0c62937d2b5bb3c08734406b583f35ee5e2cd7c7cea46820f38f7099eae7d646

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead3806588ba3af4920624e2a1423696_JaffaCakes118.html
Size

11KB
MD5

ead3806588ba3af4920624e2a1423696
SHA1

f416a49b1419717ef84a1a453345d6521254b50c
SHA256

0c62937d2b5bb3c08734406b583f35ee5e2cd7c7cea46820f38f7099eae7d646
SHA512

1da8d829008e0205bd1c555b00bea776ee8116520b3efe9e58572e89dcb52986f87748401da8b334dbff89c5f0ff3c33c275a09037a6ca5dc25d11e7b71d8c97
SSDEEP

96:1PSxZgHVgEEv4L6VWLYSoAXtzKezC9/MTF6C/2DqSjBeQFqLZz2yMyBkkQweOFGr:AKmgxKOTPfHLZz2yMxweC3/uKozCAnJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432891844"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{970C2FB1-7656-11EF-B0DA-FA59FB4FA467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b07571630adb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000004dc93d3bcfad82efa7584be1360d35ae3c1b28c884d46216402e44c97460a5c5000000000e8000000002000020000000f7fe3fd3f9e8f2c0e14eaa5c506788c2368f810d6270e6406a8cc482f5e6521190000000d496168b5cd14da0a01a8da18c6ee9343c33d57af8ec2a50b35c11001940d4f0f784a5bb7eb9628d79eaa8386b3a298eae1d568b071b9aa4f12ec8dc913a86577e8fdda4da35a0a0484b2f6901d31f4da1e5ac6d259b5077e552da9178b9c793df4f73cd2c8235875869ba686b765389d881b106db4b05dc1e0043f39d846b71c0d1a7652a6568d092db5fc7d467cc5b40000000bbb030e411c0043530419e65ddcd1db0a248fabc7a7851cc736af115e5623429b28078711ed4a1385925d6040d07f77911129a2a1f6d8bfe3bb44c1022b51c00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000b71b0ddc910fe3e7715dc1ae1d0917ccc99ad3d0c502b85e2408d402002b89b1000000000e80000000020000200000008c03cb302162b6a94735dfc068bc0f8c1ecf7ec66c55198d10f9ff302f83655b20000000f8d10277c7feaf8c19578f31c4f3f9e96fe8a536dae80891d8c841d627039ca0400000008b0de5abb64c88b87c321effd0e5122b03fd5c3319728857d5c635e66717ee5c0cd438b1091db9e274b98e7503cf0ae471ed2f5506f3127c6921e232a6649618	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2432	2428	iexplore.exe	29
PID 2428 wrote to memory of 2432	2428	iexplore.exe	29
PID 2428 wrote to memory of 2432	2428	iexplore.exe	29
PID 2428 wrote to memory of 2432	2428	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ead3806588ba3af4920624e2a1423696_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3d65f27e9b7d959ccc77fc3e3b0df63

SHA1
9379fb7752574b410b8065d4216ea73340bc5044

SHA256
30332a7a5b0aab7278eb0a1da10a1d668ea20f0105a58cb138f524f85dadaa7e

SHA512
c43107c973b698d44978568f4433294357ec128c64613496ea0fe6daf81c682d908015a3e55e8fa68a6c9c3153fd79c260f3622ae252ddf2d73de8df6317a295

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e67bf12a458d29aeff739422694cafa

SHA1
9967479b173c7795c3cb4ad79138a8a7a92a2205

SHA256
441d0f8a013e91853e481690642bb2c199548306d8c5279b035706811dbfab48

SHA512
d42b69b28008a9d55bad080f62f590ab83a0c5c734f8a83a00342ec0da35c135e6d1eeb0b1b1a1424ec96870579c6fc1e530f2a2c110712f9e439b6ff17e5686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1eda1adb7bf3eab02dea70e059c0929

SHA1
275577746c6963884b5c95315c6e6cf32454401a

SHA256
2ef4bb0ce3c57be3426a9d7244d24100047af70836b61e3d0e99a15e4b39fba7

SHA512
ceec7d4ff0e8b6b24e73d5a6b172e8bc0df9166e39c6978c46d2c38468c5e521e1307c8e34425cccced44494c6ca8bdd7543e0d4a72dd0887c4d4e1b326a50a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db3a065622f1bd1b91239f53237cafc4

SHA1
41f22d476a837f091203b51cbcac951df2bc15bf

SHA256
64194839c8769c63535ff34737c85493eb38b7a2fafdf4f157074afe43603898

SHA512
ac5b21d6587ba09d4a16fc6e565ba8c59089b3de18530c33390a399c0cc59c542d4789ddb304ceb9ea657d74b959100679708cc1413681bb6300931f4773dd8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
178fa1a37920467fd072062922e87c4b

SHA1
3c690756827ad3ee6ffc8a35498f177a82dca621

SHA256
6d560edd8653b7d3d8666d1b83228d61e322621fc879d8db17ee75a8a88e5d3e

SHA512
a1741953e19d3217e60232e98c332479a08f3208c87b943458484ea9791a57a368c11ce49db15b1162b8c9457d16d9bf420648098144d7173d56d063feb426c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c64cf9906eeaa6cf8c92933679b4cf0

SHA1
64f79e67dc110aac47e54bb66458b0b3b7e4daee

SHA256
0bece2c5beabe526ed45faf876d9eb30883e7af4f9ead3cc8accb71a16d52c2b

SHA512
dad649c43c1da8abf3244e140783dc311478ed0d21bcedbebc5661c2ad3a7333479ff812279390abfa547cd18262be9a8dd4b2c4a0aea3f3e24ed3e69f95d5a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c795f9e7a16c60f940c995e523ffcc5c

SHA1
c747627e761f1f67387d88d83203647192b071c9

SHA256
1d08e7ee3b33c90649d51fc7091231fa1e9179b95d2404404d52b0bacc56d20e

SHA512
dd4cf4d9c47bb12fe005eacd6cc07c6639028122dcc78356f5d210633d06768e4ed94d1012aacfc991025cfca9d355e824074874c0f2d6b84d371022501e459d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b121b56ab93f139c05134e009e0fb8d6

SHA1
572f2092e8701704af34a0dc09f8953f3b995759

SHA256
2996ebd445de4104f5f2bec04e17802c262acc6db04bfc352fa46c6f0f8049f4

SHA512
7984898e0de67990750bcb5ea7740dcce6670bc35deb1e05b1d01a650039f86d6aa3e64c9d69c5240cfc4ffe488fce02bf16e978e3f6c08fafab1431cc273c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5272ac301785134d4731f0e19d6bb398

SHA1
53efe7707c0d8c6d4bbcb170632d6657ad2fa9fc

SHA256
f4a903a1558dd1db9838f3329dc8c9df89f9ae72366f82c6d36e92128029eb7f

SHA512
290ac287c2e324b6536ca5e772aa5c5289106d4dc725dfc31a00c3e05a7199647c18196ac566ec5f3386f23c566a6026d06a94cca62837368c19b2175b04f3fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb142b36996f4375f43dd90b99615fb3

SHA1
cc226d59e583c1fa92e09ca15ba78fd0f004e3bb

SHA256
933b6adc817616874e2136da05560be09332911ffc54832b30bfc0c2bc7bfccb

SHA512
025dc325211b98d314f0bd0d4c8a6a330da2954a3d8b2d0ed018fc3d7702a5ea8cc3c398170d67962b81fd222dfacc1b471744fffbb2abebb2fad8f373191413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eb25aef0fe3868cfacef816db288270

SHA1
cf8fc4cbf26faa516a9cf767ea801a5b0d97a9e9

SHA256
2da6d4c9595207d2b1ead742a17f45a56a4a98869728f7bb53ec826fc9e7dcee

SHA512
7c999c5697754aa8a8a928f97e78949cb2bae460196423d8c5a34a6cdfce2e8431743805bfa1895373ae0b0c6fc4467d9e4dd486cb641a429c56717181899f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03fd53b4a0cffbb06c704effc082e25b

SHA1
1dc178f7c6c6682d2d9ce7082679b25b7616dd01

SHA256
8ac6392048626f13acc532335506ea7e876664e20255c5dcc9c913c9827426b7

SHA512
8318527d53adef599c9e68b9a11808c7df26698cbf1ea05c056f007933a97ee47881b07bb04a39605dc08a076d89bff8321b91c83ad1d275469a35e34aa19880

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A41.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7CD3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit