c2f5292f632000000075c1fe94db1f510f1a13d02cfd5072de9e14bbfcc26448e81844cf94a255e96140000000a5fc37aeb534c9f6f24e2e959f8e238877129363fdcd85ee31f58c94181d370c77eebd0cef61e1fd3c7e494f2e61abcc518e5decb1ef0f7b95dfe0336b6013a2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e3e799a61b3d97db56200e779743530ee7abc026d344fd7282744a9b8af9a88f000000000e80000000020000200000006ece94e0dae5c3478069f2df453944c6953c106a2bc3de484eb7689952b7812f900000003c009fe9608b71b2568b79c234cd5f239f6403a5f5eb26046cf16869561e59d373d100780c9bffc80ed27ee5c39c77966e75709818924e8dac772531eb82bd588ae1a690d03439a23598066253ee6637c95d3d67a270c38513bac6e530d8cb1d7ad9048380cfaadf06eb30431e60a30d81387b46d3ba03f8516a52bc58be9f98ecc0c81c86f605993e7f73766720d67440000000b8a409c1f7955d159e6d31e8054aa532bd99409b02a07dde024e3901def971c328093fb476c5175806ddf3dafff4f35e94cba6e036457713e1169774af1e8479	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0863d2939ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2072	2544	iexplore.exe	30
PID 2544 wrote to memory of 2072	2544	iexplore.exe	30
PID 2544 wrote to memory of 2072	2544	iexplore.exe	30
PID 2544 wrote to memory of 2072	2544	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c1ecd4101c2ca36b33d693f81d5fce3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87c73ff2a3c9727a0c962919433e3e03

SHA1
0b7af2cd125c351fe0707dda52d02257218e142d

SHA256
37f132e8d3ebf1cc5aacbae1cbdda3ea67574b640ba96c4510c3b52488edd6d4

SHA512
dc3febf3f98787e69a9c2c2bb6be0f9ebf84870fa4ef89be042d8f1aac4c2d5dac2f4bde7dd5819fd41f74e439c936bb0ef1e8e1b99e2fe342f3f5cb7f9cd266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7e4675dbf44e3e46f23b9b84e0105cb

SHA1
947371a52b2b956e4734761f2e4acbae1232898f

SHA256
57809444e1616522f8e3c38c406e6495bb78bf1a294b1d2d9c87b47446fd9060

SHA512
ab6425e60e51af6798c72c832f71a6530fdca88b13339fe7a2b2e0b4acfac302264f2937308620e1d1127a80d19ef7a38f717e313fe7899e2e1f0f8e78a3368b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0d53adc75dfafa40555d561801e2bbd

SHA1
02f381227d41cffaa1d52823b956bf0c3bbd4f2a

SHA256
1c89135ba01debd55022b24787002d761b2022d1b17e7084ba19aef4a0dffbfb

SHA512
2158041b2344a58a64e8ea2854572f1e456107273e604d47d906373560428f569ae9771152611fff8609935e9c87df818c99b0997f19af6a3e8669ddfd2d420a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15ba832b486d56f3d683303b7494c102

SHA1
5126816c2ed6a43f001a1d25eff2eac149bee95f

SHA256
971cb5e52a4196287110008f46bb0e40ef24e456081ae5235be3d15a0fedfa80

SHA512
006139fe52b202745d4ba472baeed9e5ae4980662de7e2fd73dea03948b6b03d63f909fc61ef90a6f6034e26f1da733bc2ce0d5f41586cb7884946c608e1c12d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7d68070c3c959699b312ab5c94613af

SHA1
d0854289cf63a466eeff305306815f99bf0af2e0

SHA256
0b6f6aa081aea8e04f1bf43601a2c30ce75c03a2ee095a1014b43599838495e1

SHA512
806fa3619b0fe32b30f787c68797d77b04af1792aedea9b7e7f27d6e3b5295f78b81fdf3d86f7b2baf1449cf57d034cb3fb6e5d08ac0c92c9f6c6391620c1146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0663284f22c78c29ce13166bd8af1d21

SHA1
7cc381cb3cc266a2a05712bb57458a090e03672a

SHA256
65eba49d5605d01d878e5e32e72fdd771d68d997bdf368a37e36ce096cebcc3c

SHA512
259b45d97226d864e181641a16aec2b9c757461cb65e87ef4711c138a769e8712f3d58a818ddc6afea8ebd2b06897022425fe7d2387aafc5ea3302ff2d169b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
358ac84165896795e0f77f3e6754eb00

SHA1
4ea5780fb676806b24ee3323fededb6abba42556

SHA256
9f9040425595a655cacf85ef509869bdac4909a2292665f74d0cd1dcd7322154

SHA512
07a09aeb7c3014608536b4ee8d033a3aa262bee7e8cf1d73c5307a1fe8ae58b659c40b04332f08ed43cbf9bd0c952444116945791786bbccddf262980fd6869f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df4256c8e06fe60f080013606f000018

SHA1
e511e9278bf913027ec73a2d36cd2e772876e66e

SHA256
d200fa01dc82fe60f951f883be2ca3ea7a6a1c3feaef331d11a929fdde93ff30

SHA512
5da8ac8714f8ec7f897806eb8ec5c7918fbbd69d0215068a739ee2198528e22e5738d35bf70a96fa014392b5804dc45e13bc7778c2252bf7142f7784946f083f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6deeb776453b979ed0414e7e2a805b43

SHA1
b9e27ba84da08f6a1538e95cb4094933022d53b1

SHA256
72afd5a682fa1c5a9f8a14e619336cd806742042710e92378363322df5bf85fc

SHA512
b39b25fa98287f3df3373146ba870695d028a77c4b89ab864e4eb6fcc6d8245995e944c2bfb446a273233c0f16749a62eef01a7038896b87a8d551f278b6c62f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90e0830e4fe56751036b2aee089a0a8a

SHA1
fbba2a0bc5857e184301280302e7b1fb52feab7c

SHA256
c1302c74b8b388e5e6f4887361c2e1336054f56ee1e9350387137b06d71c62a5

SHA512
3d182496712046f5a7847871c8542172e487b766438cd90036d3ed9be0f26773d8c0d5c0f939ee8658fc7e6f5ac7f12fcf5b9c12391230ccc323eeefcbd3feb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d059f22677fd1a13fa2a5beaa1f0878e

SHA1
6a6039ef72a8a01e5838abc68f8b9a38b73a8535

SHA256
7330d4551fc66f996e587b82b2eda2de976410bcf10baa89bf0f05b83b58bd36

SHA512
ae3025a0ab583d2e4c9ef47ce7a54e647977fe5ac2729d0ce83ca2ffffe445689790613db75d339d5de48c20977b2aa07ae1a7f8bedebb2b812c376b0dae3da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11a29e47d86d9b4de09d997c78304147

SHA1
56931f3a6fab38fc3f333383eff0d7abf05bfea4

SHA256
90e6843b6ede1242f9193c8bc6efff0a40ccdfe6035a14f6bbbfef148b31ae7a

SHA512
fb0c81a3d4b04d5386091768cb04ee6cf3e8868c2eb82ea11fdf43dc60cd1dad72ee2504f9ddecfc5cf793cb260d7d04c94acbf4fe218c284e7e6333f6b9eece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f4a330b7a94bda7d77375bd37bd4d3e

SHA1
17bcdbfcc673db84259aad01355c2d4a87beb0d3

SHA256
02c5bdc3238c27fb0c7fca2809b714e5f8dabefa59cf0a3da436d49597334d35

SHA512
d5411e610a5aa861d9c43c4aee5e237f96d9153f4a24704ffc2c1580c3cb058d67f788928536f885920f08c7925be8cfeec9b281fa1c428e81bd638cd3ae0290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e91776c6facdea0b92932a1abc589827

SHA1
541f21dc0270897190c86c781800dac53bdef9a2

SHA256
1e96f252a1bca916ec3b6a26d15ddc1c78028bb4d40510f61c2372e1560c7b55

SHA512
0b59062303ed15576fa12624ee0a122b0e546b8396cb7d40a42d738d72dc8dda212a128ef0ea512b654019dd305a0b247bed27c010569cc9196d12a7b82b68b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab429.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit