90066f7770770409bf019788b200e93d1bc81cb6ae451cb3599b80ba257a401b

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be83258195d35daa5d563d18193c1770_JaffaCakes118.html
Size

114KB
MD5

be83258195d35daa5d563d18193c1770
SHA1

c3b8907d92ac7b9e80070d61d9e9c2f850da9e80
SHA256

90066f7770770409bf019788b200e93d1bc81cb6ae451cb3599b80ba257a401b
SHA512

11ce7bdc2602bb017e70a3770c39a92cdd3ee45f5e724e9018b1226e7d2b62fc4e2405bf8b29aefae5f6dfd78beba9fae6d36341f03c31584d86fe538aba3d14
SSDEEP

3072:REE6eKhbTo+CEaQ6BrLgee+hZHwXPZw1VOt7CA3f+D22Sfgr0qta+prA:FQ6Brx9POdvmDRLrBk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85570BD1-620D-11EF-A17A-428A07572FD0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430661448"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2732	2916	iexplore.exe	30
PID 2916 wrote to memory of 2732	2916	iexplore.exe	30
PID 2916 wrote to memory of 2732	2916	iexplore.exe	30
PID 2916 wrote to memory of 2732	2916	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be83258195d35daa5d563d18193c1770_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6407a240eeddb1102fed1a25c6ca852

SHA1
8e5a7cbdd873c378de4ce6b2a1ce4c9c1beff3b1

SHA256
1ea00908be99db38b729539f42c563a244bbe6242d0d04465f907d687d36716f

SHA512
f7974d06a2920f67c8758617221e635c7e7ea47e02212050ecddac8d5ec450b4d2b2fa1e9c606834891b427988429e66abb14a86fca8c445fdbe5c70d1054bae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9482d6c27f8136c43a22c78274c25e2

SHA1
2b38350900a38670a03568cfc0bd7d46a2c96b64

SHA256
19aa3a4dc8cd8addb127355bc997f969c7ab6390c0e1feeb141c4be3ba797cf5

SHA512
cc93751b6e5a769a5f8c580d55720f291fadae1dc92eeb35f6fdff1332d2163c01118686eac2f21b83548277961b54e588a483ec74cec7541a19a288cd375bd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90b6228c38123e8af811534fe9a39a06

SHA1
7309fa85defe754459b2f81a3d4698c4e7abff8f

SHA256
d1401a2983e5280fb4127cf9abc4ec717c2b877f122e8f1ffc8a17eaa083c969

SHA512
947ee0087566f1b142fbcf6fd9001beff6411e26f383ff7b73a26a7642aab30f0b3aea5a2460a1cee5041aeb570abae0bbd50cbb40f8f638b6d54421e3af085e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2358035a1b64d2a060764e474aa45e1a

SHA1
8525a7466ba4731524fe379d290769ac9affb415

SHA256
07e97b51f05da904de479a9b96aa447c6c690e666abcbfa85d664a9a4c45167d

SHA512
d11eb96e96fe906002dd3d1442c7af6da1494cadeabad763189472af9b0ce061516f934c4335d4653d4acea68f80b0bb980f4840428523633fe564cbb745a0ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b730440baaed28dc90b908ff337a4da9

SHA1
0a409068bf5a09cc997f4036bf3d8990d548d6b7

SHA256
09e7686361172d50ac5d66edb8af356d1df9b6e442edef5c99f805145c9d15cb

SHA512
f06eaac310d98f966dd3bfd1adfe3b262921d59b8b29348acb53a05e6326c12755b20368f0cb23c75ab86d520ce1f9c51168a719314ee4d4e731642a769c76bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a3bba5a99376c58003aeb6163bea974

SHA1
19677106a4fc8605ad4ad13136ace7b4fad0e531

SHA256
262ab322abfc68fe4ce48f83b17345da7e3f4c2748d23fcba28e76f776f6d22f

SHA512
c4673d7f42091bdbfec4ddb2912c0b5c6942d1def55c47fdc4f8d8472924be2f15a8a64ec1354a0dc2bbe3c3445b568e679b7b73ce73434a28842228388e4768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b97b0a58d0eb003fad1e701f3a661d1a

SHA1
e8b6513cece266e49e4a41aa9f0cbd39f8025397

SHA256
470570365e9117beb12fae42fa40b74e2f459996e363eb6de2a3439998a31fff

SHA512
efa5a1d0b9240bb94d619f57484b18cd94b3a9dfba3c87752bdc3207479809dc5b4c193dea614350a27bb370d154a426d72d5d8636b4d43808ed367f1163f5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc7d575cd7bf59cc2bc9f444689e9995

SHA1
e22f1aefaaab9a0ef370fcc484dfabd70060d7df

SHA256
043197b1fb03b69de82e5497824edda8b936ae028cf9bc71d852c7bde51e4395

SHA512
05d0e247274647cd1c02bd40938f3404c80cdc5afe1fb29dd6fe369815f4a7cc769d7ec9d3e524534d424b49e0fbfa6d5a832409a443122d11635facf6c97a81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2061623282f65cdced9dcaf6435f9b1

SHA1
1064a0e342837a857129e1f3506daff03975dd61

SHA256
b95a2939df4f8900b60ecd96e7973909812e4c35cb6c56dd9225f4e3d657ca40

SHA512
f13bef8547bc3cd59f0fe2f91c56aa980a36977818953b47d9fcb18042b4259b21a49122db887c3dd3e089c6be05ff923bc2e76a6ea20af765220c47f7112488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d5b52fd1e91de603122397750c8dc2a

SHA1
e83569454ce0192f9cb3cf04e3c18394b3cc5001

SHA256
2dec50cac833141abbd46bd48f32e26e952263fdcacc0aa7ec4be231a541d6aa

SHA512
71b272c6a486f7b99684aeffe9515d5287f735d1c41d38fd7ec4544518419e1e90149fce78d0e5fa2ee6850a58a51ae18529816b6eb9db8da3cd6210a7a6895b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb887478699267ae4a012e1f05b01f17

SHA1
7a84ece39d80454d951897ef941666f0afee4b3a

SHA256
a1e96fa813ed33b8b8389fcc050954df3c66a45a36c1ba97d7c4a6d1143c80bd

SHA512
b898c98bb9a118c1e49d939e93be51aa52defc4781005f013db2bd7a1eddecec06071fcd1293479d281bc3e12bdcd9d2883adbb4d2b077072ec39b5f3036d61e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e8ad6584b6e9b56b0191c32e78c0f8b

SHA1
f5c9b1e49efd851053e46d7df2c00a23c7cfbf80

SHA256
9c3848f38e2cc1fd8a1ede6fe869606eec426d8c1799cca5231097054d5cd707

SHA512
6be3fbcbb42c109f50928d83997d0e410f9c9f48473ceb3b0092f097164f963de325d88c3b0dd3f1bdd981408cf6346c72c9abb30bc011bd2690e7082544cbf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7cb1dab8e9e2e9ab20fd343805304f3

SHA1
b4aab48abdadfe564da0d8ba2d0606da06edfec6

SHA256
66bb3153400f9fb0b391b585a83374fdc2fd6a72ff989b9e485e4bd33ac04d64

SHA512
bcaa2781c2fb1895ece37692cc9a6e28297ba6258bb665f4a02261c2d7b48e7bf34954b14e545ad306c0274a711b83618dfdd94747a90d000b29ed9d790363cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1c17687fcb6a0a12c09513cc22c5d0a

SHA1
4c591e59df4270b9dc53e1996dff7f35096c7f4d

SHA256
ac5c5252050be72a06534e137dc287fadaf31aaa25d3c80ad8d3d93016f1e948

SHA512
9abf794cc9bcb532100fac0c7c6a43fcdd8a101ff6717291f0ca56ec0abe01156b0b00c169aa7912dadb59b183d09c1726a259763fb167506e1e1205916fbf11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
856af137f292959a79e42d0e03df6de8

SHA1
00fab7dee66f4c2740a2194dced43004dea6cc25

SHA256
af9310980332d69229195a939094573703061862588f447dc8ea5aa47bd345f5

SHA512
2ad323d4cb88747a307adcbe1d87630f41551a8cb211d71e699d6546df47e668660df9fcc89966ad444d57ed17dad68848caf32c4e93847dbc504351afa79e3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1abe3faa94d28f553295a96c71b587c1

SHA1
3386f7e7ce2f97f7e90db4529d858be41f3fb40e

SHA256
b4e4be66b7b534e69bac839a38876cc87b2cdf8125eb0168f97b96d0422d3a8c

SHA512
b1e012fb62f3364eae9cb2e5761db69a99c4981ea19ec7abfd33e7656e9ba713e760f6fceec8914eb7c9f7a7c71194ea68501c56afe83e31d68d5ce471ac26fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
085bf56b48749b85332706c05f40f6bc

SHA1
1e5dd8211214fb9be32df4c8efe6f80234b0cc87

SHA256
3955e47e6814fd715dc2b0f9b877105581630c7ba841eceaeffa0b3ab054fecb

SHA512
4cb4b8ae68dd633e311e025cfa21e3324cdeef22954b47dc726f901f5b9fe1a01634c2b5d66e1cb1737f65f0e09c62fe128ba235ba23657058a29cbe0bc591ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d39d71e26bdec193374207cc1aa02dcf

SHA1
1cf17b101061a14811dbbbb357ff9bae16e3d3a8

SHA256
bfb43d7567c87a9e3eb119e6ea3709f63402da93440237aaa5c94d04da7405b2

SHA512
88fc73c6a0ff207a737ea0c2e9918a5caccd8251ea9429a4b1f622632f1309fbb01e8af3824c03fc8e1efa65a7a96ae21b192e810e80a3fc67a6b8593d2da7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d0bdef3d6cab68d4b0c336eb936bd5c

SHA1
516fdb95313c4ae3d7e4ecf9d8b5c4919b8204bf

SHA256
b4202ded84c2a11c35465944b5fe4fc358522c33132a42d608804cd82e6b5bb8

SHA512
ba9e611dc227e119da6cafef8e6efbbe5dd876eef011d59b393f1e991a4985feda01fb79ba0c6b011d15b61054102b4b3c1742276c0218280f3ed6dc4c6ba6e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a360b20940b26e0ae92f91b39118d05a

SHA1
0ba82a4868f5f297d43b5c22b034cbf94014f8c4

SHA256
edd562f57a8ca5572a62ab7aea14ee6526b777f1a485be948a9285ac8a781e01

SHA512
823a40aeb338342f1cd1bc5447d3e655ed602a396df9651b38a5d61b3475af16d48cbb1902c6286892878f94d8aee3bd90cd276a6f75481f2131c7d47689734a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3EC7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F08.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit