5d07f60618c0ef801fad4714516fec69d3e44b5219af38ce4ef5d048b3034368

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 06:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dc02734343ac78a4705fff299b266678_JaffaCakes118.html
Size

22KB
MD5

dc02734343ac78a4705fff299b266678
SHA1

8d122c28b1707c8fc2bad3bddbb4a98c7ef37e92
SHA256

5d07f60618c0ef801fad4714516fec69d3e44b5219af38ce4ef5d048b3034368
SHA512

907ba32bfac72141647914b15c399eafa7c6d7e344df311665b240510bba3d0432c51e8015543acd79085500b6a82fc3df1657f026ee29a2f280fba111a4db79
SSDEEP

192:uwH7b5nKunQjxn5Q/pnQie8NnpnQOkEntrrnQTbnRnQ6v06J4RnQNjMBcqnYnQ7K:oQ/4v06k2J

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000005110424064f07771ccfb0f1b82b17d8b13f10fc5bd068910e8d60dd3e685a666000000000e80000000020000200000005304a66097323201ce8c0c6a59ff71ed6a808320aae4d282e3d6802dc1bb587b20000000eec86be3a90739ab9fb06c6bbb9f9161b32c183539b8ed9e30b7b8de1f2f7122400000002487d38a536cd0fab8476d3ff6f0f4a8eec12ea723e94873f57c48b78071e0d0ecd31b24cf2a42a3953cb9d4ecceb74eca8ece46ef79d5df20d52d9aa5b6d69e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000007f1f56578f4374de3c9a1e823ea9d2f35438e277412bf76df3f5352c85a425c1000000000e80000000020000200000000ce814fd23f601873845f8856bb6c742113777a147771efd8da39fef84d8ae4490000000c20ae27f9787e31dc312c74378a561cee00ac3ed6b0f1c97a567099319e1e95165d63778ddda4d937a11dabf91ebd6445d2c451aebefc7a79991c7910eafcc788be2f6bbe72b289e1eb705b3e204c23b9f89254d38bd6d3a56cbfe2704fc055f7e8afac7cb2c2510ec8d7de64ff48d2724584fb83878caf852a57d72121a490ee5e3a1eda114a5173e95fb16092720d24000000003b3bfe46a9beac46e2489146f67c88ac33435c96add718bb7e61ace956d96a14a4159f589f2fc7e6a7c8767b14df87049c26ddcae94abfe8f354e4ad757bf3b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308894b5df04db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432285500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9C88721-70D2-11EF-9A0C-EE33E2B06AA8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2364	2204	iexplore.exe	30
PID 2204 wrote to memory of 2364	2204	iexplore.exe	30
PID 2204 wrote to memory of 2364	2204	iexplore.exe	30
PID 2204 wrote to memory of 2364	2204	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc02734343ac78a4705fff299b266678_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e75e29b4d7fd48a2c5852d843caaf229

SHA1
4474f8e6e11c4b45bae9375a77c2fda167461f9a

SHA256
bd940a1a9fb3c3e8848ca6edc3ca0dcf15e7a130ea79d83a367746320fa1956e

SHA512
685f6f4cfd3d8acc84ad1fbe5719dc176fc451182cdabbb8b57c7fd9f64cf9153781517221efde2c7517fc53fe195e4be9fa7e9a6ec33ecc0b88f52a12f50c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb57ada4b27c92ff4534dc217cd52154

SHA1
5e7f688b415e105b1fb70e1118a9fce938aa2508

SHA256
3766dae9b0ebfba37708c5a545055fee50d2739f473792f125d1c60a1002a121

SHA512
959488aa3fa111d36a2ccb34e6f109a0e8456d393ed630b3a7dbd2ba3bb282e8f0e743c0efbf73471bf1d05a0d5a357911adb3940bd8dba49d26fd73b388f394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53566ac53f0f41d51db6a38f4730ffb0

SHA1
09096bf8921a1a64a4060020162da2970e82e95e

SHA256
aecea96d38f8edf3b7c11d1c800b7bd0f9dac06efb991c7ef0dd44dec5a0c671

SHA512
20ba3badd4c02d84aa0dbf3047b7fc502f55451d15da3124762300ddc90962437587d5bcd0d79f9917b20d1676042e54f76688d62a18dc213d67062e4d2834e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5601a25997f4661674248d9f8779a21e

SHA1
eca8ac2da192a63ca023251be39129a2e47668f5

SHA256
2c33044e91ae130b5c0b6afc6f47f14000b9b65e465567d93e7412d4c32c32e6

SHA512
601f451676ec337ff78ed71d98c267f25dcff2bedaa508aafb3ba965a4b077f53ecafd999d2e171ce5f4401edbea8f5a250e73f581a2d83c7308a672a3663866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
748ddbdbfcdd4b88b9ac94da62826981

SHA1
3fb22fc8613bc4e193e6591476730d232eb2681a

SHA256
a19ea7f7f9f5f1d6c0411677c8e08643989fe1eaae7862c0eec2d09c8acbbc86

SHA512
ce3f7e9bbd07e8269aad3e2ef3cd07ba4ba34cc83479e00cd23d6b04de685870ca90cb1b2e77799e4ad654815f61ec0f06500167d14952e01e40e1d88170fd6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5474f81d84f722c60a507aa4d0db00a2

SHA1
b3047472344989aa6089180de379ae3e6484af9e

SHA256
62be1327b2576f37227299b90463050bc35b497a18477799e659cd7e3d4fa9f4

SHA512
8e3cd8e0dd5f4f2fb4fc574d77903b4da2e15f61abba14e889748b3165456ddeacabc22351d0c3b5f1df48a57dfa65a5ccdd0ebf74acdcc5791d63894734ef52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bdd6c5959d090d888e05e0b3ed9ccdf

SHA1
bdbdca8f6e7c66e5d546dd4632503a22ef343801

SHA256
15b332915b83803c19b75a19f80864e027879cee988997ab6efd5cd11dcdc351

SHA512
b24f2c714830311ad7ecd0ef3b63937147886dd51f802ea807a53cb77876df7ff3932221ac2addd48939d44461a107396c96755baf4fe6349e95658b0baefa51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f23b061e0d8992ed2b43b2465f48cf8

SHA1
90c2a3f506eca7ffd12cfe041c1b7a8a0e327b88

SHA256
9e68e61afdcb4337844d68196c9301a47bf862d4eeceea32d48c95c6963b9ba5

SHA512
aa70b076eac52442c5508a445922f0f7c895baba455e659f19a23d8935364dcaab9d4ab2554adafd7eb24dac3dc0a06c5805c7e6438a2b236e9d8ff19e1a2aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a45c6aab58828c899508fdb1a73f5847

SHA1
62e20fda14afde4e716ce340738e1769a01686a1

SHA256
8f27d8446bbd5ba73e02ca5ba95fd99429cccf05c5aeb1e508f69f03966d6fb0

SHA512
2d2f3ef5e2e88f5d4491935565e6c0851e4ec44f4f1cd092d7fd039186e0fdc7cb883bad24f7fba7190abc9323135139b364a8ec4e1f0cfad79855eb9d02d74f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
516b260b24fb1e1ee28a9fd9a6a8771f

SHA1
f47af73f0cd4db7cf84c859e2aedd63c7d1ad82f

SHA256
3147b7c3e5ca92c9e708d8ed9b9e1590f5123a19f4472d18df22b48221444b42

SHA512
4eace6e954807bab30e67ce97c42abbcfe720f1fbbd5c472f0cd3491abdf4a35e1ecaa823378d8a347aaa08e762fd4d01d389c3aca9463cda0cf26b83121d2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9938.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9928.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit