ea059162d8370f75ffa4723251d8aed0c10093610f2a45ad0367cd2fd184c58a

Analysis

max time kernel
134s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2141ab71738c5fee9ab3117745e9262_JaffaCakes118.html
Size

66KB
MD5

d2141ab71738c5fee9ab3117745e9262
SHA1

747dbaf4ddd8d6225cbb7ddf8320d6e42f4bd976
SHA256

ea059162d8370f75ffa4723251d8aed0c10093610f2a45ad0367cd2fd184c58a
SHA512

c97c386e0e110f7a3cd5fb306dfe6c615beff5e9c7e2b09a9f6db1f016c78715731bdbaa4bc9821d33f10d688a75f548188db95480f310d902791f7ebe0819e8
SSDEEP

768:JiogcM0St8tN99OIs+mjleL/oTyVhCZkoTnMdtbBnfBgN8/oycc8QFVG8sP/IjkE:Js+qAgTegec0tbrgaCcFNnzAC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000b1e01d55f304aa0952ba6d0e1df8a5917d736d719f4c75b4e62664ef90400050000000000e80000000020000200000006a5e1217a15e36fa6dc70df344bec9caaf4a5f46cb7c4cd568806cee876aec66200000002450269f359b1a7afa5a79bd6207559f39a5019623bf121951c65772319362f840000000837944635ba740cb053478de2838e677cd07fa1fe1353448296c2e5a70d3a87378081ab80d6cd2104d9bb59ab14556d7198e257ad8ec93324982ae43bcf75cca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431878927"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{283CC8E1-6D20-11EF-A0C2-62CAC36041A9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206310fd2c01db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000095e009be37ebe7b4126113208935b1b7f908f21631ba820d40ac4510e9286039000000000e8000000002000020000000d0b96498237aa36fb2e136c93407e8e70b37c0191f6f183b9be5c7553712f39790000000031104e36341aef438215652079fe5b3a02a548502527919cbf6c26824e01e80a8ba4171407097d48a374f27eb1ea26c0b11b2f427e7233c1fae8c5cdf93faeb4c63aea988f367439dc299fc54a1ed83cca084b6d9730d5ecdc840696144518c3f72131e2748c1921f36dde3e12f6d544410e66ae602d76c52a2eef4adf4a63da9483373b520d8fae4b438063811f8b240000000d55f7af4786d2718a9714b8bb745320636a1f26ded7340b25d60f04fd3450d46afc699f35fcf2840b6cd3285eeff89aafd1ea3be1c0a3219cb32b7b4b41a834f	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2896	2848	iexplore.exe	30
PID 2848 wrote to memory of 2896	2848	iexplore.exe	30
PID 2848 wrote to memory of 2896	2848	iexplore.exe	30
PID 2848 wrote to memory of 2896	2848	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2141ab71738c5fee9ab3117745e9262_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6f243afbff8cf7ffa26474e8ce1a8bc

SHA1
9f820f2afbe29ab6ff7c95354de4a0af2480eaf4

SHA256
7dafe055fa19c559360321ea10549a48e71689a5dad23d0b57ce0e243faee80e

SHA512
ab502b068f5ab531ce5e7e0e128df21392cbd75ada6a7bf1a9c1652a30235cca98067adb73591135348f459cbb8f8c361aa3880aa2d3f71fcaad97c006c0ca67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
009b1452b5ca46266cb194e0d0dda872

SHA1
9ba7cd5450046a4ca423309bb1f86f2ceadcc485

SHA256
41c8e6f91c96e778450ebd8cffa05f175af5b39955dca1f75e960436c9eb5ba7

SHA512
dc92f427096863edf655c1d8f4263b79aae57582ffd7286d492ba8ac6a4df6eca18479ec795ab7bcc27ea0417ee06d3d9bd5b851295b5fbbf47021ef7ca91b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0183f4cbd615d9f9b715d687c8341fb1

SHA1
d528777d5dd7907d0deebd9d7246a7e0c51009a3

SHA256
7685b1114b557bbb1fe3bf6c424fd898d8665ff5c4278959b6534d048d2d94a2

SHA512
209131b512ba11dedae576857abde50729593a0d423c665612bfd61627c8794ad89ba6333a07d935b6d70620c6410c429a3a56cedc3e310b2ddc1ef7edd7a154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9510ba85ce2f92e6c9140bb2fed7344

SHA1
62dbac8402f691d7b0cd63ebc6ecb054e656e083

SHA256
3a1eb42af6dafd3511c7c9d8543c3a5a4fbb4b8607feeaf17ee8876d5057ea38

SHA512
e5596052e0d347f3aceb95cdbf80485be9737f3710fe8b056326a78a7691399b54309e75bf2d681f03a5afa5ffbb85e23a56844f798486988037b97025e57cc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33cae54a9626aaba3102f0ed0eb43e22

SHA1
341923306e660aabc0bf590db18a597466eea65b

SHA256
01f9954be64278be585d39dd5c17ce844e5cc232a6af006900afb73557a3a614

SHA512
abf821fde3da0dbfce3a2aaab98222974c6381924bac37b0f5f69cb92c52b0c17d6186d47dd3920ac45a11a46e66e67ae9e9c23c64e03f64cf2c7dd6cd6447fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4abc579bf1488766bb18c75fe208eefe

SHA1
29e7c4283bd67b507891939ceea238ff2472dc8f

SHA256
50e994f1d3b7c87a35e47511136ba1e1f8738005026c7458c6c899a071f3ade5

SHA512
10c41d5b13521b2ceef83fcb7b4a655fdc390969c7fbacedd7082d0d8f0eff73157b64938bce389421b22b6c7542cc1064a28f73804bd6310617f95978299811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30fb6385baa39df6be6bde76d371fd6a

SHA1
d8963c54c23b446e1579c4d8b452e12cf9ea3b4e

SHA256
a44e1af63b8753beea24828eba55901699490b42f446f9f568a59fe386bb2c2f

SHA512
8469145a155492988ea8f6654942e481fa46d478557f3d412ceb069a8dc0218e0886219090529c758e20836669d5c48c2b51475452ae8788d5f52c5356fa8071

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61cd3bfd2b436b74b62ddbc8eaa7ece1

SHA1
5765509a0dab87f173fd82d36b20df3fbe5310d9

SHA256
50cdbf46a94df8965f8e101ff79b1653396db77b66efc6f7de12e83209cbef46

SHA512
3249f5d6b14732c3740b9ebdbe9588ea88b3dc1007f8f999b89716fcc0d189a0105d169bf81b6ba4c6200bf6552f62288be70d59b4e94b65946c1a4e0262d613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6620400fc75c9c28890abca47f9f8bc7

SHA1
5bd2bc9eadb4def79d60b6210a84b44e7846a889

SHA256
0cf37ccb0c19f8bd6577190d3f287cd312e00c26f35cb599c16d897f710c889c

SHA512
3767dd10df95086b232b42a18d2d0c82075acf3158ae1d992f6ae976071259cd04cc34e74db2a33302d0893e7146dc143fe699c1fb62150f91f5abb6a09a26fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
046c0b7a2641f71cb3caf4ca18f21a59

SHA1
5c8e0db4f8f658c959069b5d6b94814bbd6d8c6c

SHA256
2d082032e5c50e713f75d0a0f60b71ba740f41646618feb0334773112e00649d

SHA512
a19e960e16153aacdcf578a3e035270f19b659b4055f627a3d6b056e5840fa313bfd9d0b42de5d0f44fd9c7098af406fb11561faf2c07b73eb27173308c38ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c58567753b0dfc74125111cc12378380

SHA1
594668977a06935df158689b8afd9c6ee2ddb77b

SHA256
7c9fa73adc182a879c561dfcea70983ae9fc9639bc3d187dcedf9e76275d9ba0

SHA512
5a121c280b75d9601e93649330c91109ccb7327684f96131bba07b849ce2c551be0c73abf55cf431859a139a5133ace03c8e9710d254961a58c9b05b7a91f06a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7EE1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7FA1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit