12b497b9124079862ccbb6092ff49e8e647e7f81770743c35c2a69d0518dcb21

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2557413bd2395abb31d00bae6811851_JaffaCakes118.html
Size

10KB
MD5

e2557413bd2395abb31d00bae6811851
SHA1

732b660ae041272f7211a215eb51f0482ac29c46
SHA256

12b497b9124079862ccbb6092ff49e8e647e7f81770743c35c2a69d0518dcb21
SHA512

1a9b36febe1ae37e5f4f5c36818f41e61e8cf7bfb90d69ef04bf2170fc03beb4b4e6d333f4c6d19b7595f03b36299f96837fc677b79e036b1363bc05295430cf
SSDEEP

96:uzVs+ux7NGLLY1k9o84d12ef7CSTU3wGT/klUpBJ7/qOUIootOlkqlVHcEZ7ru7f:csz7NGAYS/ugIv/qOUHlkqPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20960D81-7352-11EF-B8EC-E699F793024F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000c4d58fecb0480751f113477f0f6740ab0fe5300b86f12ab4f33a022869256f31000000000e800000000200002000000019f1d00618ab005be621b35766d4036992e88269dd86381e8ef34c93cbc91c4b9000000072b23b120d2401f25b9de76aee78eda496f7c248e887675441a8b694258ce10a1f3dfa14acca3afa2a539036ca80fb88113a6b346c1928fe054a204f6687cf47350ed152ffcd4b959e561f393d3845fb79739823e674f3c81df5ef64e7ca2ddb13f4b513a87dfb5cd4d134813b677a705d7d05980f40f2d14f57063de76a2e780bd058c7f0233dab4a3c041c5f300f7b40000000fdf071b0c14a71f1106974ac998943b470da4892a27ff9132dec8607b6931e5cf888db65d41d38aa47d6a4e99112df9f69167c48f4e98748408a9fd24bda322c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000002b826938cd5448fa5c9515e9b05e66394f4a2708b412a98f946c9dfd65147332000000000e8000000002000020000000f78a30911718b4f20fe0b7c6b745c84aed0af464eb17a857e6a285783f61f95b200000005418e836781fd3c6c30ec8cf60b12028071c0c979524dd729219643c3f313680400000002023accee262bcfd08dbe42116cd21158029aaf6fccd764f409a94b2a78e478a761de11fc781b07bb16f3a67717a58386249d4e81d9aa5b3a9e003b5ebab3e95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432560072"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b006a1f65e07db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2628	iexplore.exe
2628	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2652	2628	iexplore.exe	31
PID 2628 wrote to memory of 2652	2628	iexplore.exe	31
PID 2628 wrote to memory of 2652	2628	iexplore.exe	31
PID 2628 wrote to memory of 2652	2628	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e2557413bd2395abb31d00bae6811851_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a95d82ce4da775e041da5ae30ff1ac77

SHA1
d1e75dfd08e2cfaa1499805222f2ef06d6cde46b

SHA256
788d37a5f3f2a59b14db05e95b11e681b08837410e741471f7d0f66a6cefa57c

SHA512
70bfc5082a269dbf4a7a615ea3f8af036a2dc3ab54565e74c546be021e981bdb38121e907bacab5653d2ce3630180ed169615af26b74ed8e7aead7c1f549e980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d66175d9c4b494a0d6c2cabcd886b680

SHA1
52861f91e303fa7b7782864660f5f0ee07e0d7ce

SHA256
cc559d71d7bedce82d529304de4c050a10dc61c6bbe768f8aa3e25a4e73a5f21

SHA512
108ac938b1458c09ed1cd50155ba6cee9cef19faa3fd06e92199182e268f1632e221b149659e36a691f23b406ab1e599b510716a46d8dcc3f686ab7f29a208f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c451e4157033fdd83c08c70fdcd45d13

SHA1
f6f71afdb34b96c6a609139e35be63c58edea8d6

SHA256
2e1376f440aebeafaf0717002f6fa30a9cf7df890f6aec477be85f9a875de706

SHA512
3b33a496cf7ad65f3b2c7d9ac89fa67bcf74bba0c7226d9b13b87c2c30a4371282013707cc477595130bd21f2ad644173abb0f5a1af482fc78770d599d06bf00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d1ed0b346dd0d4199d68d2ae2067514

SHA1
2557c4779cd5f7cdf5250d1c7cbe285fc87e8824

SHA256
143b287e8206882e5befacfa81e8770b4730de2556d7905efbd2b5263e4c5a6e

SHA512
00935df9ce4a7facc146e9c32ce1fd9856b10985d39fd3d4ab4940e97eaba263fbf6dde955141e03b0caeeb7e82f3446d653aebbd0b8b70583198d568aa334ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87bbfcbcfdbc7d80ea447a679a103eba

SHA1
a32162b5a4b47398b0c894ec3b3ce19d5f74713f

SHA256
cfc1c06d76cea0875b1ac702ccbc97e12ac7cf48726c5b76bba9d8ff665da844

SHA512
1d8011087f57dc319c1fa96317aadfbb274071d3f78440aed2d51ad627f7d09ac9ef95e7c067f532095f47d6daa039647a3ab633662414635aade828a6b85464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9f0f675e20709858ddd29d5a2dc5340

SHA1
1795a9e2d558ce206bf3d69fb6e204311da7f5b8

SHA256
057335d46735c38ac5d6314c63f06975e7f36a8eea416dda632f9e766c1522e0

SHA512
96602a38c2d0ff247a49d538049ffe102a0b9bf7f7704ff797900dfdaad66028c7d6274d89132b6ffc65842994f2e274b86a2e982f2ce6b34f41c50766f533cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c88b31a7ab941c64e33ddd36724027c

SHA1
724972f3b89ca277745f70419f2b20d07fe66dec

SHA256
a274b0b22a8d7b7c1d6b0dee6aedfbcf91463ab2910b005de8ac7c8c7ad6c9b6

SHA512
c1202fc4664382deab60a3794c4815778ac94c77fc88d17da9b61ade32f170a1b63ef10024f7b90a31645c9421f098a27dfc48bbd2f14100a27bafb0f3090495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbc767183aecadf640db5396cd354612

SHA1
937a59e8b4f7c90a7b669a7e9ccc2508467f7a09

SHA256
18caa4d4ea52ab456243b82830f365bd13784f2c690e185c01043a5bf80d0b07

SHA512
bfd94d45c0e202072978997af631661aacafb15f2564c9abfa045f365b1556c8e9ea322282e9919d938ef987c74f50e7a18a56b841b5585f4f9c45b818048d8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce2620fe21fa32576660fbc8a9116067

SHA1
0d07a2e64383ed20f766b3a06ac4cbd384255656

SHA256
f2fc44b7f8900c8d75d371214e4e50430c55c78345b07f3af58a977c0e7bf170

SHA512
944e32fc07b664ca4ff62d95bfc854ba0f8d0cf9ee1c54d7268b82a49af482afb01079a7c4124fc31004001091ac93e9e3e443001939b8a093ee5514f983059f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2AAC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2B1C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit