751e5c248673610a8273f16c1af6d0adad7c534143bd9d5ec2be6b694f9d51d1

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e114a2d08b325d030ea6058f43471467_JaffaCakes118.html
Size

24KB
MD5

e114a2d08b325d030ea6058f43471467
SHA1

e83eee2b3a7eea38a23a706c7d963c1c76aee048
SHA256

751e5c248673610a8273f16c1af6d0adad7c534143bd9d5ec2be6b694f9d51d1
SHA512

1b042c77fbfc27e145a9b07e21631b4c697a1373b024b9a72e64c589f53b1e7c98a77a986c8b19ffecb53b593d89890169099ed5c543b94432ab591d09ff22ff
SSDEEP

192:uqN7HRb5nW7unQjxn5Q/fnQieZNn0nQOkEntFYnQTbn75nQeCJVevo7NtIFo+Nzm:nIQ/vygcnnBZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7EDEE71-72E0-11EF-8778-C60424AAF5E1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000009c8d7e090f8f91d024620127e0babef87aa5b126141f8c14627b1a56debb2c00000000000e80000000020000200000000a119f578ba203218d1163fc7ed0f13a340947f2e80727fcff074d1d7a52056c20000000a7b6a37085e8af5ded253cb015147996b22eadfad80c1ba555c56f0e2244d37a400000007385934521cfb952536640036822052e264f59d100a914de58a3d5f15be45dedec5ce211654b2fa1ed9a2c87d0ba3db90269f60df75d3c17711e778745453e2f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432511416"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000a3ac61eb62a9a77b5807eebf90ed1e68bf574baf5a818fab59b9ad82cef213d3000000000e8000000002000020000000aaa9b51362b4d963445d752655cbefb67bcb0045a6c070329ef45710b5522b2990000000088780d44ca1f363b93ddb737cd1c4fa4968d0d91809620c84993a6f4ca978a1640d534902c0b4ccbbb297dfd9e539c775301e5d0a52a483ccf239fd2625cb1dc41642d7e2234b0845a8321f773a84929fa3557795e8667bd471734bc46ce8c1d8a972e4adc9cb55aa09ba1166d48c798557896573cb9f948f4c9846b2fc9d7957fb97d7d6b7509bb313c182dfc4c1da4000000096997cbf02ca6952568612223f6c24434ad6cfa9ef6f7c8672a5cfd8856a9a81b8f01e0e51a3f57282d13c6ab321afd521cf0dbf2c59384ea92bb649ca01e4a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b60eaded06db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 3028	2700	iexplore.exe	30
PID 2700 wrote to memory of 3028	2700	iexplore.exe	30
PID 2700 wrote to memory of 3028	2700	iexplore.exe	30
PID 2700 wrote to memory of 3028	2700	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e114a2d08b325d030ea6058f43471467_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
812b22590460a6d88888085a73a0268c

SHA1
284abe2d261102ee74d0dd2c5d938cf1c8583950

SHA256
602f785deb15e945133aa188be328795cb638e6d32cf826322a03e8bd5429612

SHA512
323bf6deb5db39a5b693c4c7bb9e422837e0ddef1adba62f39f95a4b6edd6ce0350a80d236fc9f17ed52eec56db21786e21656e55b262228d16b7f421c65a22e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29308137801eb732e66bda8263959377

SHA1
a31103b3655e2149c11b6a9f18d62421a98d6d45

SHA256
70cf8d73f50edcc78fba921d2868a97459e3a0e1ce2adccaf0b1c0c437fc9d0c

SHA512
78c060925120343984de04df088625e47f25ac20ba5964b065042e8eebd5982221fb76486c3154cd24a4c197e36977471208155e2638b0a3e84cf7cb9504de37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b1b3cdc9ba9992fcd4fcae37c2c6302

SHA1
cc875377dd8e76cf5cc8d4dd77718ae1f7a1c624

SHA256
cf271e4a037e8f46ca0030e2ad83525e1cf668c9c1199fb271b4ef59282e1793

SHA512
71df6bea7b5d4792e44a3d8fb4590e72fd8afd117fddc976e1b28945a0cd0de90589f86cfd4bb5cd2079aa18c25af42d881a0f2b355afdab96e7618bbac037c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d026461f54f8497e10f2ed88aaa53e21

SHA1
7d41324bd3e3bc4ea82790f12708621ce7e4c6cc

SHA256
67f3cf7859854b3090e0256b5fbf4f81665b1d7565a52cdca6063b895b25ea71

SHA512
ab71ef579c878935872a5f9a2f221a8b4f940e5bd703ac438d8b88bb8c5857510bbf0dd1978a92d4080ebe6663e0bc5dfe6d0aa15214762bba865bca8459cf89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
295d010967dfc2bceccabdc25e525666

SHA1
53fa698095f611bf0c9767b65501f69b554b3942

SHA256
2c9d54cd11855b4a687b845f150d0027f548fdccee5140f780c2713b368b53f4

SHA512
d2ff85f95cb3ed53a9b6dc9e6a5a5a0c04cdf3b67d7d613c2ba617471822c8c3d43c2e027d694a7af260329691ae79e168d6baca16a5c2311bf184ad47925f16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f5524e1afcd8e444eac0fe22a775496

SHA1
b5f5f78e9bd7d00d04ab325ea785d2521b391d15

SHA256
05b86d8dff938e8e70a9c8b1e579a4b57a300459e7816b409cb575e21b3da85d

SHA512
de71d5484238cbbd6854ba2220e008884ef2f45926c679da3daf66b738221c5e3b41b4d7f08034f10e5eedf7bb168bcd0edc09548a9b19652f9b516e55edf5a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28880b8718265d6cee71823e2c783c0c

SHA1
009fd59b170a9650a02224c1d34292db53c2e032

SHA256
25287beace3be53fbcbbd4eb39607cfc0dc66cd8995c94f7497577c21d495522

SHA512
68619187b05d3efc8b9c6548b59d4ffef08c928af9bb546b2cb4f2a22c40e0ffe75f00802a0ff6715cb1dce652725d490fafc1017039197b7161f604538af959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56397157b447c8e4930752c5ef2d72ed

SHA1
62855a1d73638b4ba22254899fbaebf7a7fc1ab6

SHA256
9e20c0428e0ed8857dd98d777412c7741508afa559b84e07a97e7a79f1d5cea3

SHA512
36786af6480f0186f56220c33f5b44e048a18b1d6e525165f22ca9ee5104f369832e121883ee0f8bf3e7cf1c9d49a191fe5d42a8706e1c40622b95a478bc0688

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c73431643106910871700915717ce633

SHA1
de7a197076304a6f37352da12632af8ca0be6eee

SHA256
f89d7e3ef5a516b972d5b38cbea54c5918e27ad26a81e274ce803dde47910d5e

SHA512
a068e788b8f215beff812faddc15ab4cddaabae7eaccc2aa40445a8635d979db842b1798ff14dc6bb02ed88f14ff1c1e9d36755cb43133991c50c6eee77217cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00429d531e1bae905b5142ba47ffc410

SHA1
c65c5cd97012b0047c224894d386e27bbc043e5e

SHA256
5db245dbdcdd2b2b3254134f43c271b0d8137a768dc310c58bbda9e560648df1

SHA512
aea3f461b75bee60615b9d137c3a2e76e941b6950eca640da3429f88c5221347a50213338b14d00554cc299d98525fa6a40a5578cd929b7ba5c9bbc36e84ace3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c62aff29eb98d1d86eeee69075dd2454

SHA1
b8cb0646d4828e33e7cc67d24b9cf8c0d3326b1d

SHA256
04c6e8d31ca332baf2586ed9a68315e655c2431bb7583425a275d8b87cf2181b

SHA512
215802d260104fb52ed37c1222a897d5e6e2fc048dcdf1a0e01c0b6fd52d11b25e7889dae8344f94c0554e08d323df28f374565a9796f8c6bdd4f54e6b54e073

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab259D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2755.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit