97971d74f00596e3f54fd10aa3e8962d007ac373a25cd3baca38613a056359c0

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89565d6fd743ac72122439213065b521_JaffaCakes118.html
Size

65KB
MD5

89565d6fd743ac72122439213065b521
SHA1

5cfa57743803e17c61a3ec2b9dc80e491cc040a2
SHA256

97971d74f00596e3f54fd10aa3e8962d007ac373a25cd3baca38613a056359c0
SHA512

015609bc7dd4cdef50dc47497619d82271e5b33b21b4aac4c9e833d74d151e5da478587d049c0e947b12fa74ab5b63eb540dea673d2e4d2a5394c5d5c23f15a4
SSDEEP

1536:8zSpe73Z5LySoxQo/zFY+a0xNeFIm+/O/:8zSpe7ptu3/ZY+aZIm+/O/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCA3B971-57AA-11EF-98DB-E29800E22076} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429519497"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000001a0b9484a16f259119f5ef2661090a866309d7e6e8adfb3def00465509fb2de5000000000e8000000002000020000000817ebe4bc6592b33474256169cf99c2c230ad080c34f8472605a7152f953d6df20000000c1bccb7c674025fca5277c5786dad34ed1d6247c046e8e8d24af547002e23d034000000098f2f87fdb92a63ec5aabae64d5dfd4045667d2972c4710c4b2589914faf089fbb6ba4f3e8b4db880bb5515a465dcbbb389e9de2ef50a4ccac1f2d4851a05533	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000007d76369569a1e70472fb2570f8abd99ec79e6b4724a8177bded8df8908ed2752000000000e80000000020000200000003069f694ada366edbd5a051f286a5279e4936bb939a462808708c98a47b84e6290000000abdfbf05c7e9f0fc0d33eda6f9c022154a51d0e69ee9457e896245322c26c8851ddf0cc296be543a2572ada6af9fc40749907dce8d112dccf1f8f45e37973577029cb04f6ed1ac7950f23a9c3d1d274b33724f704c3d31c5902b333c2b75356661e5796456bf6345208935efea2cbb3d3550037674dd096568f0ee6c2683a58185213c12591edfe1d5915e130a6141f640000000adb30931813765143d58904acef65de2f497a3aeb3c817abde705dffb493ca300107ae3c1271366a7d409f47e0bebb6b142ba2118ee152df88ca2ec6f8232eda	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a8c3abb7ebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2108	2032	iexplore.exe	30
PID 2032 wrote to memory of 2108	2032	iexplore.exe	30
PID 2032 wrote to memory of 2108	2032	iexplore.exe	30
PID 2032 wrote to memory of 2108	2032	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89565d6fd743ac72122439213065b521_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
408db17522b8330a0cff3b1547240ecf

SHA1
2bb91fe0bb444125c4a1f69a31167b281f1b3b05

SHA256
de5cd35f747b8125d7d1855b6997c837dd9115df4ecd9d7a5205dc86fefb9249

SHA512
a368a4b8e6983e0afd475444d3e225f5e5a7c637ca7fc83030d8a6c7fb85fd914855643b29a3adcf385d91e72d4e83c965d6b7e2050833b2d40328c91d308232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2145e235734f3954fec7f56ef65ef1c9

SHA1
f7c0614b6785586125f4634d4d93189880da89a1

SHA256
bd936e1895072d2cd5b50e58a010e633273d5ef73bb1824d0b50d8e0954dc257

SHA512
1bb1eb252d7cd89fe6da25cacce7d4a4fd6ab5efe0d5bea38479c6668a8feed5c8528560dcf6fac4b33a5f0c0973ad5f9f30b480e4170dd55543bf04c35e4524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0501fe638b93a91b27265dfd929453f

SHA1
67bf5c987a686a4ec8678ca603b2f1f4fd4c10ea

SHA256
7975ae89ddc29cbf29d546026db642807e3be807e1d7bf213f7a1453aad629f9

SHA512
67d2ae8bbc795b3f4f8cc3a5c7decdde4c744eb373c520d6903f1c10e929af02525ca1fc87d12d5a637148373f0f7e7077bb495a05615a25af29f718171f72d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67a50baa31dde539c4df931cd2e26e36

SHA1
14a991e77fc19d872b8a50f3218400fcc545e59e

SHA256
11a614fb610a39462beaf15e78fa383f27f5dd0b8615a77c6ac5c3272f78b548

SHA512
c481d66c927251da30a4772d883575979e1cccbdc011c5a0eb0a11b9d290b9208ef705e578387dda41d933818df23f0c894e4f8bccd380f4f2c7080fe65821f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc1dc00e791cc9a4051bd2ab30f4e443

SHA1
6562bc609760959b0c5c103e9812971dba9779bd

SHA256
0dd074979f248c6963e6dadddb864819c23fa39f0260b25ec92660d1820950b3

SHA512
5f9d0417f8e69e089aefb0b76d034e5f98569a5b1f903fc9002f89daa52efef96d55c77a89f699c7f9f19bc554607be1b3a51bec3217885655620c088ae8bf96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f3af2753bfa3c85c6afa34df3234b0e

SHA1
b343aae524a0268665c25de28edf4e6811f56773

SHA256
d65cb60d3ce907514e9c4ca38877bf9189c80911230c3b45930cffbdd5b291cf

SHA512
70e6d82ea6dc1e9bdaa0fe15e5714a9ea5c8f0f7c4ef6690fcf370a97cfca07e2c7fb8eda304bfa378b7591c01f8c1250cc8a6cf37d6af3a8a1f675651c77b76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8393203d68e4ddd52d2be775689fd0d

SHA1
5261da83e6acfb5a5ea156526c3ab038a2037762

SHA256
f7c0af62a02052b878fe250f24537e2b87e96f28c4f4d81bacb6e2ce33a3dbdf

SHA512
7f966e25c4657bed421d0cefa07d1a84600d9730e592b81bdfc43993c0ff6c66f98fb85dbaf71396ba2f29f1b663a46bf30b61d31a2f6b2e7b0c192deb87aecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6284caaac552867019a95169465855a

SHA1
e50889e81c5618cb72819e5d2f472e68850008f3

SHA256
b64afc5b537cfeccfb1fc1533cc4a91be27b214eacc50824c309487bf55431ee

SHA512
37f2d5b4be3ded751af0d23e7b831f612902012fe2ad522f25bc15e02b8007cc3827b2563233e3746725ca77ef6aca353c5b21fe5610b740703b78a1a3047e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2047d9dbe700b83aa435f4643357fa97

SHA1
0b54f61b19563223c526bec3478ab2a7b7a4a0b0

SHA256
a51177221ce86f3ea510fcd0d1fcfefbaa7bb55d9af45cbc80d2f6b48ce4dbe8

SHA512
c69f114f777f336b855fd401d11fba27887237e6380188056acdd9f543f0e2cb0330dd48c749ed88363f97b31f93d7b9ecc2fbbf43cf98a6886eacb8ea8ae85b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11bc0ec28cac338c4ea1d7379d1474da

SHA1
b1a1fe000dfc5ad63317d8cc78feb5d22a1a67e6

SHA256
1288ec4620a46905ee2cd813e9711d206ff8111fd43848bb65c7b4a3d7e819e2

SHA512
8746b77c2ca4e73346365fad941f1dbac5e70a189daf3992ae7608d57e3d15f08ab041e985b05dd706b1bfea88c2494eacd60afd8743008875ffd2fb83ad97ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9864dfe362dfc55322d54b52a777f213

SHA1
9e10cdcf48b8c8964f0d240d8265702e20dc99bc

SHA256
c72ba8be268b664ccb24685a48893d83d3e7b06e2028c038826d8cfdce99acad

SHA512
28511afd53da991a19a968990539ccea218b55ebade22d88e9eef21bc26759b66312d11a35b666412b3786f3a186265020ccf38749955f4d57bd669738b088f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab76C6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7821.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit