9577b68f87bc8f36b91f2e08c0172dba2c1771c153bfb859497903bed338c76c

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

070028f0966c38fe5cda53f1512c5799_JaffaCakes118.html
Size

110KB
MD5

070028f0966c38fe5cda53f1512c5799
SHA1

5327fb944b1360a8693638ce0f3fee80df44dbf5
SHA256

9577b68f87bc8f36b91f2e08c0172dba2c1771c153bfb859497903bed338c76c
SHA512

e8bf6bb5a53e208de878c7efc5e2b3341bf4cb88528d51382f664f0ed5a6ffb26a2373fe887c7eb48ec1852650802aff1584d224f3538aab53e076c784af5a49
SSDEEP

3072:qXX48564/8CCuGYrpjc1gkCGo4LN/XuAlnRC9n4IlT4VDCQrMRXYqqY+g5eoB/rn:x8564/8CCuGYrpjc1EGo4LN/XuAlnRCF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C8EC061-8027-11EF-ADF1-527E38F5B48B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433970962"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2660	2664	iexplore.exe	31
PID 2664 wrote to memory of 2660	2664	iexplore.exe	31
PID 2664 wrote to memory of 2660	2664	iexplore.exe	31
PID 2664 wrote to memory of 2660	2664	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\070028f0966c38fe5cda53f1512c5799_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d186141660c0e8a92fa97b7705e2fce2

SHA1
549eec6496cfe0f623fd6d8747bc7e701796028e

SHA256
dcbc902c8c6192b5457518f28d1d2d47f83dcb6881969e058b4ecdab90d346e0

SHA512
78472ac78d001962d44bf39ba272108782dec56374bde17a6918c54a01e1a2ec2df2a132db0a4df3f411f3b94575007d63bdc709ca30f866df0f039d7ef28581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1797177330db54dac3fa47abd55aa9f5

SHA1
4d90834e0d0a67125c4b39ecf85b6ee48cc1b296

SHA256
deb5ed9f531135936cca784f744a417e421b5ac6f7240e68763ea398cab09981

SHA512
34eba59638913f93e9526c9f262c3f5e652be2688a05c5be44b793a7ed97d382e0d0d817a51c2dd4fd7ad0dd297be05a43c9e2ff61cb77e72e9d547b2ccf35d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74182d6734ac0c81e6fe08b99ccc6635

SHA1
6e65aa8ea02c0ade760902eeb639e53367b4ac50

SHA256
3780cd6eb9bc0bf2f4e66234181c94ddfe6e26137c439621e150320c73370912

SHA512
3c503a46d45777b214dba6b3fe146cd3ad4136418cc9ea7836f576b0862614ab30fcaf78cf082b29abccef600e8b4b39086c31a720678ab171ea03c7ef3dd47f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cacea5a24911de31da7f9ed3cc5e1dd

SHA1
abea4b3c4af78a0eb8812d3bfa36808ac1e9916a

SHA256
54718669b6139f563f03432f652bfcc3c6a6bbd75e4dc2bcd761f3fcb1eb4253

SHA512
46777c7d4b229924a0e4ec57c4e3f30a27fcfb41bd02b43af4312832152cda314cfea3973980d872de7b6dbd18abdab7548b10484602008e17b2a9060a2fda55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
886508bc4d31cde00a98de5c35e64375

SHA1
ca5c5216f5c339573ba760de707564eb83c008dc

SHA256
074c099882b3a429a32e66d25c7622f912c894d1107ab051d7a6127e29b63c98

SHA512
e38b78234be44e3e782615bebc30e30587dca4b5a2e1ce647742ca178ad8fcc737ee42a7e846a478c4d9a3c32434ee78a71bf205ab498d2fc91bab5e75859c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ac4f89c825304e0c3762d282b3121ad

SHA1
5324210445ec39ff84a2632f2b0e27a73eebf4f7

SHA256
910cd3087621de54b62364ea446f68233e7bff3a132d9f3dfe6d66f1ebf3c167

SHA512
8e8ee0b079e3e0451fed4c4f0bed28aa1a771749197d04bdab1f3ad469083c93c894fc6a4d44fc477c1835529bf2c4889d55c7feece61891e5490fde4c3761cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9926623806853b63ba206d0a18ac2417

SHA1
0f33b77c1eacf2808c36a14082b05f20b6bc9421

SHA256
1c42696c0f0a6d63cd510aeb9d3d4e1e0d8bfe9137e3cfbe04740ad6626b7282

SHA512
17c3009d4edcaad78f6a8d00c87dcd8610fd7b46cea63dce103a469967a681061d637683fb3143835cc754a1474b55e04bb29c66e0306256c1ecec351e623805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf9ecbb51e4711e827f9fd2f9b8bff58

SHA1
87a2cc50436d5f5b8fc325f31f86f0059156cf53

SHA256
19aa24816e92351bcdd22af7c77ff804368e44693e02979ed5682d58f32c1c93

SHA512
74d2f92eb1dd99ab8c9ef8de4e0cd26a5645b75bfe164cb82777a799dbddad8904f7db74940897816f968e42973977f2ed1fff3945e2191dc23f45756864f7cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8cb6aebe81ac429a069e84c238872b1

SHA1
9b4eae2062b09cf51bcf64aa55d701d9ba4021e9

SHA256
caa56856bee7ca3ca45e001ec67404283c6de0aabadc0769e104a15cf8d2d0d9

SHA512
2594600bc240f5bc10a8eb2bc2bc248b64dbc6022e867c150f610e83fff136558616bdc0f7623f732dd5c464275ec25f77c194c04576b15f3c9952b8bf14075a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13211278d098042fd1e85dc9456241b5

SHA1
b101d4215b4f3f9469f0ca5e169032cbbf79177d

SHA256
d8fdbd89dbe63bdc40b0f9d58652090b9389cf74b385840cc68bdbe1cc6c49f8

SHA512
4d962bca1e370234fc05fd5f9f8d045f2bc28a8f67fee13f51a397169bd382bea80e475c20874cc926fe066f8eee71663c62ed61993335f41adc446833204f72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aba6c42f87654d4ba1e7f1d700b81c6

SHA1
c72051db6a1db497040b2c4831e7df4b3ebba088

SHA256
8e0d49d37ff286ef3fa928df2910f4173aa40309a30e3bc297c01ea04d61044f

SHA512
588bfe58dc97b916beefaa9a37e9413c7006e59a036ee6738d829f5267059c39ca0c487bab33ffd986459f005f305b32d2a8b8728270f2193aaf3f8fbc4c8925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b60c911b785ff6b1bbacdeadf902740a

SHA1
d234aac461939890a5a6d0876317a2a5d3b30e7d

SHA256
db67147513fccc83172caeabfe3bc661e75ab79e1fd28359124888b1a8316fb3

SHA512
17aa6100d31e4131628e28172d1ccd7ca89941ea19ffc5f489d3aaf5f0cf7a7ec85e750611e7447b46ed04fe4b5de3ee36456b2bb65b77a62a69858db2f3f060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8436d07fd567692096b755ed115c15f6

SHA1
e1d22babc76856cfb65b47939ec3933f70da86ad

SHA256
d9875bbc31afe4fb17c35750c6a7b2acd400981c4a84ef4cf59b6fcb7f66d8ec

SHA512
a52c0981bc98f16a8e7d14c2aef7024f410903b3978c9cf1818021ae911ec9041090fcf39d057a5688f929686ec4f8448c69430bc6ce132e52f70efd4bbd1c80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ccd4eb9262bf771b8bc88df28a32455

SHA1
0ae50f18e8311814d44fc5645ec37f5eaf21cca8

SHA256
75b91637d236ac6474db7b007bdf4f0638858d563a1018e731098a7ac6b7b042

SHA512
da2eb0278d1aceb18d195e67222cd24bd2af8d058e77902e9c510d649093cc8a9535581c43d12522f5e1b045b6a8b14d2f50d3c442c760e05761df66ac3de824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0f425dbca40da096894fe6e3594d89e0

SHA1
4f75e8424a16ee35c6c483403eb4d8b9233ab78a

SHA256
b142d42cf27f589d8eeecf9ea8ecc1496d1af0feea27922874b1bfe0f4b9df96

SHA512
ca7beada90b948da799bd55876a24049d010b9936b380040f032d9683c7635c3eba34f2e34a59270e0584dff8501ad2001bf03806f89760e3e57dc1207305054

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE90A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE9B8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit