17d23c923f30dd65280f5b8d957f71832636ae4b638f23c7a2c2e2a4f3b674a6

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 08:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f58ed62e16d828cba7371ab33b1caec3_JaffaCakes118.html
Size

142KB
MD5

f58ed62e16d828cba7371ab33b1caec3
SHA1

aae9ed87ac36bf0a722b2f575c7ab1786b30bd86
SHA256

17d23c923f30dd65280f5b8d957f71832636ae4b638f23c7a2c2e2a4f3b674a6
SHA512

97e48041e590e3b8419da45ce8a2b2af0add9aa049a6380e544aa9ada67b6b09f30fc0ba98cf04d65c247117a2cf3c304f152df37677aa01801e638a79b5506c
SSDEEP

3072:Sz0mxbx7dyfkMY+BES09JXAnyrZalI+YQ:Sz0wx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6ABEA81-7B14-11EF-B4D5-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433413358"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2340	2528	iexplore.exe	31
PID 2528 wrote to memory of 2340	2528	iexplore.exe	31
PID 2528 wrote to memory of 2340	2528	iexplore.exe	31
PID 2528 wrote to memory of 2340	2528	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f58ed62e16d828cba7371ab33b1caec3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71613a7723df2b65f15bac3e2cf3ddba

SHA1
1a6fd84927f0673295faccf5fdc58651d9255ab9

SHA256
89fb14a0c21efc777e12bbdaf8cf63559c3466a3748c89a007d8f968e3ef2505

SHA512
67416250960c5f6cabd90765a25ea12028244fd1cb71e10d33526900d49eb8eb889338e9168f80dbdcaf4b3d3b33b064ac2bbe9579e11e86b228709df17f52ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd831678e07d612777e671828bfce803

SHA1
af05088d3699d0b0d9bf8af35c494a69ebe9b985

SHA256
f279bfec51f98db6115480421e0dc46207aeaa0b7e82fcb54c32b352359c8e7b

SHA512
e102602257d85b6905c52cf5d05f51e183356dd04adc7a24510486b5cee5aaace76d832291a80043627a1a95a6e4645fd568ce1370d5fe0dec4d4a7421127d7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e32e05f9a7e4bbd54371927a9908866

SHA1
1664c8955f8d0867356d2e3ef2d4f50bc9c54fa4

SHA256
68b4c5f39ba11485589794ddeac0803cc14a1a52e1304d8354a8f8010ef67af8

SHA512
0dbd2b6567434f36e63a9ff90f0553842a2ae50553345c3e923aefc46669048740b7d9453e846290fe6801d66c4b1a0d3ae155d8e8b2ff2477d06bfbff69dc01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e75cd136883b12391ef1b35949eec34

SHA1
d748bd68cda362ab574242c7d873d3e903e12f57

SHA256
a4a1564edad3639152704821b363c2acd9e3d9361fc31b89d99d931f274be87e

SHA512
a9bfbbb952688570b930820ccc547cd55a44cbf137e6fa6b9a4886e4929bc8a0b2dc64c528d3a9f1f63ea905565d3e9255d45892dfa905d33e36131f06037c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ef3a3e8566de3dd29ca0f85ed11fcda

SHA1
feaf8330a966ab7db3f56d44f1dca872e6d6c515

SHA256
38906e30f68ff6f276e4b9136d444b8063ac3807ec52d60f85b463a12d506f19

SHA512
e23b6354b0e2ab4c6cf2b139aa98cbc357a7f65d8c98050fa4ef01d14088e2fa43776f3bf4fc80318a3cbe4cfb72d80e4e3e8f6668c940a30f6f830c686fb371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fe1521316aa49b80e0d68100bba0ede

SHA1
6211acd4e7cb1f0ffceb3057a69fa68838752827

SHA256
3104cb7858e65275b355de18d56b84934d1c882068e817a87d6a1879558a8e61

SHA512
c5f495f936eb69ec1679925995f674016a2649fa2e71bd1408dd9030bf0488c456aaaa54a988bf5701dc3e85a37e96219f26a2d71249eb000120c90ad6dbbd33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
414967932e9b83e2ccbea2473520efc4

SHA1
b7c465b853193b647b66de6e674c30295802fe7c

SHA256
316e342eff5d9f18fa8d4743e5c72818e654a6276e24e0967af3902aacadffd7

SHA512
8f67ca54221669a982a42f46d43ea4ae16d077b102d38143cd03a6edc948240f3db1478f494ced372e9cb9c176636795c9b09cd552fc3573ef0e5bfbce948e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23932c507706aab8ed1f59a8c007e8a7

SHA1
03b4eb1a07b89dd76e51729bfd651baa2b2da911

SHA256
6c5e49d612028ce9ab997af1904f17c46ec55b7b1ad8170ffa99cd4c5c50b0b1

SHA512
4a8492d5aba47b8e3cd2ebdf130903a8664e8820213e632c3e6a4f587eb25e5cf3a461b77b4a06f846c5cab81c9bd6c10f04758c38495d65a04c736f9d60c2fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53215d0ea7ddca4c4eb3ee00e49374be

SHA1
b971df9f1a48b3d1fbd7349f9e475ce78c56a49d

SHA256
e8fbed70cb50679b868061897f7bc9b293e2634cb8d09dd25b725281cab30845

SHA512
a2512c6fc80129cdae6a816165b774a7a12d9a9bf08d44b31bc39fa08257b030ee26d8ea0cff770e801d24bf308cd73ea4eb3367e32eba5840ecafdadb1277a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25ff97f697c15cabf5ae88e6e5e87b8b

SHA1
6b231a395e2d9994de51bb5eb4bd19f72329a9be

SHA256
7923c5fe64e4f6ef2c730dddb53b98140040e2d49e34a0c4812b17599801a749

SHA512
530f5525fe5d5881192065cf38ef36825e1760506cb0e780dbad3094682488641b026e17c3a92f098e725ea67227b863c49c06c1711930e356fc706f3fb0c942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09fa20bd314ac125ffa081296f7cc2a6

SHA1
b89eafcc257cdb2511eb3c5d058817ca049728af

SHA256
5af6a65e341d987c4bd1686c0a04d84dd9fffe548f4d78dc419a749d8ec29fea

SHA512
f5e7b238fa252e82a42871ecfa59da33a47f7253dd623c9d3b2167d32074ac27aeb00f3d1956bd0d2107d190952a4b125fc18d04dcdc5466eda46b2f084060d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa4a693da571a1d5b4bb5c1b7b9d8347

SHA1
912100c522aea3d20f4fb16595d7d426d7fcf538

SHA256
ab45329c51b84117fc6a1f9c21c3f1128103bb49c9f3d4f1d388c82fb2e7758c

SHA512
0ba0a871f73b35f5daeb5b4d3de7b79a6ee0b485ce8aff6a15d8d5e13d25fdb41c04a49e1d7944a67495ec8fcb5f904c42a9caed596daa1df511a695386dbd63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fac4091dd38a92b8e4578919c03c8e7

SHA1
c7c4ae639bb834b20752592560d0a00b1e601284

SHA256
a22f54fda7a3592629ba2ab3bcd82232e374d0e4093621e53b6ef5480328008a

SHA512
92a209a2a57597d1e1ed5e656f1d0c1159ebe80acd0119b2b1f38841640080cbb24cccda36e1d87ab134bb1eae5ac4ef3ddfbc7504d84f990d75dd4ff96d579d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3da596757836d09f2196f533f5b393d

SHA1
4c2462570071e84da3a3bc3c9ef06e81a6553bb3

SHA256
f2c4854e6763db27088073e8457bdc1df74a590ba72026fdf7a8d2eb06a83bbf

SHA512
2d16c9be24b3a5c39155b302c7fcda0dd4dc2fa76e3e063637c79d9b39f9e03b2e2209890fe420e1f63c40764d47a99ad4d14cf54c8bae6755316a685a8488b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53ded33f6ce7939a020ea9561de6024a

SHA1
4e57c1fd532d2a0a4bbd19764040eccf42e72b68

SHA256
97076d3de55724669c69d7ea45a095a65c719bc7e90b119afd081563c9e3daf1

SHA512
f08b1911c90811fc7b5a165c2129c2465bb79670f4e58a5394743e4417a4c2421a2a083e3400458c0815eb1f380a60fdb2d30529170635811001b05c12d4b094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5666c7ba9724dc9e0ee9410b796c691d

SHA1
829fcefbf2b183f0086c4f97be0d815c93b4aa47

SHA256
127f13566b0aa17aa4e9aafc96f2af2e2ec169001f53d8c006d158bf0db531be

SHA512
5e0d3fe18e42ae8269abcf6a1d13abca38b77eb99b29a8dfef92a8942047d050581175ff1f15f3aff5fabe6b8ac23a6699684c11c7ef980eff9ad1c74beaf2c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0660f5f8e0e662eee8e3edca9c2409b5

SHA1
4ce0aaa2487c9b797188eab2bbf51bf70a961e65

SHA256
eb1b789c35be60117558ac23eef5cb620eb1af51121716c0b78a145d4f0e7264

SHA512
dad1d9a1085c0f9953db0805d63679667236af241d2adbe3f28627dbd2936d2c8b39e6cc7d86a22daaf0f3d325f15c5e03bb4e49ead81b0647d70fdb3681addc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06429e5d71837a1097ac7154cfcfed33

SHA1
066c728087b5de9e62ddf58c189a3aa44ce533dd

SHA256
86d5f914a4f4482145b2ce09bcb42c6af812e137b8285e40cf5d911e76c7188d

SHA512
4d3e1985860dcc0aa285289e0fe162cb177b771665cc3cd40129a36254a08d7ba789324ae4b66797181c71c0a6f401f35546b1ede34624d09259a4465ae5bc8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
115d83b86b45d9b715175afa0c89365c

SHA1
d365f2cab815e803f8e70374427cc173babc6e55

SHA256
1cbd582e84ecc982c7696855efbc7691a252542631e2242d6661499d564e8ef2

SHA512
d9166e6f1abd02b8ec4d868429ae08ba66691edb6c77efb98a65020834aa737c3524c9203c282ac16ef066acdf901eefe4e2aa7d36ef69071683e3642d7576b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCEC6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCF65.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit