b144073492e71c45fdd114b876faaa8b0245151711ce5cf7b1f94e20bd95c98c

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

038c49247b2cf6a67a3e209692392ce7_JaffaCakes118.html
Size

6KB
MD5

038c49247b2cf6a67a3e209692392ce7
SHA1

4d03278f9a43c54e2ff31a084b61b611f2da1700
SHA256

b144073492e71c45fdd114b876faaa8b0245151711ce5cf7b1f94e20bd95c98c
SHA512

f1dfaf663f7c0a4a9e721e232f2368bd1936a1bb9fde60f0b4eaafe78048e1bb9ffde8a96963785bccc528e8b7a0794c326a9c3b56e714e895cc949df0053902
SSDEEP

96:uzVs+ux7qi0LLY1k9o84d12ef7CSTUjwZcEZ7ru7f:csz7qi0AYS/q0b76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000a69bde8dc4265ff568e402b29e33dddd67c80a1ab5849bef2e47e7792d44edfe000000000e8000000002000020000000503d2ac7284b170903233719d1e945571fd0b68a0d07dd4759ec5be7fe0d441e90000000c2fef76a6969ff254645cb089f839dbc7eca4937955fbb287f7405195edb772e9d1c486fae916e601250ae02b67092e5fe379a6e185eacdb323c872fc4808e6fabf22c8e892780e91a0b0dc8ee1f40b00ee067cf10ab08646b7a6aad040062674628c5ed1a6e73894cb4539ec90af5ec2c909927289ba306eeea1e8ef270642350fd24c285205e9f895e07692efaf8f6400000004e54c1393f6725984735094ca7cdf4ba407d7ae9497570425c09d0ea78350cc5aafbce902f376899fac6e1b2dfd5cb473cfc41ef670afb2489f5c192d6438765	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BE41E31-7F7F-11EF-AC30-EA7747D117E6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433898895"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000000297a0716d9ce631749dbb1e1f3d5a8ab5dd92442322c1b6f648987cc79a7e48000000000e8000000002000020000000fd1fe16dc5728c5d03f1aacfc8d67723e6c841a4608829588d27fa6ff289723720000000067185682a315a9a178392d48a6e18a2c634dd0093401739e79b6f742680f6ef40000000ba9b15a4d057b91e8e08b1bcedd94b2567489a629ab316137aa6509e61598899a9dfd7ec62dcb601d15a28cb819135e4a9ff85d874369e39bf468a6a81720434	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3002e5208c13db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2800	iexplore.exe
2800	iexplore.exe
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2880	2800	iexplore.exe	30
PID 2800 wrote to memory of 2880	2800	iexplore.exe	30
PID 2800 wrote to memory of 2880	2800	iexplore.exe	30
PID 2800 wrote to memory of 2880	2800	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\038c49247b2cf6a67a3e209692392ce7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
574e4c1aaebd3bec0c16dc63b110daf5

SHA1
13d0b52d3bf037a3121414f34268f90f5f552d8e

SHA256
8303c543396a9e1fbc98346e52a78fae141c516dcb945e25b93afce154f9f8f0

SHA512
0ad34695af805ee1e8feddb8cf6d33285d75c2bc066a484727adb0944e7668e65ade79f709f3e5339d43ba5849a8e8f472bef27e203e9ecfdcb3f103b63c64c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
269bf3f18ee92600edcbff3e3be062c0

SHA1
7293ae45cf0ce21ca599ed0ceec8ad5e7a5aeaec

SHA256
349e6fafc89568b4b0342967ceda2286a5604fc1862d9ff937b1d115a93a0dda

SHA512
48fea82389784c978360beeb386fa362404b00c1e62c2b4e9e511c02da6bbb7b12b22f4e677107c5fe8dc616a7018639bee33bf2825d349fdff36f6ee63fd110

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12856b70b65a4788823f76fc192e4ca2

SHA1
6d2bd7e8e2deea602e4afd2d4ffed6be41b67aff

SHA256
a1562455b0fb6e02980931723ddca53ec117f93ebda3cd1e05034c303366cabd

SHA512
ae1e6dcbe62628657c1ffe92938dba74b52fed2da6ed2bc195d19ebd8bcb12fb9ceab065701885d7de53cae4f5186516d40bc112a44e247f6ac51cbd4e206c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d739beeb6a3bddff589b641a44615ad8

SHA1
f52c2fdfde413dafbd6d0ca85cd7e0d21f00a91a

SHA256
2e59f9e8bede6de96e18f94a25c9acef41353effcef066a24be5eff2ee3275df

SHA512
c01562376f3e3385046dca093921763f7e8835b42b9cc65b13d669f6a83e7823675b805bf07ef7d61b3906663bb3feeece2e3e48932b1963a73cea6a0083f17a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbd5f4e903df98530dcb8c7edbd6f00a

SHA1
2379bef5505db7421d6453808608d49a0df90d9a

SHA256
7104672e62a0a7122557f6a2a3e7f52920a5a45d46fd95822d217e97f6234443

SHA512
a0212aca22875e6a0175d279eca1d466f792afc077e9d65f3172177b4e51973c1d40d6fbe0143eef1c735425dba0ecefafb4e08a7f93079f5b2e70b17190b6ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
260b760f2925cdc5fb49ec6885253773

SHA1
3a6791e271761737dd35831d0189866e876e8cad

SHA256
0014888c430187a58fef81f9c565a3a126367e457a1843ada24aa205892b1ee5

SHA512
4668727bd097680fb9fe030da6a4d240e9cd7c331e1fa7a845c748f3b4a670e611fe18ad7856d16911f41b9d49cdfcb83a865250c37c662c76cc8a17a3c8a6ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1a06a6bcca304b6b606c9882bba20eb

SHA1
33c26b8fb1ab9a69c3c56abd5037360672b52948

SHA256
c893f2a8dd6be2cfb1ba73ceec0d1aa19ba9d7322e62b047ada8456b548f1a1a

SHA512
2e3b13902567a01e85a397b13916caefbe3943b1683e1bbdf43aa384f76ea8709ce3d965a7aafd7789e3406610121d3d187945d31d60a93018a8ba9c40ebbff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a2df563d2666676ef7cd91246f1e9ba

SHA1
2eb86f7bfa852efe885aa532dadf805f9a76534e

SHA256
3ed3c03a470fb7e06f0237146a4a46a69e84fc1a7bb08ccf860a539962aca109

SHA512
c69bda65ff1cb2aa13b4ccc54c74cf0f231f4949f4619416b70e280a02b8821896ce8149391d83022d490631a4772d16ba02ba9c8b850b918b9f76d5e2d12435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
055feb3c52d9a2e2dce8934cebc1d876

SHA1
f51b3e367fe824275bdf33762e58641d4ae94dcf

SHA256
d18387c4daeed66d346aaf730fc02aec9b9df9d3a5aa58428f61a1702356fdba

SHA512
9cf7d7e9999dea6cc269acbaa1694dbafeea6bb64a3c21711704b3f9472d83a03b7f5ad12b656eb4421b3809cb99f4d221ebbebba3b5fd7af17aa74712d782fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27132406ab3448f77deab576e37bb90b

SHA1
7fe7b3ec7a0c4586a7e3c041dcfd65606582f53b

SHA256
27803c9234863f099d798d0bdf5d778c11b2da3995e52bd4543c7652336579e8

SHA512
492109849ca0f03cf264e5774c42d41278f82ada1f2a99c0654734eb229365b67b40a3b274f6272cafa4d9bf7475a4626b34e016c1bdf82664d7cf2292d1dd04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
834952a01de80b731e064ba90132cac9

SHA1
0ebb178f2237319dd67bf2eb5d9e2ba3536da281

SHA256
7b9fb10497d610abca9f81118e903a4d427764d20a046236f2e484942138dd51

SHA512
55a7a553a887084b0444934da80cc04e10de491668530d72ee95f3f66bdfac68968409344bff9e1959e7f373ab3cfce6ec63cc60f8ad840f621ce20304e17cfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7677e11f0afce905728ab545663cd2bf

SHA1
63491886d8a0b80390aebc7d4a333d46ac268f51

SHA256
d908b8c85fccce63dece4873835561317633c2ac591840d49071bbcd8508355e

SHA512
58352dd795cca84cd3b0054ff25976e7586c9a0dbf6b7b81a8e0a7546652acaf8b98cb0503f61b0a4c48fead1b90b06adc3220bae33ac28c60d0d21008671375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
800884d8a7bf83e45b2cbb9f2dad1901

SHA1
977e43cdb783281f91349a5e956cad1057a67a7c

SHA256
37b3631b17f2387bcbaec70dad9cb85dcc091a1d94b092a40430969653d7d106

SHA512
b576bf3864c25d72e590d04f8e5b4f42db7e79c2eb4ef69f7034fb1411281c40c188f2a8a4aae49ecefff8dd84ed9c16683b74a701190ac40d07aabd1db9a0fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f7e3e6c38f82e6a1adb87be4bc0e977

SHA1
d0126b780da8c527b9df647304e104f13ebcc86f

SHA256
dfc257bf925da6e78a2badd058c4260478daabdf1b577048fb52f6230dab1477

SHA512
82f73a50f6cd988fc39b3ee48de3c872135ad10f4251e836c684b589f9bd1ec8759c46ffd232a15b6c6dc0053250cf0cf0a61ed994ad5b8a8004ebfd21c48e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8c2e07e42b46ccd1b9ed140da1cbb77

SHA1
749e141df0c00bc0a6f0908f23d0919da3804ac1

SHA256
32c0ba254dfdfe067fcaebddd7750e7d65c16fc32e373f7ae115887ebe538814

SHA512
e1d3f98386e1baea7af4da06a35e146dcace8dacb7e207f9da66918c4c7149a29d9eab37fc46ba26e7a42d2d58a7323dbcc2a73298ef280e8dd3e03e51c33df8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b02561e6fb53b5be9ae4f9ed4e3c1cff

SHA1
ec131bd7eaf37f4965b563b3be06bc7fe75193a3

SHA256
bfec9b132853ad5304db6c0f997a60170efa168c5109b1372b98339be45f2117

SHA512
a3852b816849abd7779dbed63ab020a1b0e5acb6b25c42833ffc513b8dfb0309fc867a967a6090690736651ea042243237330172912bd515a312f27a606d58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab98BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9949.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit