e4538b4e9589d668a83ce7e115d295ddbc81008b18b6665e349a8cb76bc2b90f

Analysis

max time kernel
104s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df55f701966728386d292568b8f6196b_JaffaCakes118.html
Size

11KB
MD5

df55f701966728386d292568b8f6196b
SHA1

a6a27445d7dfdc22d0df7f06eaf067b3388d52a1
SHA256

e4538b4e9589d668a83ce7e115d295ddbc81008b18b6665e349a8cb76bc2b90f
SHA512

579628d51aba1e51a06f6e46a80a3e0767bf06dcb449775104bb5b4a52692de41d2cb7c0a591d1717d25743ba12a57bee06185c35eaf211b3a2d208438ce2da6
SSDEEP

192:bxhjp1E/HdrHcw0M2VlYArlmbhK7fiM32F0ONCff0IOWtWlzc5:b3fEvdDoM2Vl5gbhK7fiM32F058IOTl0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000010ef26b6decc35f4f7d12f93ff52d5bb9187054e8ac426c149d12f6e7e954d7f000000000e8000000002000020000000b89d8b3c7856448125616d6a4dcff033d1f5b47ac1d35b0ed36aa0ea72957d49900000007855ee49cfb1ff9575bc9ab40af319a8a891849548d8ddc1aef0e4cdaf9e92dc4448394d6bc9cf0b8af8a2fd24bef592f7162513e5298b0f2540d3e9aa376a178939d1632d302415d382d07c79458c8181dbb44be927f7c72a877df226a70d7c0a59be0a1b576e4529106f5e6cd55188c4c944fdd2923b385af5615f3a6fbe95f7050d35aea05b77708e34cbe0ee72944000000017e6c499ad00c934b4c5fc7140094a46144f78241183c84c478d1cd59164d81cfc75bacfec330e17f56b006a66cac7d86d26d0bb198375c3941a8005ddaf02d0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000aa5467410233d78686a20478d1ff979fce64edcfc2fc8d17a1b79f53c8388c6e000000000e80000000020000200000005f8fce32db6aee20abbdf83048d5df711c745c40109135835def56f8b84bb19720000000db7f047e14e2436c0e1842f59a27ab11bbee79363c1414764b5fbcfc431ad63540000000ecca30ec990f721aa8159352b227f676de0a7a67b1382e91bd80963f0337a3dee40be056718594842187f8be19a91d1aa38fe7a04645eec730a5dde50f39a639	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432443273"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A430511-7242-11EF-9704-E62D5E492327} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501fb9184f06db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2332	1640	iexplore.exe	30
PID 1640 wrote to memory of 2332	1640	iexplore.exe	30
PID 1640 wrote to memory of 2332	1640	iexplore.exe	30
PID 1640 wrote to memory of 2332	1640	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\df55f701966728386d292568b8f6196b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
099c5240a4a54959b4181d4a1c948f20

SHA1
0654535be439d2a4092f2f74b3dbbe9fa916e6ff

SHA256
1358e3e744120b1ec6a07a8ea07649bf079feb0a98445aaa2341ad6007b11c16

SHA512
2727763c33da36b9db23c97e55d51e7640356c07d2ad57aeb891a66286cb95d045da275d021d0f5d1261860b5b45cf0f1b4a6f88362594b87dbccf38464a35fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0eb1963b79d52918979ac3035bc55e82

SHA1
6a31c75ef4db75ce02fda52691482c3565a18712

SHA256
b35bb5612fd29108ed1357923ef2e5fbda259e89935e7e8f8c70ef50abb2ba79

SHA512
9534a20678b69d46b9e69d34bee7ef8c40c1043899cb01bf9c9e1848d194a70fa43709d0a7a50229c03e3deb8eccccdb564d231f4d2ee49ec8e2663ebeec68f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f296b5ca01d62bff32b3f92206e82fe

SHA1
2ef2ef4c41bd4fa6762f306b0c961c85c5a7e473

SHA256
4cd5156069aacbc12dbcccbed051425af9be8ce691c82c3c58069d81d28f136a

SHA512
1bceabf7ef9c2d3f8f8ad2b232d28b5abceb840ec9701f35b31682ec07ab9f71b8ebb37f96f05c221f242f93a468b038509049ef7b8ea07efe0b517d278f2437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
715ff3b14700fbf6b20c874c98a79b58

SHA1
68170b484adf3d495e70fb400804350bc127db70

SHA256
778c7531cef643800174f7867ec7945eee9898850a5827aac6d764ea492124ef

SHA512
fb71420c775c98b7a3656d916ccb7835cfa5af5141072aab3df01fd587579aed5226911564909c87bb9e1aae2c0691d71cbf3047e712f05097d26d3ba464aed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8aee0c98732341f953ac7bfaa6022948

SHA1
6d480e1443039210edf88fdfd2c4de2e8cf26d2d

SHA256
574db4b3d2d730305150a57edceebac71aae92dba86f3eae0451e310ceabfc47

SHA512
ad9ddde8d355c19d1c274738d35be491b1cea2ff88e7e808a89b96c8d729c279a8327a33fc369a86c2e5dfc6d0f5228a096c6dd74e376c3c47530f066217fe5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36abd06f7aa62b48de11bc1ea0bed9b9

SHA1
65fd6391333c081fca1bdad4cf5dd2a4245ab30f

SHA256
3d963d408fe52bada7b9721437eb496ff6f8723ff1639d8f8af96e6698193f2c

SHA512
c4aea2e669ee8ec43e3e1b744dedcd3a8335cc3f7d9bf1d20b8601abdbbc03d1faedc9615075c60679b619eb8c360024c9574a5d63af727dee7c6c474f732af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
343e0024a85dbbbf234921a99759afe1

SHA1
661ffbe4cd8705d082980bcd4def16a48a1105e3

SHA256
fdb7f0615c38b5f60b9a47154dc3f6b3a5210e4972ff84a48e5551d4f1ba3f51

SHA512
a9687d22e6c474c6c7e3a2e75863b714b3a80f28d64b08fc405b646d6a2aabe3cff152798514b031343c419bbe59153f3db3f54429c7fd476d65c71a920de1c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4b14755aec879daf022689520ed4b9f

SHA1
f3c2d11bce6a4074ee097e9a2182beb6b4334bd2

SHA256
a5a17dc35e225b4fb69bac1a62a9cbf8a0d0d3d404c446eb7fdb8b9b1f881959

SHA512
8c2e0d8c1586c7760a9b134c960a300672258ca0b1010d6e7bc1d7039d5fb6e764b208ae9cb5b507be8688f31743259d9bf43e9a5201f28a00c7f5af002ea9ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c02fbed0cbf9e9b29c768452044be908

SHA1
9ec70bbca6df091e33b9608dfef62b367cc8f507

SHA256
6e94c90b531377c3aa48bbb658c0ee176f22b44fd3d00005012f80e463750e4b

SHA512
f25d9172d44bf606f2d44e9f200216511ad000517f002e8cbaa2757566f7c70f83fa86cb2991131683d5d120a072cccb00fb1849ba1aa909e2fd668a5182048a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2ef042014780e96d0824241f77fcdc7

SHA1
b3c758cf481f103f8222aee878c55362612611fb

SHA256
926afd19ba9da26260fa7dc6f9a2d2c45b7cfe9853f5b0605d0e81e024943561

SHA512
fe36c9b405c7ad357d8418d2c8f14f20bc832e41455b84c1cd1901fa9309048db6661d2d59059a16de9d0e1ec81d615da3798a8e0de134bdd6e38386c169eb18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66bff61eb74e19ad20f1847575632df9

SHA1
911aad226b51027077edd10d025d09d0749d391d

SHA256
228037ef9e44b6b8e6b18166a44e6f73bd3cf9297fd6bfb3c0352a9a59faebf7

SHA512
a691c6343b2abccb914df3392b3093a7c1fef08bcfe9e4d20c62756f32920c8f0477f3517b590df50324b19a8a4f67794534b4c3c609e86d757eab73fadf5ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06ace9c15d0d34609be8e3ec3f65ceca

SHA1
2c002c9c4578ae313172f794008dd7e3e975d428

SHA256
483d92f81d84cfd217ad3b7a650bf8ba1a3e9986311325a4f956072fd3f30ca9

SHA512
b8aa5b9621d01ab663630da7d6708f042db16e36f83cf3f11e8467eb0a3e2683f87a20cdc3cfbe46e5bd41cfb69d2f76f92e1ccfb2e48b22e7f50e3e603612cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eec87cf2cd8a56f00f403b87421edc6f

SHA1
4cf379684373ec231ad78884342162216c5b9b99

SHA256
b72b64b4f1b2602cfe7a2df5dbf08568043d40365bceced7c7a958d1c1666065

SHA512
685f7306efc3d97fe0fbee3907918ef4dd28c071d8efa09fa9976469015f4b9314f71a12f71b8cb075bdd1d565fef6ff0f09d9a23def544b4b5977545789acd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab853A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8655.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit