ca81027d1f2b5da70764f4a22f67961d739c5be153deb2df7470f16507237476

Analysis

max time kernel
136s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f692c0dd2efd9fb108b39404bf7a1086_JaffaCakes118.html
Size

214KB
MD5

f692c0dd2efd9fb108b39404bf7a1086
SHA1

9798d23eea67c0869a27ed2adf367e4dd1d06ec5
SHA256

ca81027d1f2b5da70764f4a22f67961d739c5be153deb2df7470f16507237476
SHA512

373b2bcbd39384fdd2de44a4b79a5a7eec78b6480a7a70b8b80ca6a1df92eca6b666b28e41288b6c5032e523564a920aaf82730e6bbe390abdddc50c16f12bc7
SSDEEP

3072:OrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJd:2z9VxLY7iAVLTBQJld

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433449564"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3071ac36760fdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000007ddb35a686d2c2999407aea38d4565d2e9af8eb9ad702193d36acead226c35e8000000000e8000000002000020000000ff712f3da415fda86f7d5b6b44168259806639a05743e16af282fbde768d991890000000bbe0440608b8495439bb90d484a1c83eecd0a9bf49deccbde83aa0e38b44728a8e1aeb2d4428f0c8ec60334ace55fa5c39ca8b6d153730c1248028dd42512d47f1258f06e59f716da4f810e0307519fd59c5113e1c64e3da5e53a0c2f7b09cb90595e459ebd306e3b00a861c6fa3a33b3c6d208d7888e2546c0c16c5920ac3432f27bec3b9d7904a8730711a5c6c118940000000393ec77d618de67deecdd909099c9ab35a7af497bd79c5cea5dbc822d7d8f3ddcebc8b4f0b90a8e2f800cd198e4a9c5a0d889c1825a0f8d39e79db4de7a3909e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{231C3B51-7B69-11EF-A429-7A64CBF9805C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000069c4230aee42695c354de9103dfea5a47a1786846964bfc5f78f7edddefe97c4000000000e80000000020000200000004de316677d0e49e20203e8bfdf08e52bc4f0ce9c125a1a1b58a93e3674e401b0200000000dc844554bafccebf7688f84c2d1096bf62fb42366a195e61daf18437b520bcc4000000023f615b7c8478eefa9c5ad1cbe6aa8f6a022f99239b7a94489447d39ed1a59a85c406fb3b4b64d065ca22cc828aec2cfd7831515eee1754eebd2b05f3bd75323	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2788	1760	iexplore.exe	30
PID 1760 wrote to memory of 2788	1760	iexplore.exe	30
PID 1760 wrote to memory of 2788	1760	iexplore.exe	30
PID 1760 wrote to memory of 2788	1760	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f692c0dd2efd9fb108b39404bf7a1086_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e804519b5084d35ae0025cf133d703d8

SHA1
cef674d3a76f4b4acce7f2b5649fbf4bf46fe942

SHA256
571eb6225e70337b5fd69e9b32c785a47449956f8b80f5d9c2d8297f611d5dd3

SHA512
b1b1aebe6d93a32e2d4d3a232fa582b190036781ed27563a69ddf4a04a4e74c51471151855098a6bb195d9ed25ec5c5ce3c872bef5d67a7ac915554d8fbacf3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9db36c51bb9c2ef5d3e3ac4c5b15789d

SHA1
8826f4461a021ac5601a4ad496ad07a97fa5103c

SHA256
96b3302aef82fd3573d9f9b8b03b8e8002f268e615ec6a8966b5403a899c356f

SHA512
283a54277a82d0fc08a6145dffbba33187e41dc641e98a9062372ef3aab2624cdd6521ce3fde9478cdcc2f3ed01b77aee7fcd492b5e5f6c68c2221b0d844bf46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f65765ee74be0d6648d506698cc697ef

SHA1
9ebc1bcf45c57fd9f068f9ce5d3652ecbeb8804f

SHA256
7a68ef82b646bbde9f567062a22726fd4c259ed1c586cf89bf4fccd359d4bda3

SHA512
55d43ba64b8dbf4dcecff90b08cf4fdfe0e066a6758c4b8f6b2abda7413292779f7817377de44722871fb66b014b8255479cbb290f3bdbadc97888b852d07318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e71aa1bd7105a2f2ec54947ac1aa972

SHA1
1ceb09f5e979e137d0cc97614f9d98b13a792e8c

SHA256
960553f55f7c75036d4c65fafc5f7b7b1d9e92e62d81375c22cf807747507461

SHA512
38f895de5f7e6ef456edc2f1fc76d84a1e5d939be66a03f0098ee6feed6265754d2f0fd6d90dfaa2d095b6641698b0cc9f6c45e0d40199720fdfcb4c4f366437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f3e19f3282e6394937b4fe5d29c4a4e

SHA1
3d2f4b8e24a0c833d0b7553b14ecde849a17f1db

SHA256
744b36d003455e4e90c0678d36ccdbadf1677175f6a55107176850b956d0226d

SHA512
6c776e92d6b9dfda02b72b25ce9bb0c386ae0bb999ba20b751fc09037cbc4623763343683257077a2f184430f5c93827038bc40e16e55ee4c7639e64ebe7870f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9155772352e810b9502ee54714ce9cc5

SHA1
ff44e5d3cba884a86dbf423f567200f3ae1f9e2a

SHA256
a4838c0e6270a8f895846d38ca1d541607bbd3b12492bf2b8f13ef10d192b95f

SHA512
fbb93191d3ce417045615ede07e5e5e02393c4bc2efe1c8415d327cd7f2eefb5399fe4e1ff06a090e56f323a0ae2b4d0f60cdaa8c401201b96e189cfb7e65016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efa41b8dcf46d0f89fd52668f4dd1079

SHA1
65a3e0d3b2cf88b1560108df40c1aae35af37ca0

SHA256
a3db717d580039c42f99fe3dbb363bff229bef8bbaa816228e43ea8e9ef35cde

SHA512
8b8cee0dac3344c15b60bd2278ffec288c330c587d2a00089d003366d5207a0d0bb23172cba7b22adbfe90f2b986ced72b4f5180b22efe8a94160565975219e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42a9caaaabde51bfe571cf1d10649c64

SHA1
dfadb2de2ef066ceae25314ce331a271206dc420

SHA256
3efde227812b38edac0e3b562234ef8d45391e3378e9f353b43f5e76614ec0f6

SHA512
1b236fd1faabe767aa10c45c6e11a5a0c1247c5a5d1ba2bf3507c028a09aa1181ad2d6a116010ce13ca0ddad601a66656c36450a384c4edf511f643e598f644e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e4189681e82efe0e7b24db2300779e6

SHA1
a0f271e20f40728a946e97558afa4ea8abb17134

SHA256
eca39109004777b825c65909511ccaf8c3f3380f7037605f40db5600e71eb2e3

SHA512
52f26eadb2e060337f41dfadfe5a45c35ab0a77ff6866d917f96cac5835de85eed6729b047eb06d9134493cdd91727465de44c63d526d85b9339c8c8e603d4c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB444.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4B4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit