65c5d6f32afe71374c9668523780cf1cd793174aa54bee0ded09c0b4151ec8a1

Analysis

max time kernel
139s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d2623ecb9f9264c872b09ce33187ffda_JaffaCakes118.html
Size

72KB
MD5

d2623ecb9f9264c872b09ce33187ffda
SHA1

df729236752f2efee9b1489b3c286649e7f7a5fc
SHA256

65c5d6f32afe71374c9668523780cf1cd793174aa54bee0ded09c0b4151ec8a1
SHA512

6304169db8ad4041de00d4610beedf006c235417109316e6c74872acfea2f8989c32335e7b49e800f0b8f8a4c54336b25ca158bed1522f8f399965214979d2bf
SSDEEP

1536:ShpzG0i0i0J0X0c0pVgknM2r1sJaZta5MDth7ynRQoumPwiOYc7X9eZ246gAQa4N:+zG0i0i0J0X0c0fgo9r1sJaZta5MDttY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F7631B1-6D38-11EF-8BB8-FA59FB4FA467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000acdba22162e1e997fa8813563827a992b37a1b92f4cb40cc1d9bdd3c1b2767a2000000000e8000000002000020000000d82180ead0a8d877a6640741f414975ae190adbed1d5ba1624eb5eb641d4f83090000000acd8e7c5ebd3df8224f44eafb81ee79d9e6f15bb6f5d34227f514892c23d4ccba1d8cd9fcd0069cf8c042dac39cb167aa594a1b47e9f4d37bdf6c782fba2ade7a508b1ab4c16d718cc1ff20e6ee10e3ad11ca96a8330b0c6195a65e1daaa0184b80d01fb2ed2cd5d3571de8c53fb2d2665f05fa11bf4c75e076df4b059bd2628e8aa9db2188a384b484e92afff336ba140000000dace0114a1c5e7356122ce3f5c520b6d5e9217f18dbbde90748faa83ba6dbfca3f2bf308551ace8976449707abc8f8e98f439c79dbdb32aad60efb2c3fcb8551	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a91c044501db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000003a8750adf452d127e4c22874e12558d4c1693c155719777d70ab3b0ed9783630000000000e80000000020000200000006e978f3285d63ab932d9804d5fe3adebd27a68fb03aab1df19b57a8e17784baa200000008f8c3a07af91f9056d836216b335f163ce6268296eb04a4b9d13bf9a2f368bd8400000008bd80f7a7c9b205c288cab6575083b641a874a9bfc9b1e4609372e79f9547440ff21153709ee62442dfcb257a08941c8ba459a3c089aaad400f1bc7405ad7206	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431889228"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2524	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2524	iexplore.exe
2524	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2556	2524	iexplore.exe	30
PID 2524 wrote to memory of 2556	2524	iexplore.exe	30
PID 2524 wrote to memory of 2556	2524	iexplore.exe	30
PID 2524 wrote to memory of 2556	2524	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2623ecb9f9264c872b09ce33187ffda_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3780ba999b8e651ed3f56158d25b6673

SHA1
6be4aa22ec69d43ef8c1ef572082a4cea2fb091a

SHA256
50bbbd8d3b9b575599d3b9cd0f1e893e94ec55cb43e3dcb764e691846ece79e7

SHA512
2266e86446ca761b94135e1ddb2b8ae81860b7abdf7c30935192727c2f43923817210ee36b43a16484076bdb19a18d83b51cab934aa9a62a6cc815dd9a3864ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c294e924641340fe82870a7cb0c2f5c

SHA1
47396a0ca067ea235549f82e41db6efcb0969dc1

SHA256
f6f1367fc71be97e9768ec0974b4b50eca0ed7420f3d8ccf0054864aa07154e2

SHA512
ac8fbfbb874baadb118eeacf7e190119281fc9a50ecc927b8930a412a6dc37aa76c391233322d3f119c48bf333a66bbc7e1be3d387ddbfd1b3fa5b891b3c65ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2feeb77f4ec277bff08b420dbcd454ab

SHA1
663c8fc255f86a0c2a008503047ebfd04ef3ca70

SHA256
0759fb8e3610c39767861ba8ce5e361dcf565b6c623503c3ab572542978ac042

SHA512
0f138ee880f6485da41557ba25d1ac5dc7b4dbbdd94f3b331365e79d41c5e26e6d805148758061595b32739a39e1265b2fd240d3ef87ac078a8656be04443072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9fb7257ff525ac4baecdd00cea8828c

SHA1
f1848cb37bb221fa2222c493b0ef8a13fcec3b94

SHA256
7ea6f4ddff5eac7e0c1454393272fd9ab6ac071f991d46f19e1fc6d99e26d683

SHA512
f1e40a54f808cda76c1bd884d48f64d0aba40dea8b1aa835c0138c70358e2172551147c2459ebb84a6cd371ea424f6d54786678864341850cbe36a0aa7004351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec1849df102a3b9cd705e5dd1305d6bc

SHA1
a2d4f5f76eca39c70a4ac88d375d4854f2a784a8

SHA256
53ec0065f50d9fdfec504c4052fc6fa49173aa3f07ca37d7fc72015f9f0114a5

SHA512
a50f5661d77c89f9cb183db0c6beebc5d476e7000d7b1000ec67a2da72859bd1ebafe0e6a00eb9cddf2c5cdd363cb0a5c865ab6343d47cc39b3b29b97c3b5710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f5cbc67ec0348377ab8ad4b834f963c

SHA1
8a1f93a8f532bdaf666686f9bb9bdac9872d1b8b

SHA256
168b08458f1184721d4768609ac298a99de24a6e182eaa49a8c015ddab791cda

SHA512
e740f3d1085b5d4b121d31fb76c00629d8f4cb45dffffea6a89bd766d448bfbf8d1ec89b3799809fb8f6681884896fee6e3fa8e46a79b6e2b1d15534ac6d40ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57984fc2fa66bc49a01384227ad3d6a5

SHA1
1c8815e141e72384975ba2c9000039ddb837425b

SHA256
9215fce53b87b1ed6546223bd3a09a49a2ebd44ceefbb2853d3246f68b3515b3

SHA512
675e56ec2a0550724a8192b6dd4bab5062e3d0f37f73f9db1504f45e692ee51614f1e54ff8e1fe0207ad2990328619c4ea8cef94844e5a3289e60f56e915556a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83df626c04ea2c0148a87b285b5a74e2

SHA1
dbe7f10a92bfc31a340d91873056c9c88c0af191

SHA256
3ef48df78ea090d727d46f2e88b65ecf25ebf8ae13f500f4d863fbf713a34f60

SHA512
94cf95f8a267414ba73044679a7cfcfa866005b3a691de2ceb0ea707591f243fd668d6ca4eaf2da64aed984c0c37d12e06f2ea9dd8518674dd293a88b79c0487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1086803c6c6793662264eed455a326e6

SHA1
fe573f57fb7c2b3e84e2d5590346a032cbc449b9

SHA256
228ac7e477ffd3ea9ddf7a45b0164445211a08cda577ba497439c76f627e44ee

SHA512
af01bf80afe86374eb6a898e943fe394017918f66d041c3de96319ebb037e5ff7d3add53d58e4e3bdb433b94902f5c74d58408d39814701070ed7b37f7a8f531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45844cd074b7499df06994dd6d94d2e9

SHA1
57123988a177cc2b5332ac9bda850f108a7a06b5

SHA256
2060edd3748cc56820382944bac36251aa69d4e8280ea964e5783f38a49895ae

SHA512
11539d08fa7fc76859243cfb2c54e17589c9d07a1e1614ce0c3dd8c19cc1262970299dbf3cf18938bdbd932c752a337a9e1f5d997e4e3fa9ab9ff6faa2c66b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0268aa5e6bf1764c88bf5fa7eb96a769

SHA1
3c6e3ba8139d2b44648ce6cdf5b3901e535d862d

SHA256
716ae14b92e74f6d3b8da526fb6f3c9bb72ab88b38d6640e60bba8f01d341729

SHA512
a516aa12e81d0673842aa759854fa5010c20c911fbfbf9cb512d4501e921913e7698d2ef2d4c1f37fb33a299c1f83462827fd5bacefefa02c5ec8c35c952601d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b702c9c4ade8890c24c3186171c634c

SHA1
cb188ea732cc0fa6517ed7a8835829445de51b58

SHA256
c55afa2bf995f29db37160d85f619cd2e04a245b059e92f4a05cb3304ff0f780

SHA512
8d0833126d02e44805ba96377a98284cb6aee68fe247dccc7fba1042b66ff2bb63c23d40b2c95f76c8d28f727ee5631f3cbb1d32af1671be7f05044355fbdb1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
822edb0a9d0f2afd9b0bbe9e4eb4dda6

SHA1
59eaac61774d8a4552572bb8464994e0831d2e0a

SHA256
61372c3746b76b5caadac53b600b113f96cd03b0603aaec45a395f0cdfcbeb96

SHA512
e07771abfe8dacccc08f565e6d06ef1f37bf4ad0f2418ed08676c5dec6eb6d53a2c14d5efb3a10e54558598e505f958bc0ae0a6337bbc76353415b5f6098af5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3604f1e72198729ed73a9b7968da256

SHA1
3d05e6dbb2474eb0a783ef1831c584704da2a113

SHA256
399ba9ba7581a27a2089fed56c826898d13b7395eb1659c899fa27746123dede

SHA512
93a0043ca5e642bd05894dfc4297b755f20f5f844d066b24acdf106790f0d1cc6c9036afe7f69e8b76360aa2a3600e81824a5ac8b56a89775448a6a5e467f1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC78.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACF8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit