abf45224cb7960e1e331d147e74b39ca4b7328b6c5a33853488c24c46697257a

Analysis

max time kernel
148s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04e261fae8a5ee1f55008891a75f0909_JaffaCakes118.html
Size

10KB
MD5

04e261fae8a5ee1f55008891a75f0909
SHA1

99a9d1049cd632b6784523fc5c4c2a46b07fbae7
SHA256

abf45224cb7960e1e331d147e74b39ca4b7328b6c5a33853488c24c46697257a
SHA512

f9864fafd1b861e23a83877d56a08af9329b35f9015c221da5f4a0538bf95e1a075a1ddaa090abc96d9d836ee855eb66f6da19d3baf408105f8f69ca7db1bf40
SSDEEP

192:DDthd2tIrRD6kVlk1kd+TN92+8sTwd8LhBwJUHwKLmEwakpBSg:DJzdybxVhHwOHwKLmEwa8Sg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000007988fce1c5a2f5a030f3c9c483181077e868e2b9d11b614b931b1f232b1765f2000000000e80000000020000200000005eddff430345ed02f07bd065d9ef1ec7aaae2d5d9ac7e5e500151fb49c0056a6200000000a269f756619978344247a8ea6c786e5013c30d1f251a07ad1aa068b4fd69e564000000029820aca58cb705d3a4c3fc4e34f90ae2c3df6b1cad1f918a72e2890c11c0c4132f34a7fe5a85c2455ef7b4cb5f5c921c7f837b7942f5d7eff7f7c0fdcc2a7ee	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000006123703a1282135e700ce0d4228e390535da53d090a52f5cdcfd175129a3b7ae000000000e80000000020000200000007147c7be0bde0118a3cb3f1f84561b22ee06eb53822aefbe209e50030382d31490000000104e7160bd81fe04d2899b83e015a8a6f1b2ff435f4a2f57cfa7e00595f1fe12138349976fecb3057a839fb01bc94a58a537c3887dea3d7109995ddbadb54c0f0691e4cbe4deb79c7e890a5f8062a3fcb38bf551f5581eacb8f96171abe40f66386e1161f85b62f6909ddf00fa9e595cee2be076f5e3c0f10d811fe4f4a1810b46bf69c2654fcc671494eddc342ea97f40000000cd5848ec0e2f3dad7412f5cc7fad3228f972f189fa99d27f0f2d549bfd2726d9565db95e6f0c740818800e77c14348b6c7e13756d78b395bd20ef8094a2b47f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE42D151-7FC7-11EF-848B-7694D31B45CA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303950e0d413db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433930113"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2948	2300	iexplore.exe	30
PID 2300 wrote to memory of 2948	2300	iexplore.exe	30
PID 2300 wrote to memory of 2948	2300	iexplore.exe	30
PID 2300 wrote to memory of 2948	2300	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04e261fae8a5ee1f55008891a75f0909_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
464a6ed4621e5d832a05fea2c692c49e

SHA1
f06ff6685136af0d368f8de28e115a96ad336889

SHA256
be0e82449c259517eaa8cc36807ca36389a0220fd34656f1835575179e8ea9e1

SHA512
e2a03bbf0196b03c2318420900d9b677580ec31dbf857cc8ad68365db9ac4a72d4ee3e8ee824079c79b2afdcf40ed6c7997d2c6769474366873e968236d58bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
641c5844d409c645e17c623ec76c1c6a

SHA1
6db51ab2496ba42722af30b03d414e6b158d928c

SHA256
5ea8edf2979984ed3e52e43969606a80a7ecbbe97d3cf81d4c56508cd7118d0f

SHA512
c6a18ae7e37fa13948c5054ee0cd34d017db1a04d548d4561485358f174eb63f5aa54a5fc31e714b6b417b2029d688328581c574d1a864b0f282ba05214fc58b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2840e7786458e8157b95f42075bf08d9

SHA1
649ef8afa22ef0b8695f0e17610b507cdfae8c9e

SHA256
7c970f0043a8d9b669aacdddb1c76853c2c4a2a3b08c67a6655378632af79d74

SHA512
cd3884c1da0deda75b9e02934ca9fb3ffac94be0d90e9ec63e06ff8a591433d2b2fbcbde583bd64f4602b75706d4ab16d68191ac345c2b15bc7d59e7fe84b20c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77c6afbe828b13ea52079c7df36e430a

SHA1
cdf2c5b0157fb123e7c604473fe1cd62ef1c77d8

SHA256
65ce46154bdae825f0b9332a04d188ae8a21226a4d2d264eaa2a5bc2fd20a621

SHA512
9e93ad6bb404b2aa67525b7b39c0373fe7021f1dd35b3b10bbe79f9ca046d3f7c774e4f982f953b3c826726917e9e92cfe4dc7ce182e42ea0edcd056b61510c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7155ee0ca68aac1be8cf11ffe86ba147

SHA1
ea6b8fac2383905b213eda05db3d938b7bb0eb68

SHA256
f5b0616806a749041e5fcfbcee259300cee2acb7b4d0c5888ea5a3dba0b8597f

SHA512
278de388e69882cfdf1f5293a27e7b9052c365ae62f340be94b035e737679572cd08cb560d83897ade865d6efbb6bea172c7428ac219d3e504ab0efa1c599a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24a56a1bcd16805981cf0c1d62550ca7

SHA1
14cad0d3a7c400c9c0e68cd36cf8405f4f3b4b6f

SHA256
252cbd264b52b13078f74401c95db2aba803c3effe176ca32e4aa613f6184622

SHA512
89ccb996985e75460308d40ed08a91b35a0dbc4ae5b95e8850c3188fbd6577b67547064ba74467d0e1a889b14286f33d16e2cd4a21da5472c005031e5cc88975

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7043ee42498d3b23527e59ecbf7c2026

SHA1
511c1b45f44b361a28a4e8a5e0ed2a3b4dbf5b3a

SHA256
8d007556f11766e374ba84de199216b3029f8966a0b799cd2d0acd9279a1c1bd

SHA512
07daa2e8a94938c09648e1c424d930df3ecc195135d6651b260616102727270882373e2c152fe9d85896af273c8065e479b819e8b68dcaeccbb116329fe1bb4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9afbc4b2e0ad967a41ae5001c75945e

SHA1
5ca8c1216aac9f5418f751657c6a42e671e038db

SHA256
693b1252cc37c6de999f684d109a81082cd0b77e9a52936982737832e35fd126

SHA512
812c0887739b1f8c85571880a22460e5e749bfa72a21b6a0697d385d45a0a9e3e2852c4854b1488b4e35756ee6ebf97c6506efd4bccd8c321e01f41562944cb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad7182e15ca4e92b9a510e02e453e9cd

SHA1
17ef2b6999ed44b783d3785fda2cad88e1dd8d21

SHA256
e9c8951bf8673bca170930b62c8d0a80e6adca6b8602c9effa612d22fddb8056

SHA512
b725bb94540341e92c11576666f91bfec5b516b11bc4f8ccb82fb7cfa9d3031fe12cab65bd1e3884af75fe0cc0e408c375d2083d3a530a189e7fa289bbf4be22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0811f98138b824b84da9d142df72a05

SHA1
117c34f56f086e0bf1af73cbf59f59358a8a1fa4

SHA256
ae9276adcf30030c218030c03e60251a04240407d3aa1b372c88e6c756284ade

SHA512
19f799124ff80eb7fd25ca0d3f0f4c2cd8bb936a10fd5a8b3a70e6b073d171b60e273136067848b4a35e0f45db1e139e4a740ea6dcf8a36093cf9a10c11eec16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bfadab50fadaf15a4bd8c070bd78552

SHA1
a43e1cf105aba2ca70933ea8390b43a7926e8ca1

SHA256
b0be6963dc3cc4b65b30d7a380ea534bdfdebbf4ea92830a672f6aa2a2e14198

SHA512
5925932879e23b0eb01495da123fcf4a07bdc76fefda2d0fcbbedaef07e2e73ade6b6bf9fc46c1aa4bef73c9dd19a5aca443becf7d4d33f8d643361b888d7c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc3dd8242671f40147da59c631062c29

SHA1
0b762c2965185d8dd3979f36b8e1b0dca12b794a

SHA256
f39a091580a4a9a81c1ea00d46382ec061afae57b8978da8a055da73062dcb19

SHA512
18f174a47c1267bb7890930d899a996c47469c2875b705f7ded51b32b9c16972d517ad8543065cd45a2e87d4ea6d16bbc19a499653dc264f08c9465e9bf6565a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD414.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD4D4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit