848bb3b48eccc2de0c5a1d6a3a9ecd59b89e71b89d8a1f75fc51c0f99d453bb1

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d4e8e95454bd38b64969427d7a9de85c_JaffaCakes118.html
Size

69KB
MD5

d4e8e95454bd38b64969427d7a9de85c
SHA1

5c632530cfb59becdfff94f76372a29cad17758e
SHA256

848bb3b48eccc2de0c5a1d6a3a9ecd59b89e71b89d8a1f75fc51c0f99d453bb1
SHA512

d07beb2471d25677e386cd3baffb9eb5b006ee10d8fb3432b35a64ef03dc6690e22f287d575e7ec2bd599d7ccf9bedd7e7e77bc818de5d26c49312d732c4f903
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6sD67SNoKxiNoNxDfoTyS1wCZkoTyMdtbBnfBgN8/lboz:J3FuTTzNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{598E77A1-6E0A-11EF-BA23-C60424AAF5E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405fea341702db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000fc5fd2b0450cf532b3040fa1bb1f9a0b1a7f495056c9caef7ced9567a59d1d2c000000000e8000000002000020000000ae05de3833798c74ec832dc8e8cb7c4b6fb35376ec42f709c0aa2074b933c3702000000058a466c43f86cab8be57e9d2ac8fdebfebfc4e27e9f3baefad8f2536a5927b04400000008f1e0bba931b76d1ea5972aeb75ec714c4f87de91f9bed9d540ec6eaeeac4b1b4ba773a18786b2076294815420159a5e9e856305f04436a34af3b7942d5130db	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000006f57df99c4615fe5e738b9486ff7a71bfd3133946fc76e02a3e8342a8cdb7293000000000e8000000002000020000000bf36e5e3a177dd0441663bbd66e8c691ac2fd4782aaae8e954f3439b0dae56da900000009cadda4718a785c6508c7406fb947717b61a5230582316e57b1a2656b5ae4583aa899c8490396576f8364e5819f11140814f187f764f225f516544bc0a2c641d7a07819b5cae7a6bce7d03252d9bdbfdf99265d5faf149135dad10da02ef44bbff9be52319409f12105f64ed70526be5348b7fd91379b17823a49fe0fc11aa43a2cc005c9deb503874153d3fd319f968400000007a2f26266f9c59cca08fd38a2f32e02347c9426a02f975e885f5483b4c084ba661029e8c40264d01db548fae38ce6e3d049a275522eded8869db779d715da661	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431979488"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1968	iexplore.exe
1968	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2684	1968	iexplore.exe	30
PID 1968 wrote to memory of 2684	1968	iexplore.exe	30
PID 1968 wrote to memory of 2684	1968	iexplore.exe	30
PID 1968 wrote to memory of 2684	1968	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d4e8e95454bd38b64969427d7a9de85c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a85558e3944dfc3b022e9ca514b54ac

SHA1
9113f0a1d3d0ed067dea7b449e8a140dd17d36cb

SHA256
1a8f067f5535ed799e308686d83879aae348451edd7a58183340c087773cb5f7

SHA512
e58388a179713907032a6e11fab470dc6ef56e325aab8d39f39f4648db96e5bd4d52b8c1e460ddaa10588ab6db4af377bdf1a8bf21a1ec37e944ea22053a6e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f1df09a1109fdf6c53d670b8893accd

SHA1
a401abd8eace83a1b31e733c56858dd6851190ce

SHA256
d914ea8ac4988f59909f8fdb780f0f260e93ded1d56d7b6eedd3e95c8c842aaa

SHA512
6c5c3f45c43a0e609e0a899b00cccb2a5c78a438d48c9511ff825bcfffec4d368d5d84dc98d4cda5f064e5e42e36c02bc4e1add2e638f4ca7283f3cd822dab66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad24f4a4260294282d9983aac073d3cc

SHA1
7150b5e23734b16e8e2999b524cfb895afa3bb60

SHA256
66ee4040d65829238fd32ba297facb51f0341acd7ffd9fa43be53f8e8d22318d

SHA512
9615279e11790c9f522c1f1d488279172f0cab7d37e3fcd8ba65418bc81b42c85106906caf1339acf8cbc0c5deb13513382794a84cf8313a036e437b2b0ccf29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b405bf822539417993dd99f5fe0b2784

SHA1
6c759a833a396cd3ab4e3917e59f01a399b3897f

SHA256
8a32210f0ec38a91dd896fd4810cd961d501689db652cd3a6cc134841b4f3a87

SHA512
aaec890be9d2fe95df3278a5ba151307f81d878c713654cea7a7dd86d11f86edd298c465e7aeb30e64b365fb6418ea8b6433cc04a81287b10913bf3402eb56e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00d93de073703690e7fd8b74704d83bd

SHA1
ec992d7974792c63cfa62dc7bbaf79ca974995fe

SHA256
9d29e303d2c179c369611cb7cb38aa0572ae47814933c65e4fe3a41d903bef52

SHA512
a25130703d8bfd0946035df0f9f4ecf7e22269afe23d24d0f0c5f33be03e1568dc6136b6c0c883bdf04ab811e623deac87110faadb45add91b90a201251a3d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66b05b7727119ffe9b6e4f3567f05677

SHA1
66532de563febb16d1c4f7af7f1cc3eb5a7dec30

SHA256
0f6f5cfc46cdcd57b49aeb0ad5f3ebd0fe9f41c12f380e5ebf8ef2cc46f11e56

SHA512
7ea6d8d584786bdc9335142a1ab91173720f2bd3bb1aec1494d2b329ea5f8d244a57b380a84e92dcac856618d004637bdb3a21196edff7b92b9a16df81bfa038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1361fee9d45c08f33069164eca7b02f

SHA1
bb8e770fb9f58c43fe712b7afd624e9dfd1aa113

SHA256
e988b3dcbcf9b1c57e85afde3d79f706a76d4d842706c1516c53bd5a9dca3675

SHA512
cfc41a75c872fec987ff7cae0ec786abedfe7e26518497048f52632c6a1b2deb009ac70ece51707babc44b1cfbcfcd0187e78383936111eecdaa1b4d75c0a0b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbae89a8dfb23bcdc5be8f1f16d25b3b

SHA1
633db76229e295ec1ae4035f1bb2b96887f324f4

SHA256
348b411452a9936e9d661b39923219fc810df6b11e793f69b888872a2236b023

SHA512
041ee3c24777e4a58600dc0fc4fafe2f231b294e9d6dabecaaea471ee535a58314930511d013587a2aed5aa8c3da38434a25c9ab7daa3e855916018d7c89e1c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67952760138ab94ee820f876e07e71a0

SHA1
4924010818ea4f1dc30061402379f4957466a166

SHA256
aa8f46762ee909c51b8e2a3dc09c0280159ae0016c01c573b53e157c86b9e39e

SHA512
88a4a5d62fc1d0aa600532815333d2e6a2a931c86328ce7fd4624c29b4ea889867920d7097bb71c28ea626eab1ef9756c2a42c61ccd65e8bbb7cab7e43c3f024

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d46f6915854d18d7d5429bc0af8c74d

SHA1
e2304de8b580e26fd9845128f48b17c86cd07f8e

SHA256
a1f20dc1f4619825fb17ad403a9f57e50d0ac771d605729d4a897548bcb7831c

SHA512
ee98435651333435d242ca9406da4b36aaf716cff88a77a22f3309a7ae2be5583af607a2a609123b8b2a84e1c29962850d65690ecb8e7bef27a1ebb9556d7498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7327b5c4895a6fc754233a4b293e152

SHA1
c05c603dfd25cbf84262354b238f84576c83d041

SHA256
b594ab3ba0bcfb226b43402eb0b9ac4369278e000dedc92257fcf291ed6098b3

SHA512
c7a71882edc9a8d908c13cdc5d2969bad1d5ebbd9c752e54de1a0571139080399a7d6eceb1d6144c98a4b4264478711018d7d4878bfe2af71d92ccd0e6d7585e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8f040ec2197d006a83dca22bc2bc274

SHA1
c08790c55d5b04dd8b9567fb56b555ba266f3c30

SHA256
ccffa4b1275e59ebc5cffd04ff77fda6aebb9a46c7aa6fe35c2cb7336c9db98e

SHA512
f3964339e795423600d479b58fc5cac6219d2ff6c595f3848c288fe6c99fb4eb1d4e1600963196e71d39d536bb6bf7cb8e38243bc205a449cfb36cf8104b38b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55e4618e3f57b6ac697d6afecbe351dd

SHA1
6235320821f2bdc406314a802f769f9aacbe0b34

SHA256
adedf874854bedd20ea0d7b0d8d22868b5e72aee336bce6b131e039bbd40acc5

SHA512
689d89f05559fc8c024df9238f41298c482bf01f4a3da98390a226518205cce7f567f17e874c98d55e54099f4b48144d5a9d2e5f2aa6c6a75982ae6e48f6e67c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB2C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEBEB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit