2e40369476e3a68e40d5c2e33aeaef236b87ad516e4e4c04ef2226d2dfbc0b92

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d98e726681f9d8082334622abfd37a7c_JaffaCakes118.html
Size

47KB
MD5

d98e726681f9d8082334622abfd37a7c
SHA1

3b43aa02da11678d045d13afabd6e9b983c74f3d
SHA256

2e40369476e3a68e40d5c2e33aeaef236b87ad516e4e4c04ef2226d2dfbc0b92
SHA512

12047934713a20ac29c3a27e4c713f6ec96f9d02371641eff5ee414990bc73b61f546215e9864955b3e7fea38334749c353df338e5e69d1224019f2cba3fe484
SSDEEP

768:kobmIGiXPXDbjmPKcu/B2fao+E7eSyh4ihibROhin69KPUy2JtCx0SE9R2JtCx0T:kE6PKl2fao+E7eSo4ioYhmcKPUy2JtCF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CEBC0731-6FF0-11EF-B44F-526249468C57} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432188424"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2556	2360	iexplore.exe	30
PID 2360 wrote to memory of 2556	2360	iexplore.exe	30
PID 2360 wrote to memory of 2556	2360	iexplore.exe	30
PID 2360 wrote to memory of 2556	2360	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d98e726681f9d8082334622abfd37a7c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94116B1B812EC997E6041088FD2F16AD

Filesize
504B

MD5
a7de316caa5d52fa82747d6f76f91043

SHA1
46d8ba7a51bc0ba31b075fbb49bea54bfb33fd6b

SHA256
b8c0da6864a674c3ccfc82d672a26b744a3d16035c85be49de1a5b74f4c5ee21

SHA512
66994b378a68109bcc0065a05ff443cece4dcbaf7d7c05ad279a1774b9054b8023d1c1c490bb26c850199458dfff053b198e190406d063264c16044ebee3c0a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7b6b6137f00c7b5a2e19bb384e9e2864

SHA1
574b22ed147319e4a4aa0b4f7ef646d028c50954

SHA256
1666f66152502a07a61dddfc17b9b6bf3aeb371c00c84a49bb950633b70d64d2

SHA512
c9e42dfd31d6ec219acd0e27866dc3f7119d7f13f9f08f161a0dbbff1440e3828e93ccb87c00d064239eccc81a15807a0815d1a59df7dddf950830293f158c81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94116B1B812EC997E6041088FD2F16AD

Filesize
550B

MD5
b30a727555fa9478e79680a60af91a71

SHA1
5b2ce102632bce763586dd30f512848f46bdaea4

SHA256
bdc3dc0b81c375e25c54c617a5c52a753d8162451042acebfd28881e8e5338ee

SHA512
f00c1776e7271e4a60ef11cbec84977314162638cef2dfa59f9c1f2c3efa701a4aa27495a5d6a2ee9d295abb09cb2c5837a3679fe48dc40dabf77f9476edea4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dbf936f8310925096405367afad944e

SHA1
6d2343f3575706152f2660a21fda17135dfd3078

SHA256
8932f1aad4a6c04670df332927e5b4ba8d21afe2b0ed60237821fac3198800e9

SHA512
b4d74f515cefac7627813198686b5c873036deee1a1b86afb676e9f27971b38bd6c9ba366e9c88175b983cf13cb7e2e47dc6c1d38a676339e77149b40af41886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e20774d1ed0a80446d2dc8a54d484dd9

SHA1
ce522af785cada2174970dd757b4a71c3e0e32ff

SHA256
50a403de29022d7193657da391349ed1f7cca92c56a11b92ec9e4f801e292b7b

SHA512
bec8b6f3ff77391107d6bce9fb56c8419bb0fa8879250337be98517f9ed9f4aa1231d19dd5e004586b5c642bd94da434cca7e7150e35569121f359e3641a3d4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91014a9a25210694b3adfae004d94b65

SHA1
2e2fb1bc6d8c921959213f9da446cdbf97d05c96

SHA256
2d5b5ab524a60149a3a87b063047fa195b743489e25d0beb30390a43ac6b24d0

SHA512
9f94e8912612bc3f05ccc970beca5931a9af4d492f58b59fa5b065f355e6458015ebaf39486a01160df160ca6ea03c3166b48370088a289ffd5ac9ebd7174f49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e3bb0477635f71df2e31722bf8f6145

SHA1
4b01a9d5f2094ee492d22f026b46f43538aab61f

SHA256
4de9be05d0caaa6df75801c752dd9424a6ffe514597442312d3d7ac9aee07e2b

SHA512
3260aa5ee1fedaa929a13d065580b4a2f4e10d32d431ccf0ed2f8e948cefc7e91566d8b159f82db1a0b6f085ab9e9c0001e755d8762c24ad10727f6b417de28c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a64305c220e0ab9f2f0fbc6843c75794

SHA1
9cd69ad98d1e0f92b2fa491f2fd7bb6f4d351d98

SHA256
3683b6664e60adaf6dd56a5f38ee5a7463efce83a12e50e9c1f1cf5c73694d97

SHA512
2b9a14ebbb4078f855d591aafffe6a71ab4725910c26b7a22dccded0e2db5bd12d1b475fc63b14af345ae81136a49f90b3df01b21f2af627f4a88c54d538f6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95be3d40feefbf727341173ad48a66e1

SHA1
c31f40a6acc352c166d84ced92334193f2259ce6

SHA256
84456b49e494f3cd9ef6e1107e85bb65c9a30a1378fbb8aa3a772b471f2d0ab6

SHA512
713c9898ddd2f9f3b840d31b234271f59345509a4b1000810c3b3d810a574a74c98966c657e466e1c87e9de6ca3c50db89a47a0a69870c04855e531a6fdad581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
036eb1d3b21e71370c4fd0f4c1bd4623

SHA1
92716fa67324ca52bab62076e21b48846f8210f5

SHA256
e1a280eaac4530b94eb64edaf28977f6fd6f4dbc0213ef7063039ca6760c2dd8

SHA512
87bb766ab43954b94ab15a5377be51fa26a6c7475129d4f47c11014b2132aae49c03e97944b22f4e143cac95d9878a401baf81b04104672a30e905be69e877b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bbce8b424397836433201399c4a7c74

SHA1
52abb0e5dc713f59e9e49f67fb957f1a496209c8

SHA256
cf40d849c48a8ccb7c35c11ca5b409302db0644a09ff1943f7523478cb9d75a5

SHA512
1fa4709bc7436045ca4ae915d54cad733847a6078d5c61d47b7e13037f9428c3baec6ec6890992d836c56d673c1dfd93e955c8e46c986b28dd7a4e8a42adcad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f87f02478285414117d342d966a58990

SHA1
b622623a77edc52d436a74174b8bb59a7d2cc645

SHA256
665a2d609ab434ee9ecf244f111d93f936205e19e59d722cb1ee490aeaad9ac2

SHA512
8e76f9b14f4527fec2258e489dca2b493daa593e76fa4bac20ce815247353f7607a29aaf392cbe0ece091fa867a637d0633b836a9e6044141a4a2016fbdde241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3280dbab7cb8381e9c91651e899b9bd4

SHA1
f55573688383ac37b3328ded2e00aa874a0c82b0

SHA256
df4cf5d73304c27a8515e2e2c1ef6c336ebc0ca34f634be1f7833b6fec306035

SHA512
80a4c57fe26b548d1d483edd33471970d8a5f514c7206e3b1ac893c518edc2fdba74af5e9af27d990bd94fe413bc93a96580988f5c52bad5f3746c77ed5906fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad1c88d3859a6e432cc386d275e227c7

SHA1
ed9fffe53b41e361607ae803a8d2f7719650971e

SHA256
f4541f38f9d1be018e6bbc6d62a6c4592b6a027e85938df60cf41701c1f55938

SHA512
b2908ecf934f85ea07cd98e87a33d3a0e1b2b86b179c581d00dcbfe89aa7605271991690cd7fa2a891d7c9caea7ec1e62cfc00cc4b43d295f04ae85392f1c8b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
32d505acf1daf8cfd6a007c13b47f4cc

SHA1
b3234f9b02f5f2c27813b4465500709b843596ef

SHA256
7b24fe9b0ad3cf49e8b0863ce13413f176eb43871e355e77aaad55a216e18699

SHA512
5a1f56e30d3864a993c6f5f56544d6daf70b3c68825861b04c593dae33b35f7bd8773e2e4455a8fdb12d9fff6f4d5358ec7e89a32c2940204ae9cf41863138e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\go_pricing_styles[1].css

Filesize
5B

MD5
fda44910deb1a460be4ac5d56d61d837

SHA1
f6d0c643351580307b2eaa6a7560e76965496bc7

SHA256
933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9

SHA512
57dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8539.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar855B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit