17bc261cd090e83fd74c727d73ecad85a8d778fe7d35a808c5ea3447b7a546ae

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0754521f40a847cea01040d2e534591_JaffaCakes118.html
Size

141KB
MD5

d0754521f40a847cea01040d2e534591
SHA1

600942e9dce5aa4562a01f218ea1fed3c2845c7a
SHA256

17bc261cd090e83fd74c727d73ecad85a8d778fe7d35a808c5ea3447b7a546ae
SHA512

2da796fa8e2f03f7e6654dfb464e77f01e4ea2007774f95e69e85a015eb4422ea9f48abbddab817e2974a5642304d76900db9d254ee412bcec8e2c4a2e502c0f
SSDEEP

1536:SnSl1Lsz8etgx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:SmOcx7dyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E958A51-6C94-11EF-BBA4-FA59FB4FA467} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431818812"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2784	2188	iexplore.exe	30
PID 2188 wrote to memory of 2784	2188	iexplore.exe	30
PID 2188 wrote to memory of 2784	2188	iexplore.exe	30
PID 2188 wrote to memory of 2784	2188	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d0754521f40a847cea01040d2e534591_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a21098b82bdd67f254edf77b97a1f86

SHA1
9c773a4ac5d05103bb94e828b6bffb6c6ff0fddb

SHA256
1ec95c85d0306f997d5be4a52bb49a179739af775e2ffc827a0fd775a34e564c

SHA512
667e16d45002dd466f33c2eba495d6ca38ffe88168f6a14c25a95713c2e111030427fbdd8d875553e01d51e34d5081a43921e627d7c586d27ca70ffe4d8ea153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19db770a30b8ea272d5f39d3f3f7481e

SHA1
3b71e0b4ab5c23ce3dee9dd16c1d02326841a67b

SHA256
67b55676a3cca90569a36e5acbc9646beb64cd0ea635870fa393b835ec689f68

SHA512
16e30391ac2bf90adecbdae8912155fd133ad8e03f4eb884c90f4dbfe04c0b9943bc20fc5f24d70380e7d268e6df5f9300d07dd2c9c9053374f5164777fe93e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7853836a6bace23d3ad46b01447a580b

SHA1
24579a05aaf3f6ec3abed07ff99d5ede4f13a12d

SHA256
3cf41783208e3b7011f1b5da6c55989c8f04bd8b86464e2311fb540932dbc60b

SHA512
b07396a09acba870e60b0c3a2680699a15cb24ed1bae34d91f1f58d04441022baf3ad26a7556a698601a0d74bfdd9a9202349d4bb0dd64a2e443d79f888a801d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bab4854129c4f0cdb859d28db4dad607

SHA1
441c1a7680d8121e4f8d3b4dc74ab8bfd864a21a

SHA256
d52ddf191b30e992b174c6a8bf6dbb002a1d1778622594c48484b36e5d7422d3

SHA512
5280f8d6517ee17ba1a305a1f1cedc4c0e2dc26b643a68420ed7bb27e01b713208c93148d9255dc22be5da562bacad6f46578c50e661c6d6daa4cf9ff94f5ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9c40fe38868c48d3471e4bbe7c465fb

SHA1
3129d3ce9f2edd4b3bad895c7e3eb5ae79492212

SHA256
3a70b0c0339b80902aab9cc911d5d75b60288d3f14f0149709cf4af805d308a9

SHA512
410b37ba64d0b6fd06dacc666c52901faf99d74498db2fda832ae5ea0d88b99774a5f6b9b57a7f0ed3cdaac8364afdfc3f0676ad4dcf388ba93fc23b045b9ba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad46ffdd0678c8a7f963f2327cf13d71

SHA1
21a62199e23cf326b191b7539db61b4f05739b74

SHA256
a6187e14573d5ed350a1f82e2d483ea8fff07f0f34ffe5e5ed0bc0b0e3531fee

SHA512
8a8e95c89714d2003a5c6542ac6f6d3c29c2ec19e1beff6d715b04e8df45652cb1e572822b79bf61ceb963e391a95f881d3c8a9d016394cfcbc34d73e80d585a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bb6f031f5f6499b47bce64dd29cbb04

SHA1
86e4b2fc57894a680e82176cd1d0adf777daaf86

SHA256
b5ac5587fc3524b3bb639d027bfb155ca1bb10dc19bb1e13c530aa0ccd9a1015

SHA512
a8fc279fedcaef887023956c1c6217e72913430de9b01f467340c616c18e7ac1b5c4653064b1ccd804a7c243b04ec78d6370f5b51f606a8e7e00e44243220007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
115efade6d0d3640ca9598d7d096a172

SHA1
1681ea3e7bbf568aec38e4d7dfa66c3922f919a1

SHA256
62a9eed686b0c0015b843c5b871831d80919aa66be3fe48168edfa5e9a2cefd4

SHA512
ffdf510d6c370882a1d2513d0a01e60e821c338ee77851904c9da9e67d15afc27e54d183b51ef8072cefd3840796b8e851f1ddc2145ad926ca901ad65a31774a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd3a8908165e55dd2bf32cd359e7c3af

SHA1
82dbeba39272bb389753dca31d257e2fcf031925

SHA256
1309ba7e0712f6a8d5161d3fae60a2948f4f85e58d4afeacc19b404932aa3685

SHA512
7ac8e58cf58f0715754204ca7dfb668a62b21b10603676da68fdff643eaca1063a977d0a277d9cd656299dd7c9f507c05522ec63fa26232d37c627bd68bf41b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88a34f72042e57f4fa0e403fd3ec01e3

SHA1
fe3d5f3952b2a07038e4108ae56ef2d497ca9860

SHA256
ea44aa093b460bbe8b1aba5558bfff42a57ecfd4daa64ecffc3c045945bd94fc

SHA512
052b0debda1fdc9576944f2bdc085b118a7db5f89cde2037490ce6d033167e03695d3b61fd9aff6f65a1226b6fe84e07a585eba64efbe8fe176301afc84f78fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ddd9141cc3c6e522b2159a938a4b758

SHA1
e05cd5dc69591bc3e803ad6825d5aa97a7a11d93

SHA256
7422d49a00fff814221b8461603c57c804cef7ebcbe7dc7a6646040400d6ffca

SHA512
f0e25495f402b3ac666395b43a742ad5b741047756a815a22b8fcb3461babad7a927ee4f4be11c4d2354a2617aa0cef2671024fbdb6d2994973e9e82a58cd7f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfd89620373ffd058a783114c0e41b83

SHA1
6d4778af3bc06a7f70e260a9b3fa9ea6be595b8a

SHA256
7d1608b00eaf8c1aff045b47e4373085c0c5377be5c7f067c333f3f4b381cc10

SHA512
b2764e0e5ced737d0d17583f11b7f7725ef125ab910b9d5e30c6e47bec10b178e11bd4ef437e4f22881476da4001fcaaa63bac2c4678ad89d29b30d5a15925f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5009d68e2745b6572acd94d0ba557b8c

SHA1
dd86859c314685d7fa41da5ee06f767108b27548

SHA256
edfa026b72cb2e3d41807420d3d44bb7a0075ac50e218dbd4cd2d9b1cb0c741e

SHA512
f35a26315119cdc1c0e1d1e23ea210854fff3dce5729a7be9d877a6ba898ce00e27424ce3ee86eab79e1202c972e18521df0019184c2d0470e9d12196c28f8dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99da19652a69e44dbbc4a4afd9a23ffc

SHA1
1a2b55845615cbf4899dd6f226bc5c8069a98114

SHA256
d153ac577faae0ff73a697f3a5b24a3d2cee0c94b352ad1e68ff8b0714580196

SHA512
a19c4100d81b6c3cddf0eeb194f815b1c641db11b8effd9e60d71d4c3bf7585953b1a690c30908d9c2fd2949b14388cd34091c4195a257771fbbe175f8d97299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f96be8dc8224114a32ba702e42d7b8e5

SHA1
b98e0c8d5678d067fe55ba6080837c579d47f08b

SHA256
9197483809848e209b99172b55ce1a762535ea7a878e28cef956cf2e01d74286

SHA512
7097ef5d40b4e8ab232b83c79fa7afbed3b0118c8fc63777a6e08e84a5183ebdb1bc9567bf8f98b13f389412dfa636a049c5495ba21c323d73ccfdb952a82fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1d21e053a53636019f12d4027fb0cae

SHA1
6768560bd20b06548a17dbe16e3122fd60c4f21c

SHA256
8c665deb50b8842811beed927591a217c3649f94584beb5cc2ab9a7c8b58006e

SHA512
04126fa66d66d0b1a22d2dd187f83860224cdf159b8677ea62d32f47376db25773c20c0dcd6e32b29b9e865ba09acc5c9f3092d0560cf05fc5b294ea8db3dac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
404c2d403b11d59c1c4fcc45f95e17e8

SHA1
377c4baac6aa8c39b4f8766336619191b437c38e

SHA256
0ac507d2ce2743e51a06da9bfe40101b590f30e86e6b293eddd5d72952a8513f

SHA512
8b824f73250fd6dc1c565e62001063544839d7d38543bee239f904f2aef87675896e81cc743fc67eef8b510201d4d9653e6587f9a186f3c1d4de5a5878db1341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae9eb357949a558e749d434dd59333bd

SHA1
c67370807f3af06f7783c033075e63b819a9d3e7

SHA256
b4bba834581d210f56ecd04559b5986d18150ff1f572e954e45d68077c22002e

SHA512
8424e8a0c548a947033b079b27a6c922ab4da19f483889a680fc86da9a1759749d3fd63260246d9cbff8fd3b46cfa9981d911498f411b48f20c091c1611a7824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42af35da9f569518493c199dfe015b83

SHA1
aebc1a9b443d9400e8a449667166558c2d18a247

SHA256
a82800b065607550b3d4e51c5633709fa12ab7250965bacc2f460b6573c73902

SHA512
ae49c3d1f98396eca476136fc3d2f97c2f64c31dd451f8ad8711a40913353c4cdf4c11b81516dde309630197dfc112a334fc6956c9b51f546636841578487361

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF5A7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF617.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit