2919bf6b2e1ed22a03765eb0f2bf7ed6c8ac738f3654c67167780687d765e159

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f52e7ed2bc6069ec703578ade4713e57_JaffaCakes118.html
Size

9KB
MD5

f52e7ed2bc6069ec703578ade4713e57
SHA1

78142c854504e148650eb6ed8cbe316500218811
SHA256

2919bf6b2e1ed22a03765eb0f2bf7ed6c8ac738f3654c67167780687d765e159
SHA512

04878ddffc750150a0157c43e871aab1b06a8418f2a9248c115d90d5e4f68b146906444b9926fe76845ca21b9f8fc8c7347f196900359c008e8cdb698b23fd73
SSDEEP

96:uzVs+ux7BvLLY1k9o84d12ef7CSTUaGT/kPs2pUlVHcEZ7ru7f:csz7BvAYS/rRUPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38AC7341-7AF6-11EF-9584-DA9ECB958399} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d2e89199bb571aeba8538371ea8d99d5e9d43979338271b1b9a8c3b3cf975802000000000e8000000002000020000000f200caf1f41130cba273c3990ef6d58fe8a8837a271b67b31e1f4ef2cd36936620000000458368a5698b26528ee6952881a05b8c33584abc5a9d31110bef6abe5d87c59240000000f937778134782f95b2c8429bc71f0dadf586d8792e12b8b085e6caee38184209b8d9e52372bfba40cb6177a5e3620a4936ff2bc4556ff1eb0373fdf171ca508b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bcad0d030fdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433400208"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000049ed665afcc92b39e90026f6a3653ce3c189742bdae3dd9d371a01819b7662c2000000000e80000000020000200000002210cffe32b1cd6cebdd37888d33e3461f0595b70d704df06a312f7772670a11900000005b9a6f075c3a9bde81c7980030a7312c4bc5eaaca01faa7f2f7b849b1aefc07a1d0f075e0e081b6bcd02e82b7f97a7ba3ee0c75786bf17863608d0e3efb73fccb171deca4e7c1602efbd2c5c5bf6808bd7d97109b4792904d5aa8ae88fefcb51fc9c648605335780627407a12e5a19d7588073fcae703846bea3fe0985dd82f6b6902938babad58fc69ed8d4a03e01374000000067819ada69ce1ba209ec58c26276f91e5c9d7f3c8620c8f1cb87f6ca0b70f8abeb03a0914126991511fa822d2ba4cfcccac5d37433df5e52d07d012af4931d54	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2720	2180	iexplore.exe	30
PID 2180 wrote to memory of 2720	2180	iexplore.exe	30
PID 2180 wrote to memory of 2720	2180	iexplore.exe	30
PID 2180 wrote to memory of 2720	2180	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f52e7ed2bc6069ec703578ade4713e57_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3e40dde4926aa5cab4fc8fa512dd776

SHA1
e1ca5f7430303ae46ec865708be9d229b3bc4a59

SHA256
8975603115e11fa10415953ed2e50bf9b7883d745f8cca148971c8379a2ef328

SHA512
020527bd345415ff0deabb9ffb5a2c956582d754e962d8714994872a4caaf46ada051eefe0ee5fbcbd95d4d28dd88b37094ebf3b1a9a259e575df34c49361f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
032bf46b6988cdd45524ea1fd908f75d

SHA1
3e7c16f3fa66b3a0df8e07788eea04f6bdcec283

SHA256
495ccca71d1c685d6ce356cae1f2bfe9bd21a33ddc74c833a63f854ab5f61778

SHA512
72abec5fa9a5efe89baf10aa94ee8437cdab79846d146ed92964a37c5f8a3830256ec57007aa1f9e2cb05584cae3b62edb087afb4379819a392e76df6d29b6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
956e8d13c726aafd89bcf17d6ef4ebac

SHA1
1428b814e86b2a10352e87a162ff04e40d07a917

SHA256
1d2b931d82b49dec5a922a27e01bd9707c34284e64a9c088d2d7d37ddbe33290

SHA512
6db79c8218c06c394c552f0e2498db0ed41cd8bc6552c32b51df051fa8d51e775e4cab896a40e90d437f6f993877744289986bdc9004d3d804e16b7546415226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bed3bab6aff1f7574410a8fc84f28850

SHA1
2b574e3d594f23f716f59a5de940a69d55b7e6be

SHA256
44f55093a1c179c553cb67b7232e6be8f39a76156dc21a7896b7c94e94688248

SHA512
6577f7d56fb8a7c2aea6243f12a06b462d979ade39c9d3a791462c64429a6845f975e64abd1ac45d20a3bcd4e56425c36f75d6d3e89d2496a06de5fc9d4564dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69d423587339cbcd3dd0e36b00a2ad32

SHA1
17401d1fd7cd20d7bc37b78738deffd54f6de24a

SHA256
3b6fb8bdebb87ca91851622cb0507aeaa59fbf43be31e0697e905f6dbe9a0603

SHA512
17cd0a43f9a0e12b0df42b51d6e1d5c7767feec80eb6516390cd8ce7ff7f7793b8bbbbb1acd96565a544455c01777290e69d047e2bd48dc2ac6cef5948d59912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b29771e691c3563a8e2e96bb0aafdbb

SHA1
df88d35cca55b70d33ed013fa1e29261c35951af

SHA256
18bf5f819eb5a16173c41c5e496420209ebcae98f3a886979d62f9e6d1e5c5d0

SHA512
8a2482bf2da739462cc6b1a4bd3dc83ce9521c9b205b3d5db3fff47fa7faaada9907179bb0d3606382baa0f19451da1b8cfb5c5e680d411a1092b8c7c077033f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8b8ed2ff65d8b9ea5108109ae7e6ca1

SHA1
e281868ac7ed27e52e5781ec6cd2a2af0f8891c7

SHA256
1a8a4ce877bccf071b754008e7345ca2c4fc0c5cd33130ab9602450de7b3dd95

SHA512
56e15ab4e4f6606b6ca215b0fa3bd625668f54bbebfb3bd576664416bdeafe568eed8015869f9de8f77532fa4feeeccd1f2e8d5539bc14c38dbcdd0a2a849560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dafaebf721ec876e7d4ace98505ebae

SHA1
eddc6e5c8161fc213e2391832b5b640d6a88f367

SHA256
595a40e109cb3c8520e108a207ef02a86f770401996364d5aaa2ce7417d6fa1d

SHA512
5c03faaab7cfdafc4c24d84733efef740b0c1d9e449976e530272a3abb76712b453244557f40c6f7a3a305d6b84cfe6af4566ae31c3743680a3632053c2d18d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72bf9dc8b9515fa5a4bd165a794fc7a6

SHA1
f603835bbbe8c39def3c43ad1453cff61eeb7698

SHA256
abd2e5be7e97dc4615669fbc1f5c88332a3433c4feaaeebc0e105b42ff306137

SHA512
967999a6dd5e53d9752a7b387fac3fca102b087af1ea6fd9de534f7045aaa8fcfc337dcd0d0d1a2b89bcae6676f2cb6d4b16f34d816bbe86f95da8805a453acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0210a1768e20a53eaaa1c60c2cf70710

SHA1
471bc9ef084ddbc5e6c0a4c4c2d97f2d98c8771d

SHA256
5688dbdedb134c64dec3a58eadc801d2b7a898bc58e95c66b97af0a90c48550f

SHA512
e7b3d3914793a06eafa58cdd1902c1aef41699a7ccc389a05afdd5faf8b18cdbab608b9747e496077d6834a3ec8a5fb8704bb26adadcae10ea875a5639fdab50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1e8af7a5e4631c43d48d7d3d0e002db

SHA1
4cfac0424e6f6237f8fcca191e5777ce5c14ae9c

SHA256
3123c5d34b5a4bf8d6cb6628729759f6a94e4272a687c36d0f97ea03a75c07bf

SHA512
ce2c6c40198a4913acbb882fe73b42f8489e64f55c0df4bab019aa64da518f54d39aa3753af00559eb0a613cd15a111a2335117ce5dfca899f11ec848e8eeb96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e0b2f3ba7ffc47e8fc5e0cde1b565c4

SHA1
c2947daf77c019025feee195936da5ce2bfc4e7a

SHA256
63e1de50f6a740a9cede10b74b5a1e7301acc53c59fd6c6bad30e6512d05782a

SHA512
dce984cae1c186eba4c81a847ca2309902427ac4c535f91c52a6702660a2c6615adbfa0fc3168ef801760721b4df5261594d8c6c93cfc92743c96799d597be52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28c632cab8977fd0950cc3072c3010f1

SHA1
a5e7d08c181e37b2b1cc98bf3c16b24ed18102de

SHA256
07e2ebb54fa69a5b9f2c0768f54391244a3e120eff4858ccccbc66b47b21e750

SHA512
cdfcc8d6c18250599e015fab37fdca54d689204bdd75ac28ea7a78b71ec094ef50ebade6bbb9ca47e3c0ca33c1f6662899a06409156b85a2e2e43ca3893b11e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21a063bbbf8160f30fa5e2cfd13e6df7

SHA1
07ef02ffac897d3b18bfa05d1d5f57a6712c8793

SHA256
bea044828e9192571d61034f9d8e92eafac16b23c65daaa68c64ca64c98fd01d

SHA512
6ed68ac837a6f31bebceae10b84d2734fac9d376797b4034edaf0f44e5cab25de0b0a508e1d525dc21f3fb435e28ebde67fb809a1c2aab06dd0d1c2a6e54e551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a934896de31fdd59f2250f6f5fc3ec46

SHA1
27f66351eb0a8c68cbd386695101d5eb740203e5

SHA256
de9d3afd6ad180ca705d834253e4be97452ab8ca9a5a60871983307be52e1a54

SHA512
2978f10a4d20cb2c7bc0c276b374690f59eadd3b981b1fc790b436ea86f86ed148e1a6176dea143905e03e63a53c0c83f7a4bdb2f0c231c13082a7da6ccebde5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53a06384c93758b90b78cf00d2321b98

SHA1
4df4b5f4e249ba329c58874d718fb1453316ca93

SHA256
d2a6523cc7db0592b6238e02bd634b611a17bf5988e50b37ec786b2bdf2d410f

SHA512
3d1e6db8b6026b47b19f61199ac656d3b4b7d6e83ae1c864534d048e95c523b7e4602aa75d224ae1bd6695a5d1b3f39ca368010edc91c58ba42cc213be6d5e83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C2E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6CDD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit