8b48b78098cf81b3fe38bc3f2096ef191865392c7220fef65cb3e4521320be7d

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0609044ee69594f6efac3f71c2d6344_JaffaCakes118.html
Size

36KB
MD5

e0609044ee69594f6efac3f71c2d6344
SHA1

7060ecf4df282d8bc4dcced9cb3201f1fc612a2f
SHA256

8b48b78098cf81b3fe38bc3f2096ef191865392c7220fef65cb3e4521320be7d
SHA512

0e4e58fff12f6b2865e7f90886ba811c569fa918ae51c3fb1cc46d04bf0d1a5e8a416408f817b380e86df28fb9d43de5df7500ae1e3af6cebbe937901dbee611
SSDEEP

768:uCG53N1lx+gIJ0hISn4xAClZ+EUZzxClPxAtT5PXoOm1kEOrVAzC14A:t41lxOJ0hISn4xAClZ+EUZzxoPxABJXz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6ED7801-72A5-11EF-9E32-4A174794FC88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432486075"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1404	iexplore.exe
1404	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2340	1404	iexplore.exe	31
PID 1404 wrote to memory of 2340	1404	iexplore.exe	31
PID 1404 wrote to memory of 2340	1404	iexplore.exe	31
PID 1404 wrote to memory of 2340	1404	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e0609044ee69594f6efac3f71c2d6344_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1404 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C6A1D5359746F445A967822725811168

Filesize
504B

MD5
20ea759499b939faf44b5dc1498fa938

SHA1
0117a0ca955d715a6d573dc8f068b4c242df1a89

SHA256
08e34e56dd2707260f0e394de8858fdebb4274637542f2edd188d235507fe549

SHA512
911d050177d9772a9b98b3d267556bb1bb16df6dac367c2c4fd0192adb7f7c08c7de0da9ca60530f718f9aed0258bddfeb9e829b7a3fd6f00d643734f1d8be63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
a29e71e784d721a521171a76d987b861

SHA1
af54dacc7cc3bdcfa56d4c645d98fab013071fbb

SHA256
2dc8cfd2d5b86695bea312d33a0d138926ed416252dc2aa286c02aa49240e6f5

SHA512
f9fbc2992a2de96b736d7d8b2b6b40e8267d2cd1c68de5d7cf027efe7bf981568912726191d35b1e37106eb17015f7470e1ad28dd9095fa054f16002c2f70ab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
52615165c57571db2b0195f9738de0b0

SHA1
241597ccb6bf8f3b87de801e98f389bfb9e65d88

SHA256
541dfc1b09999a5fe57615acc8dbc1dd66136c16de008ca717caa360e916c567

SHA512
a7e82c31e0e5ee639601eff12a8e42ac86d87bde77e88aac3f4bfb3c55222ca101fe209cee2f53d044490a98b306da2dfcec0ecbca50d0c3597eee1d7f0ccad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
3ec2d874519e4e1e9c108aeefc10cee4

SHA1
0b6705f924c18c3ac2baa1221a39ce4adf7dca96

SHA256
cafa6cf820fbc6475dc687d5e7ddb1f090a41414f880b1ff998555cc4b204eb4

SHA512
d76efb7bb9a17a5f27599a1bf4804f8d6f51a1f6a9f369dfa83ef3af89f84895530ae326bc6bfa8e42e94b4f86d2b5a0a203d79a6dfc7fe4f57b8966ecf17f10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6ecc7d4ddc1c8583b233059ece1c299

SHA1
b67ec242e9f342af671726b2787724bf5e06b182

SHA256
150b82012d491aaf4fe7258b69f87a98bab341e7dde4f9e52dce0ed8896bd9b3

SHA512
05cb4289a19187d2d384841ada7a2daa55775fb3cdace6eb25001c4dd6560f1c6a3b88079c0e1eee395a7c29d76344e1d16b23aac9d7898a61e037f370dcb845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
640880ca41581628d27a9ee8427ff810

SHA1
0004dffe1a9219a2392b47520a5e1e7ac7cc1ce6

SHA256
428c297fc6ced144b9c5a9b71edfd64777cb0f7e635c3bb6bbc96c07e1ec7dcc

SHA512
286fb3acbe0727af139e74496be22dda9ec6e839bb23f312f6c7bd50101e8dd65fee84b167093faf54dca7549abc42949ddab335e3de96c44777f0fcfcf75419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
815c150c52756be5308eb3f6061bee91

SHA1
23e740d5587d7d03cba3928f56989d28ffa85b34

SHA256
9811d4a509d285b0685cab348786093491da79002a3d3ed5d285bce9fd695218

SHA512
cc441b05a6505a2143270aee062e85d2dd759d2b971898bcd83f4813b22a4e03c69d8b512993e1fc7846839f29de0962a07bccb89ff22c7bddc053ccbf941a13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6dc30acda3f23ed1e4a3975aa741bc4

SHA1
188a7276dabce63581c805111e291dd08f2d42f9

SHA256
c39e0c4e06b8f401da4546aaaac0448faba6109d767debf58d76be534144c806

SHA512
c9eba0006b29d231ab36aca7112f05fd0ce712c9661a38aa4bc1b4e8110b5f36fe315a09170a710b84ef43a8d9920fe6a119243035f27dcf7f0286f17a56ceac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38acc645d1fb126d8d57b538d97f2ba2

SHA1
a77ff131fc6176dfb5db3e2550da13e30e3c193a

SHA256
c0c2d6607c2382ed5de13bc8deeb9acc0647b27f636bcf367f1f62498861256a

SHA512
d8e28e6956a23ad3ff7a36d9e34c557f064e04147b8fb657385e2cf0e70290e56cc1d9ced39fb5a08d7ca5f9e015dd54191e32563d1246ea64583a83c64857b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b1364da96d2dcca0a84b42b1947abb7

SHA1
b7037fb85c8b73d1c20636600e34d14bedfd04d8

SHA256
30e4c590003071f37f8001e353afaaa8583d69d2b3b67df539c39b1bb4950447

SHA512
7e051cb408ffca4a079a5c85ae38310fc80187d27fc13cf3358d8e6b7ff1c1c85b3e279f1ea560262cd15aba9484a20242a2db9cd0636c4c265dd56334acdd57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa85514ded0f8791c7c3aa39052617d5

SHA1
37d808669a23ff85deb7ed764a71ab860d06b093

SHA256
d512bf6ccbf4face6b41ba4e6b7b31cb4c0c9d99d04c68dffea68b7e19de852d

SHA512
214f67f8389cadf12657d7b694c0d0932c33def2b9f5e538217429bb1e08439ef881c97e33a0f71b3ea9c3655973a07b0c5e5c81ab9c4b089a0e8a6d6920751c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9adf84f6f1b45a8b0067f3a731942951

SHA1
6b0322d92d87eddf7e7bab73d44eae6ffcb1cc85

SHA256
b5ed605294b11365f1f5a48ffc0455214309bcf82bfd894555bfe7d464c63136

SHA512
d8dbe7b9fa6d6c6a239679f48a78fa20e2c16c316044a6690e8a5e709847769c7fa8e960d0490ba09a05f38c3dae4d4f7f6a8d5228b893526e1589cba895c315

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d9b0b1eccbbf8d5055b8de309296032

SHA1
8b4519f9a2ac4938b3667ebe4445d79268777173

SHA256
f7ebe00dee23507fec2e5cd1d744fd4897b69a0bb1bd6b72ccf0f4278090c8f6

SHA512
83e42225a36864bfe11be06dc4e9cb8ed8a6e2eb3b3f7ba831add06e324ef761b625fc978f9e7f8feebfd356964d76ad9675f6268fcb09f0fa26d1ad09749ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD99F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD9A0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit