978dd52156a935cdf0848509ba90b6827b9321e2dcc3c3a066022059c2b80562

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0709d4cf260aed75bc0efd847748486_JaffaCakes118.html
Size

143KB
MD5

f0709d4cf260aed75bc0efd847748486
SHA1

7fa27da9cba454a0d7da9d7acd22e2fb4bb7a108
SHA256

978dd52156a935cdf0848509ba90b6827b9321e2dcc3c3a066022059c2b80562
SHA512

32b7656abdee22830b84fcc0fdd7f220244156ca3f4bfa7dfea0411008f22be19e017ada6937411435003abdb917d0ea8fba965b7313a68c379c957516c8fe7c
SSDEEP

3072:SBcx3Ix7dyfkMY+BES09JXAnyrZalI+YQ:SBcdIx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4042631-784A-11EF-B0B3-6E295C7D81A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433106666"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1560	iexplore.exe
1560	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2684	1560	iexplore.exe	31
PID 1560 wrote to memory of 2684	1560	iexplore.exe	31
PID 1560 wrote to memory of 2684	1560	iexplore.exe	31
PID 1560 wrote to memory of 2684	1560	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f0709d4cf260aed75bc0efd847748486_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1560 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a4a28e9a6f85859d8ec27f3da034495

SHA1
1d431a6558641e89145ef080718f9a560f14245c

SHA256
9d0a8fdcf7308156993162a1e600921222ce168d60a475dd0c7631cc0ef92304

SHA512
aad927163541b27d7cbc227efad946ff42b603ab190e88fd256f4e06bf4bfaf1078d11cdf88972347e81e928d424e3f11ede2ec415fe4b6477d3042fc7bd05df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4308426fbb79b69c18b09ac7b80c755f

SHA1
020d9df87db176520f8da05586be063c677a93f0

SHA256
2e310e12054d117dc4d4f93ffaa0f128d90fe7f04ec26bc05cfa00b8946cd214

SHA512
12b0d3155a2086ccb0d3d192223862209f34c7c6390f4fea7a31dccbad884a6f46f8187d578c2c1a46dfc4713f0bbeaaa390b68912f9149dcbcd41ee50dc1131

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecad80e336e2a52ab937f826d4b8b298

SHA1
4d63c18e5dd58da90380a32e331032cc97dd7876

SHA256
225f6c13b7e796953a3b649ed8c807075ec2c833840eac1185695c9b2eda30ed

SHA512
e192a6dd4b590544e53aed32400fcf6d508c24b062d6f5dbc1285f9ad2eec79e52ded035d61cb318b8c77c132c47da3ccd06e9191c0fc45a9429add3b6cb2c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b980b55ebf75050aac94da0f502e03a

SHA1
9447beb439f8dad25c727823e27061bf30dacfcc

SHA256
36caab9faa1af761d6d9aeec9c6ebaad175ec747ede4af2ac13fba9f5cf1b278

SHA512
864dd44a8bb5b48bbc3de3e23f9f4be2b523859ddc0184cc98abcb6f555e61f6c908ce3cb34def3bf0753868ba89f8ecdc9f42ae0d91728f5452ffdc3e9120fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79b654f7b266adbca8504dfbfd7da984

SHA1
8f1e07ccd41ba372178f880b73491e5ad38afa11

SHA256
ada1dff6f27f01a7f6bbaf384a6928959de31a17a574f4904d2eaa758207fa6c

SHA512
0fe6dd6e8ce5741d0c0823f14e73f3e0d7892470be14823e4319cd1ef8b795b0a384e7dca7f9314419e48fcb5beef4d99b2233764af92ffc3e7b150e4c886564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2da9956af5b1336cc66dd6bf0515703c

SHA1
4b7dbc7e0310806ef2ed19bd5d8d4905ceb2d2b2

SHA256
2a5f8a68282a5ce5c00531753b237e6a136db8072f32b539013e07e3ee6aa7f2

SHA512
0692183b51fdd383d6d4b871c7df22b1435ee4ddc46746658b859ea08cd981f5a24cd04eada03b9d70ad97a4fb18bb8480c7e1e8691b5c6a4100fcaa7def4c51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0dbc96aae1f7e86c21c778913354396

SHA1
d10845408b9b935c99d6ce3e737bb212f6c1c4da

SHA256
42a33d6b22c7465fab284055fac8fa36a2cc6f344372ca733dccaa0149752d64

SHA512
925c5f1e13de4e940fcae97eb676cee66c92ffd44e0a870b98682d0f8a7d30ee9f2906f2c2a4f5c97503cb3cca083458808f3496e684f190ee57ef65fcade2c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
549b43b03a4dc822e89df9977eb4d2b0

SHA1
9da3a82bc0aec5867ebecce0d4b7848254654224

SHA256
fd0e15d5c5ab1b1bdcb109cf3137f481150cc329e02104414592be1599340780

SHA512
19cf90eba4357e39ec6794dc0bbbd5f174e2044bbdf4b038e80d7e36192a54542ea83a4ce478db4daf61904a82a49238bc8562c30b4fdfed3df41dd1d6be6dec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5f0420f5db50f9d7cb8da0d5edab694

SHA1
9dd2f5d8cc3c5c1699b5c5d3465416898eafbafa

SHA256
7a53807236ce8694e2e2342ffd2678db11b75f80cb24446a2015a2fac0792167

SHA512
a22280012f382cf88def1b1cc89943af657e0ca97eaf78950aa24fc9e71c5d4ca9d46bbc77f2aae5053654515c39b3d9b57162f151eae59674b4cf1d557496b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d5a0770340fa2d75da0b14cff7afe1d

SHA1
e0cbf107fcc2aedbc0230115214ef96715824756

SHA256
505ca781dc56808d57ecfb94d5c89c1596438964747174a8bd52b58ef48ee931

SHA512
1a899b36ad034d2ff0035e008fc97da04224dd96aa25a25d350bf690d647c9bc28c188636aeb7ae603b416c628a92f30ebc906a12a326ad04166fd8ec0a76c44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2734f983f359ce6df97adcbf8ed72f8a

SHA1
6777e5d999c560d21600260aa802f79e116c8fde

SHA256
bc3739430f013d57e4c7bcf2d316447d42e110f797baa23b026b94046268fc5f

SHA512
a4a600978ad37e04aaa8cfd71492625c6c6a051fe9b0dabc7df2a7dda42377146e4b5383d95457b34d45b1f365c8ca4fbf137b48c55da386809b8219df6f305e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01ddea4d7ea49243d8b7b89a0de80fa4

SHA1
e75b5fbda34af05665d7b37ed799b85860c7b6b0

SHA256
83c17f9f329f99639cd13045c3ddd90df4c5b13816363ec8eeb38f114a37e15b

SHA512
55da0ea332519d603f11896bb3312a9e442c7e14492e46b1ef018ef590f5f39c26ac24c13b46dc37967d550726488d7348a6d2747e40a6c9107b20b73bf914fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9efcbe07f672d74e13f542dd9a110f20

SHA1
35683cb860686c2553b6db917d22f72d87f13160

SHA256
14ee399f5028f68e72eaedd12455b3bf560e8d688200f6892be1dbaca6928891

SHA512
9490db6da22f02f44aea07b253e999ebf8a70800587f6e2e6a7f6177e2a7bd34d1957708084cbbd58c7c740434958f6912ea940af1e1fc386844ec732c8c492b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3686e5d2a592f1416547411bcb9cd25b

SHA1
d5c0f45e2eae5a1fafddb3e5ca4a47bb9bd64bbe

SHA256
f0b8246ecc91cee3eba5a3619c21c3d9879fcc149509200f31974a5e5250ba09

SHA512
beeb1efa2f0bb7b5f8276ec5e1c17687ca5cc6c4262204ed1c2fdf5cb842072d756f19a2a841b3aebb9424007288ec49be6d8fcaa0cfe029ba543dc71ee58785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4b521f54b806878df13b891e8cfcb1c

SHA1
268624aee2d997c0c76da4ea3e732b143a58b088

SHA256
273f2cf39c79b6bb95afe24f015f284d5a8d179ebbae6e5a6d4debcdab53a1f2

SHA512
7b02e4c17da12aa372c333e07bf1bba85ffd470d99df81da25093733b4de82a0b7e767792dfe02eabeeef3a888996e02abf1b37f28251f622debf887d7a87296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c29896ff1ae45d1412fa3b76bb9baa5d

SHA1
c81293cacbb82b000c97790a41648ba76a78b329

SHA256
167b228fecd21d19e79720cb13bb9145bb9af49665055878cccb955733939767

SHA512
e229d28b54e71a159affbec1ba22a54baac3e361b347802d59b46da85eea16cab3aa4769abf2e2c595b09abbe9d8993293e484f36c0f7c9c20cad2ac59758fe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77bf6677efba1d4efa495938c5cafb53

SHA1
09246402a4c77d5febe6332d01c0d03e8dfd214d

SHA256
fe0177858ee5382cfe7c64a102922f91a4b2b4411b7a877ca13a062801bc68b7

SHA512
ac8537a147a7af1a5e1c6d5073eacc718f52e1873287b43b7ab293f9017d0d99312939524da4ab1e6e487fecbb37b133603af818ab11e0d64bf17f2381daa85f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a515544df6dcbdd501ee73debf98145

SHA1
703fc525964f41e0adf12a1477c0edff0a3cb9df

SHA256
95974a38bd1ed6b5c859e46166fbe9fbe06036dea46931c52654bd0b918a74fe

SHA512
05e0fe44986a6081c966d7963e24a72f6b8747e079606e09635f664b9631db16b4cd211eda307eb28516057900a12879a40accd8120adcf15625ab46dddfd19a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEED4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF44.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit