0936abedcc488ed71ddcb425de291b8bed01de0870774eb05f92797efaa0f522

Analysis

max time kernel
119s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e04c592ccdd6c155018380211b7ebc70_JaffaCakes118.html
Size

68KB
MD5

e04c592ccdd6c155018380211b7ebc70
SHA1

173de88fc35f85c8baf9c2c2e05305de8def9531
SHA256

0936abedcc488ed71ddcb425de291b8bed01de0870774eb05f92797efaa0f522
SHA512

19232f4e77730ffb4b99eefb7ccb42f7b180c54e9b15c8eb75d100b8bd2dc8beb576a8d43177ede83cba32b87214c528ca5f011bf41657955f13553bc48a1174
SSDEEP

768:JihigcMiR3sI2PDDnX0g6xnW9Mfp77oTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:Jele0Mfp70TcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E74EE7D1-729E-11EF-B439-523A95B0E536} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70207dbdab06db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432483114"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000512ec0b8933cf2bf76639afd315447a46fef244613352fa9fa5655302791808f000000000e80000000020000200000005ea4b4f627f47b5b503a24d01ec21ab48be1a2f4fbe5250429203f10ca732cc5900000001be09dff53628d81028d084d71ab4d46f5e9e53337c9dfa70bdf95402dc3495b11398791fa0d4420beb4865d7e12c4b649b36d5cdcc6ec275355eb0fb4218441efc098dcd54a5c5ee2afe5bde2fc6aca6c65ccaedc36d2c57abc18c29cf1e096cc485fca25427516d3c29120260ef749b28720518801d023eda18edfdf1ae19ca43bb00acdf8f5987b36ab98519cda37400000001b720511815cec06b34e050386bfe1e2f4a77b26ec9c9d5cb982e56ec04b0c493a6390d76b2f32a9b06c848b6fb71b720548ca97d8064a128643fd2458b951be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000004b41fbd57a80a1b233b8898066031d203c0decdf93633b2b0ccaefa2a573521d000000000e80000000020000200000007bdd5c24c0518e745a3803508c1514ec4a32b0521d864a28b9d24dc1f62a1fc120000000f66f408604f999d982edc7c7f26d7fc8c9a03a6f11140a6418a4560bf77eef8a40000000e25c6684c353dfadbd0d22ef6a6754b6f3fedf2ea667317dbc62d9595ab7b365f01b4ecc8eb8d1296f9a2dd1cc2d083410d4bef1cf9eb0e9bb75d2844bc7e8d2	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1076	iexplore.exe
1076	iexplore.exe
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1624	1076	iexplore.exe	30
PID 1076 wrote to memory of 1624	1076	iexplore.exe	30
PID 1076 wrote to memory of 1624	1076	iexplore.exe	30
PID 1076 wrote to memory of 1624	1076	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e04c592ccdd6c155018380211b7ebc70_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17ca3a26fc46241d02e78b3df1e3385b

SHA1
646a74bcc0256a8519c9c5aeae786b52edd180cd

SHA256
3c703923f668b2c08e022319b341a1eeb58005b1bfbaf8f8b68cd27dde0a235e

SHA512
30cb2b768587be8f35abfd77dc894bc204b325216ef62187d39091dfcdf56c05aa8818ee69f1339deb2beb06bdb038d8040a1176976851417c2103de7754b03f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b4decfe11a422a975bc4c76f151aab3

SHA1
32fd81ec08f97ecd049d265bddb871b72f1d74c1

SHA256
eec833f2bd7e86bf7a0889660fb9f303ce936137a6f580b00e69f7ab3f01d145

SHA512
abe3b657d0c0515f426fe1ab15bfa6aaf30640896c8ca78584bff28b138ba8edb35e4753b057c2ad4c7ba8d7ea32d628f10056eed55fbf8f554e01cf2fd5e246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bc5fa2d528f6cc9f2eb9c020a350482

SHA1
02477833e0d69288ef83353fef03fcdebf7ab603

SHA256
ab183bece03db840bdfa5f56d596036aa9f91a4218b75d8c72c143683124fbd3

SHA512
52261e1b6d5487df7fd80cb8069c585470fd690b3e5e2399877b1e0be53ee39f89cd378549a253227b613fe5428dcda4cf47efe6041ea0ba47d2bf6ed53c2fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2450fee6c08ba954247795fb245cd3cf

SHA1
fa3623ec5ecf496945705170a26be62773c15960

SHA256
18c7990ef727cc512e246bd44cee63c2f113a70399abfb09f8d93ef121165677

SHA512
607427749fb57757b4e6e719a56d46a00a5b4fd393238e154051f30cbdb9ec81f56d8d371aaebfb9ff216804f0beada67b68e5bb193a9705ae2130891edb5702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20d704f7361d5b5f814903ae80f1c3c1

SHA1
54868b3a46640cd9550d27601c6181ea291652ff

SHA256
72ddacf1f5cd6e689a025da76a0bdb6f4d166aa2f501897c4be8e25edf404ab9

SHA512
568fae860222130f8dded01357cd7eb9e80149a5641d5505e5e5eba5ad801ddc346762d00f04ceae2a19154409be6f3190d0a895f1e09395272df64f2906e194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50bb2eb2ed9dcbeb46c58de21a783b4f

SHA1
53ddc2c32ce3000c3de12d0784533655897129b9

SHA256
461e6a1f62c9876a78583d1a6bd190ecd5ba23659667b076fe34de0bb1c25b10

SHA512
49fd1c4c114fe48b795101fd862689f8ea6d327c9b3150e2654f7493285b7d489b245136b36995c817d45fecca21285a20aa9d2ab9df9b0d87964d2189de8fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4404769a1ea5fcab109f32e36d7c008

SHA1
763d0e818017f5ecb356b6c9bd4cfaf41b1e38ae

SHA256
af01d7ded23c195739d3caaf6bbd5e5504249de4545b5e56512d04f90c12114d

SHA512
52e2c464dc255ced850040b251bd708fe36309a03da6db1173e2ea68571a2f80c1f3c9fb83c715e7df3afc30922332f7d4c4d0d5c7fcd2334d4efbee2ec09f83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9dfa4f2a0d9213a1f47fe5875d2c9df

SHA1
fece4afa5519a65692f538543504f54b65b67588

SHA256
8a0c911dcf3603b966f3dcfe02e8f4fa4760b96ab2eaf609c79c78b94d646479

SHA512
d7cea0998b4e407ac014b56c441902fc43264628719cfedc9b404857dc3a23529c4cc55bf953216f1b065d226869c634ea8afe795f07ea08849046c5c952092e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e14db34408335026756d538d78499a9

SHA1
6a7151b11eb6f6ddc44059222b261a821bd646bf

SHA256
1041d57ca5cfc83353f4e1d8aa80ea51d7bdc864a95d178e6cc0a82563a92e26

SHA512
717fb4f564a14da428b1480312f82c886669a69e5d43e527262ea2fcdc7f866d9f0346418a2c5138d01d0afec21f798089a0091ad0f56b3239dbdd33ad77d881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4743f842d096a783a161b3b23d9ad05

SHA1
a5a04cb00baf4528f0e1e807af1e50d6c0b0ab0c

SHA256
8d4881f27154e06c16eb18ed5b0cd19422035930587bfab0a31b726b9f14cae2

SHA512
9e08bbf790132d19e447d244a7d8f68c5818368f33be6a85292af41bd107c48e9486496f944e795021008ef65c95055def2e9e2712593d1be05bf80f01c7c763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d47bd2b3500c16374fc0ff4b55fff12b

SHA1
59aa5c2731d4c4aa18d581ef5af62b5be88ba953

SHA256
30a8dd18f8399acf87e4b97ac587f158eb3614eb4e9c0df97abab7c387f55184

SHA512
4c1d94413f97f639fa0cb93179b5bd3d038f22dd7544224e4eb2c41a00d5b6adf737c2d38845063c40b30ee57c112e0636da17fd5442b91c8e9a3aad0f41df11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36a208ca49c5679da68575e513177349

SHA1
7dd1dca143273ea7175f078fcfe475e7382cb7f0

SHA256
9148b75457c7bca41dc33dd468ae00ac1f7e6b7df3497ecd2c2a022d5da7e404

SHA512
0261d086565b3ed1fb85f18e48357e4d3914e2e8fbe56bf7e8bd8cea3cd3c37446ca25e6ef29d779f6224bfacd6cb57699d1ac2121a750ef27c1539c29b18e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be7110d3ddb42acd77157204279fb7db

SHA1
22d8156c08fcd294f6e135105f2c9f504954a71c

SHA256
ca021e3f898c512267218ada36acd683aecb24fa52d6f7f38d33824775db1cff

SHA512
e9eecf7f4e00701d1e85d79173a5bcb88eff7b0d2a4f5345ae01eff39c05ab3897e2fd19f2365f99c13d0611ce25fcb8b5546721b3c83f8fd7565453e4f43d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB1F3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBBC7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit