c54829a3b241d3939896c92c9ddb5186e7989a6852baaca2012df2b6eb5c0566

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 13:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d217ec42046c42f2991ce8efeeada36c_JaffaCakes118.html
Size

213KB
MD5

d217ec42046c42f2991ce8efeeada36c
SHA1

c24cef013f9354c57b23055329e9293eab54a70d
SHA256

c54829a3b241d3939896c92c9ddb5186e7989a6852baaca2012df2b6eb5c0566
SHA512

8cadcc4307efbdc53c4151948758fcb53f683bb4820b4579ec66ad5a2ea413752fc1c8195bf28830ceaf1c9cb7ef49ac67369468a8cc57965ed5c16eb14befc8
SSDEEP

3072:SzpZpoNO8PonSyfkMY+BES09JXAnyrZalI+YQ:SzpbxXsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49E2E691-6D21-11EF-BBD1-D686196AC2C0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431879393"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	iexplore.exe
2520	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2332	2520	iexplore.exe	31
PID 2520 wrote to memory of 2332	2520	iexplore.exe	31
PID 2520 wrote to memory of 2332	2520	iexplore.exe	31
PID 2520 wrote to memory of 2332	2520	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d217ec42046c42f2991ce8efeeada36c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d19d36b855d2b1101129493e686be25d

SHA1
ea30f70d54431505a44bbf22593086d09007ca0a

SHA256
d161206d0b10ab81b547808878f4682d258fe0e505a03bd8dddbe5e19971e60f

SHA512
40b0d3941a83f487631315674193cb3f0590f52b471187a5d2625284c7af0eeaadd7c81d5d75361f9e3f37a166987993665f8ef78771d6716647cc2cc9596036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d09445bfabc3ad8f69d05a9c78a92eb

SHA1
7313b9769af331db94a6aed61c9e15c7c8a334ca

SHA256
783b906f6a519d87ccd16bebe3e92f53c9ad58410e9c19b7274f7d106d4747f6

SHA512
5809b5b95e2842067183cad1d8022cb0339d209f271adaecdbab6d3275c8fee2f2dc8365124fb930758702fb999e70491dcb94560cceb854144b20687ed8683a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29313e9e82a80c2943afa24f171983ef

SHA1
fb84d3534d01021f23e131fa22655ba320fc2593

SHA256
420bd5a81f0e62a8886cddaeb922f683768b7196c439a6a78570ed4e6f494c56

SHA512
fd70c0b3937a34f1e62a1a4353b96d7dd423727adc91d1d96d2fee4fa6773b72b6d4a3abd0f28aee498fef2ecd255c27d97e8edbc90e258c0dee4fc995962153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb1a3843f351104a7d56302464c83443

SHA1
e3b422f28665b1c7c913b09de05f9ba00df114ee

SHA256
e55721475cec2d5d8d164885dc906bb7ed872b2c1fd487cfc2a1c77d11029737

SHA512
ad037e7aa3fce64cd182a3d6ddcb55f50b58afcdd85341bcf6f7c04429b632598133dbac4994bc672964cc572550f13dfbe0e9c336956cba731da804cf2570e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a4e832079ea5932c43202ea246c1e46

SHA1
374f1e7f4094e14322ef5c490ad3bf7ba4a684ac

SHA256
38deed3498e16b64b62c5b57d059667fb4270e741362e7bbfc8843fe85709f31

SHA512
44368d2ff0248a6368f8c5faa80411d60b922164744b1db9669ff395709ce8117041c0df87fd5a53c31e1be7ec9dac8a303b487a76e8cd1554db6cf2d47a126e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b3eb527b8259955d6ad58be6e67a83a

SHA1
4d43aa4f6bebeb93e3a53e72f55e538183d6c325

SHA256
0edf1606451593d3aa150b80011a012f9aae925dd06f7c30f7de6e18cc270a20

SHA512
e5d692244eb8963e35daabe00a36822fffea7af1af2f1a7519dc681e211ac82f12b91b5ddaf283bef1f24ade8c379a2f84fbf7c9803c9ae9c3b18f6b3d744f0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbe838956f9d56a3a8aa3d2dbf23193f

SHA1
d41db9c06083bab74b0ed400f3310bd080d579c3

SHA256
18f5d0c807da176ec4415d81f3057f072e98938e6ab73d06b0fcad11c19b8a96

SHA512
b1b709645cf794316ce754daa571f7ca369ac594ffe5a2bdbad8bb2634b261630bc14330cb09e2b1fa3fff7c3c1f89a174546f4cd916a149746e5c44af07815d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6976c37c64ec9ab1ed941fbe4eb1d617

SHA1
957742f9751e39a4666ea183ef7072ecc6f47fea

SHA256
01883ba62725bc85e3841efb0ff0463dbce44458e1bd2419bf322a0b70f39ff4

SHA512
132596cc96e2994e27be4860f1fd453f9f166d2656569d65a2afa30d24ce6e0f45413e5cce415f0c951f3efa8871a38dc1eb056ba0c1566abd5f05cc1a694881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d22f80b1155bc264ee1c71f8891fefa

SHA1
d34404d083bd49a54e3aeec8c36635a6eca6db53

SHA256
5919cd4ed47c567dd0a76cd22b80e0598a75f4aa5dd561f2a2f672c2177cb076

SHA512
23868cae10105301d7a6ba1190e80a132c543bbc523d143d414c460a9d9c9fc1c312b3513ca677d72106ca4de9b84966417a3225cc4c8df5d487b1efb00f10d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48f8be3c982708d6d0ac17ff27233bd1

SHA1
7bd010975ed5bb4304f6484ab526ac6cea396f8b

SHA256
5944a10cd0f4137edb3af7ed3809ff5025297393cb0c55e8e739e2c0763a9e64

SHA512
53ebc352183b114f49fa5c16198f735f0d4d99c01954c4b240bdb17c43bb79ffd69586d26cf57027765be1237c3ddb4fc247854c5df4bf19f9e52734ba8b6085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
856844d64d49cbae336feadd74e2e7e1

SHA1
fe4a16c54efcfc7208a184e76383e2453516fd43

SHA256
a5c9b9e177db8aebeaa9082321b2f6a111a86725785338119b994c9416bbce9e

SHA512
11cd2b41e46ddb08973cc62a1b8978e4f4cf7993e89ae1a1292bc67820ed70c0bbfcfe99d255d040c6a5aac09a9ee40c415f4ac88e64c05d187150fdd7fba87d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6528d9488cb07a1e63c063c430fc845c

SHA1
650dc059ca4af70569736e587b5c46eccf50e5e4

SHA256
f646280460d6b2a5fb11d4bb9c982446c602f931ef15f36f7f11f013f9434d99

SHA512
5dedef3c263a630632b1026256225a51a55d1cf8f7436142a64b1e90458a44c7789f1a7b01da83ff862286794f099ce95d4a0078d4f0b598b05a12851940229d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80b35b94b8b637d3317a75465036adb8

SHA1
7cdb9d1909de77324c9fe393b7bd5c11397606a0

SHA256
ef7fcfd2ce042d49228e87b62dca9a3ba2fb711f1aa909e6708adf553a87d95d

SHA512
d7f265170aad62aead929d096b41e344016a550909baa62b591a7ab3209f88afc4f918ad20a08c4bee49226b354ebf5c265e8387e6ae463924918c625b3adefa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd2d299fe454c3fbead86a2a415d2187

SHA1
5fbfcfc976c285333a0e1f5fc9b388be61b1ba21

SHA256
22953b5a9c947a13948a1ac316b0f172a73f40a8784276242d0e035a423bc005

SHA512
363c499832c5c341f8dcba03d17039f77fd48fb951e0c94cb1a10d43b750fc41f3f28fd187a0247d7a9d7f5cf4c876712418df1631fdec0c1b72319e3ef1e727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e0f022d522c91977e606942c580ef0e

SHA1
3c4a954415ad46de4bc464655b7b80d27ed04633

SHA256
84a52e7a403c218980134cafae5ee4e935fea5a2fe9f65082f4e521a7454a2bd

SHA512
57ceb22280718cf50686edd592deb7a79bea1dc12abcf7e5163206a4535e96065654dd19f8497825a5a0153b40c5868675216011ae6a0fef07bc3e8340dad10c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8493e804dbf5140072df2a91d5ddf75c

SHA1
3111c6195f985817967176e087d1235df5dd7cd2

SHA256
27dbb967ea724513cb3b11d8cecc88f47fc4001fe97316c9b442e8e6a8e7bd6c

SHA512
4eb76fe9d8eafe171dfd038ba24149a7e4f501b80b27746c03070fe7da4fd3f51deef43f8abd7978a9f9197ba00ff6551a27cdf2d4c48431e571d358bd773a9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0eb994c3b8f2c95febcc53f01c2d5fea

SHA1
f0720618edc4c37aac4895958853d8c848c0ed9d

SHA256
888b789609b5fcfd6a2dcb944e8215b6c61efd96d46fb78055cab58a4ce0e522

SHA512
ae2222ba7f191d0a7a0d399830d7aff2f2b915de440ca4522398529ee7ede8522e138967666f91c40b21525017a13e988ba202ca97d22eb27f9239ad6f8ce510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
691db6755d5023bdf83158060dd3f637

SHA1
2e89470275510915ca7c5974b8c7c407b312c0ec

SHA256
a9d17c349c7a99e471e5c655578a0e045625435e36f0dcdd95b2c19a4587bbe0

SHA512
b65f4803c958b488c6da9bdc23fe452ec6dd042b48fa2987a4861ff1f2913f9f74e05b79c7dcc70a3f45fdb5a44a2c70d193cf8f4120640bb24603e21e83961d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDCE9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD88.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit