e7af1e7f1f14604fa54a6f6b60e1bb186405605e452c648aaa56b8cf58fa7716

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e04f527b4781603c363f8a6ed6197402_JaffaCakes118.html
Size

70KB
MD5

e04f527b4781603c363f8a6ed6197402
SHA1

8829369f04e85ff73c00c1d718229324d33f4692
SHA256

e7af1e7f1f14604fa54a6f6b60e1bb186405605e452c648aaa56b8cf58fa7716
SHA512

ec29e947ecbb46d6f05eb678ca686dfe7e7a1dda3eaeb819b84b00aed5b36e7d9398059b62c74e4e50bcc8aa6d5df475b4019bb8484f0280e2834dc2d4ebeb38
SSDEEP

768:JiigcMWR3sI2PDDnd0g6COQzK6oT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfQFVGQ:J2wkKjTTNen0tbrga90hc+NnhVJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000a97ca3fedce51ebb49a9362b464f712bf2034f109759b1db053caa9410798d88000000000e800000000200002000000001e9f5ee7e4421ec8fa758772b9dc3f7524971bd3a8fc1175ab87ed27a34981690000000938a9d8e458e9013c9efc281029c2c0b378ae1d57abe7e2c915688925fd8e23600460fe6051caab50adc7f4b7d2426b7fc6752ab2e855d3e15d09bbb88d459aa7521eb49d79efd07e3df1cc8e7b18f05935aa71c877886006102e51d772f2f8b60aa1152de0cfd739d6c520427e00975d9b99ac3de66acb4cd612a5cdefca9bf176abda6216e10993cfedeaf8d353614400000000c18d8402d64dfa77e4f9f8fbe9d3aebf8af8e05a982380851a0146313dc03c5d8ed787ec73ba17846ac88dd6b46360da83a8d9e0311ff66f32f3799dcd006fe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432483468"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000009a152f247d3cd0ec5946b59eafb249e91e60cac863f965f0c238f3e1e05e04ad000000000e800000000200002000000048ad4e04a5bc3e4050223cbbaaa35d6c707196525bad820966c57bdad3f9ad1920000000417e2672f9364f29f0281e4cc6b950b2d002ebf174a1c087399d87af04a71ecc40000000e86fcc8d77202b079ce324b9491a0a927690e4d2ad9db7706be22c39dc807803d67388bbbf6d513cfec04cc463d04a6dbe9f35b3614fa777c06f3b5f6c9679a6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C505B1D1-729F-11EF-A567-DA9ECB958399} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f035a699ac06db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2748	2688	iexplore.exe	30
PID 2688 wrote to memory of 2748	2688	iexplore.exe	30
PID 2688 wrote to memory of 2748	2688	iexplore.exe	30
PID 2688 wrote to memory of 2748	2688	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e04f527b4781603c363f8a6ed6197402_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f029a21137b14d23304ec894c60ce3b

SHA1
cc73750f8814d184298df5e5b6eb122277629464

SHA256
5a60f2fa7c4d45c3c482a6a50949c60bf9231c7181ab0f1d07709671b3b6e1d2

SHA512
6ae115f16d6a22a5061c0e0982961489143a56dc197fd9c5867d7feab1d2b394c8ed028e3c837c2e77e0d9829f0bc2751b7906342f7890ab667ce74dfd105a35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18d25dfdf6276c349126e6db134d77cf

SHA1
9e1b04ee300e9922e4646364e56490a2ce814485

SHA256
cc9642ee0d4ace8a71c974f095c834e67401d5709468e9ae51e0ad5770c480d0

SHA512
079a03f091b6371de6746059d6e7d475b3bbdfc6ce528c56da03234afe636a0da87cd3e3e432760c6561ba1954f3b3d8b7a0a2a6289b8d6068832a012ee31f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca649389e2f114e723f12034c1828e51

SHA1
b1a17dbf42ffa8868e14747be9d96ecaa16e0a14

SHA256
f8f30b4b8996120eafecafcb159335a7156fa58021398e3074c1680739261e3d

SHA512
343eaf78beaf1b56c78b6db08e235200e3c89fa73caa12b4b49c1b2d680fc42f0ba7f4574e173831d921fca4927b6a26c1806dd0bacfce4848ff1c41a2268a3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f7eac80f72dc2103b2b3f953765bd0c

SHA1
6615650e96a58a9ee19f4013553fdbab94c03078

SHA256
064d9b67d0e821021006447cab3677615aa90d3a81f5ff23c6dd0ec17084c901

SHA512
26dd8eaf18755c4820d69f618b6c05fba523b710d2a66a5d1d979a520d22d1c69ad32085fcef4dc616ba5ec0b1b4ac438587be22d7cb072d2566e3f7f8a39b65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dabf1173c24a2dabb3c274212df6e86b

SHA1
b27e3819b012910f603d88de9aff3d6029c480d3

SHA256
9dc34e286ab1e89f8471dc0572f58ba14556a18df3f3cc402ccc69fab18973d2

SHA512
3175e377e285336d1af5c8b72eadc3db6e323839ae08fd066563ea6e666a89dc9eb0f7c5e8f84675a7a4137f3ec0d003377b390cd9e9ad9fe5f46e3b89767389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56caa677959879b3f1b0d6fba4a63f51

SHA1
d7de1fe6633d59c2e54475f62af7677bdda51357

SHA256
9f21e7f168c9f4a2998e3107272abeb669f2d09e6d3e329620f832a25f461fd3

SHA512
6d0cf539f68c22611adb91a3cad59778b0e7af1148198a5d16518b167f1fea4f85c3ecdb4e1eb5440286ca3d44bfd924c527df46b97ed4a2585f3940e2581d8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
214725dc3aafe6d01d72dcb56c5d8f2b

SHA1
56ef1ff7fa94d546264bad3e766eeadfa958aa92

SHA256
fea8936cc61efc510bfa962a65db0dafd7aa3a92540104062c956638ea3f24ab

SHA512
764481f367540643b8912ce13a39b4355be2204c5ca75d31a77a8e7a23908061f723857ee7877c5ee4e44f2d0f6956b12dbd6524dcef945104a59713063cdd42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cd3a5e04aaa271a56f6318509485aef

SHA1
9484d6c1f66859f5fc2af02b1d2a5222a62a2a86

SHA256
ddf6c828c6e351bd00a75d335689de201d72b68d094e2994d664022bfc8767bf

SHA512
02c43a5d133a4eab1f0e1f7170ab711df050ca2bbbef1ab126191070365674a4af340e8076df18e6c0bda43ed0ba2edb7976a0c346f5b0a20753fdf8d0b8eca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eee2cb096d58557c299dbe9d6fbdc0b

SHA1
b8b4ee88000a3cbb1d8c8270ba0daf86106d4ee5

SHA256
07bc85b8a0ba03f708b3cbcce3b6b9816a78328b12dfd621339dc9ee9f1686e6

SHA512
b12ccf8e45ea47795e2ddba8246d1aad447603c03eb31de5cf27441e536e7f394f19adf676a5ce00d78550c76ad3cbca84c40153ffd5f1f5c483707413967e5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d9f9efe74a550fb5481b118ac026d2f

SHA1
0bb7b5eb27e007057bab643f6755053a68af8682

SHA256
b6cf77a8d1cf44ccbc7706c79cbe5ab7a449ab71e0f848f7e21e0d5ebb7a0cba

SHA512
fe6fc288de7a45662dbefe92ea55ff5c24c3ffcf6e11b9a68afcf7a4a17128744ac9716aabcf23f019a7e18ba988cd91e5dd9c2a0d4e91befe6bf0dbd4370503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0e991463b4433f7caa56a9cd1aae0e6

SHA1
8c344283c0062fc0511506d803f40b1ab1feaf28

SHA256
20c98c58a1d218419803515686221dbff8a74e6cfa9e10d3ff6f233e5083daba

SHA512
028de9697e1ad6af3ae5669577038f3e723af5039662dc383e0535cca7e09056a105360c2f953e1944df0292541e1c81f3f074109de2d92425b9f1cb38da62e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A9D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B3C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit