12e05f1515adccf3eadf60394f0db64f4d40634aa2889eab97c2b5573f6848d3

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e27177f9c562f46bf16c21aae1a6ee54_JaffaCakes118.html
Size

4KB
MD5

e27177f9c562f46bf16c21aae1a6ee54
SHA1

a9d55f10a63e1ecacaa74d7de15086f0cd14ca4e
SHA256

12e05f1515adccf3eadf60394f0db64f4d40634aa2889eab97c2b5573f6848d3
SHA512

1c6104970a6cd417407d55449fa19debf810b9a1c3d44870592700fa54ce1b612a8c77a265de55d4e0aca3fd922c859485aa5e9808041a60fc22280d84f579ad
SSDEEP

96:ziErZmV4MSEPBDvV0n47ej/hgOKiljSR1QnyneqXiiSZ63:ziewV4GD8/h/KiZwQn/qhuq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432563871"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000013db2593ba164d1c9bbb01f5f3afdf72b8cb12c0612d5e36a56dc4686b578043000000000e80000000020000200000000eee652d6bd848a8f5f6c64a1789b3bf28ca54bd39805d2456f0de9276132879900000000eb3a0d4039f3758ffda5cb55b2dd454f32a7cfbc26043f8b98e5f1c36fa6c3992181a806dcb92bb5bf6803bacf937aee5bca70b4c32f8ec961ecd2a734dd70f5c5692cf3ec8ca7da8a95a5b08493e710fbf9011b449826981afc8531e17165ba2d6b1192446597ea615d9d2b0b555281d8ec0703badf93a45b655d1525d657e8406077d0de78d13e4e32b186116d78c40000000f15a15facaa08fde6267c128d81c191df066ab53d2822f764f52d11c70d0159bd0c9b1d56598dcb7cfee82be4999e8cd67b1b1d88f02cc355abce88f77d80443	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000000580c14e32ac57dedd3f031b8e52463e85625415881abfbdbfeef44b45e41b6b000000000e80000000020000200000008ea8e1e84e11ec11c9f9b48c562d0e3d636500b4805accb805647cc48582245f20000000275b52a3f58ad27a1b23be91718612dbcf9c7f3b07a93b3f20c9d2ec0c3653db4000000072d7620cb016870b97b4b43812e9bf883f8b8185edc9e8eb86d25d0f426fafb2c25f6d4badb2960f6ac9e503c633bc9c18ee3c24142d0b97a39e7b1e63f829e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04e68bc6707db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8F9A581-735A-11EF-B221-F245C6AC432F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2676	2632	iexplore.exe	30
PID 2632 wrote to memory of 2676	2632	iexplore.exe	30
PID 2632 wrote to memory of 2676	2632	iexplore.exe	30
PID 2632 wrote to memory of 2676	2632	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e27177f9c562f46bf16c21aae1a6ee54_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83d7773e04cecf1792228b91258c2149

SHA1
ec0246ce9c23270b59f3f576c80d95735641179b

SHA256
dea23d471f992660f240799f2aad7915acbeb6c344777f3627f97bc613465e21

SHA512
fcc5c0156014aec0803377aff22460f3e2f438c6d2dd31bb1083a36dc51ba9eab6223c8a8176ec08309d3cfdee827b5fe09aedfae6705692e7997eb5ab866833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61c4157b1aad26d1997a316fc7eb377a

SHA1
46f5ba1dec0ede28cbfb828b8a1b01470f64508c

SHA256
230572f42aeede03863924b242840f2b65854a3e7051aaa2b76c6ee93bbd83f8

SHA512
8e5a61936259278108caf1c8e303bb943918bc7bd0645f7580c5a12be1cdf719c4f1a14506c291d7c6f20513eb7645535801d26ac2d6696890fbf205d760db44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a65469e2b06cefc28f14742fb87a40e

SHA1
7b85789d5bdc78d32e309021e15f105c8983934a

SHA256
cc169b0cfde7dc1af404a84b035c035e8d1770da7e7667eb8d62e6a467f37eec

SHA512
0c9083aabce850b44e749404467baf88728281089a3c07eb916aa43b11c7b3de2e2549d3eddc66c98b2bb7da563db44faaf0e12e8bb1a53142c5ec365ca16f67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1a34965742a9bafb9079801e9d6d23c

SHA1
b28c353a9458658a44d7e3d6073cfafd6959a27e

SHA256
7a57f31cd8a19837a079b8972d8f62197b793b0c7014d1f253d54c423b040d68

SHA512
8bad1ec769dae9f07a39d36d314fa14559d595be7ce6f184402e1e14063e6d5226529d66e6cf7cab7d278deba4b0b64f5ee4a4317627e99e226381b0355ea2d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d3e162df9f3f72b54f4d7a01365f636

SHA1
9e7b6882da20f03c567aed95bd76d0056f46d822

SHA256
71f7fbeca48c7faad48a5db53b841a69f0c3ed88c182b7f03521975a07cec301

SHA512
d87d328de276005eb6d67bb4d0700c02575a2bdd38943324b4b1f733fdd84577c24adaaf13d8f8a714565b977ad3e7ef2982faab75cf0c7c56f191b52fa4d68e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8c7f030fc4e2cffdda1306678f13c23

SHA1
c316d928d940256faf3925418995adcf9d1764ea

SHA256
25e5cb883382b28d7bb992ead6b55a70fdb613eb5da28ebdd2c6b08b6086e355

SHA512
1bf807d595b2243ca8adcb941176dedc2da53e48cf151e3a53324441510ddc844c8a56f7af7901aa1012a01989c86b50f5a20f7cb75dfa2b22e182c648a7ba7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8475a49542057e24239602c7fe64746

SHA1
52818dc3e6d31db251746ced5d342d22d0826dfa

SHA256
ab1a728753c70a5a6683b30dc4a534369529c7a9d66e626800944179eab02d0f

SHA512
3283f9c5e0802edb5ceedca9ec949976f8196f1f63711cd99c3eab1092d9e5351131a938b10df897c2de466e093e1e72317ac84361a6a1d5d2e4b70fef8218ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9c83d0a1e4c0868f8ecb772affd4787

SHA1
6de025b1cdea929943e1afda1d1d2972f8e6ee09

SHA256
79f2d5a2ccff568979ccb93bef3a371480b53a95f310c1017b0e529bd3eb2b36

SHA512
f71049e956a07dc9e2b625aaefec3e1b0c367e82be43df63e697ac7d57dcf0d4a181e03b838c54ee4e5a826265689bd72c515614542f7af0e710b866ce7c647b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08a96e209b036b71a76dd3b9cad4aa0e

SHA1
218b4d7308936fe5e8cb28f73183aaac5756ca9c

SHA256
403a3cf20a7cfb22032f760513e399349f84a47f736fb3b91d16290d210c147b

SHA512
731fb0128c4626de5e93a348e595ab8171ed72555e28b7ace32ff2fe3c6261385808a1e2ecdb162d352544e4977025bdd9f891a5f8de3bf506aab1d729e5f177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c5795e39d0358a9e667dd67c814fb88

SHA1
cfbd1579089262c6b342349fc0f011270eb67bc4

SHA256
3f3c90b323d70bb586d400276a691ebe97c9acde7b1638697e1998496455aecd

SHA512
1087bd97d5c9272ab1224a00a133cac0065872fc208890263c693f6001fec7e5ac16cc16771029b1b35ede4aaba9584f831ac9222da59791d5df950def4f4256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6182.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61F4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit