b2ec09c6715611f081fd8425a15dfb959926d9b1e74cfaeb19c69820e5a19f5d

Analysis

max time kernel
142s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e6d22f501fd93c2a236f3a6682d1833_JaffaCakes118.html
Size

28KB
MD5

0e6d22f501fd93c2a236f3a6682d1833
SHA1

023cc4fac2ab5fd88a41c33b8b9ae8ec10e38a9e
SHA256

b2ec09c6715611f081fd8425a15dfb959926d9b1e74cfaeb19c69820e5a19f5d
SHA512

ccd81183c17cb950773f128e6c7e2c3f879abd7f3749e49044a5f5312fe5b94f4edb5a7928b40bbe5b2bf90324383302fc5bc1781722b7ba494c70f78be6691a
SSDEEP

768:Zcd9QZBC7mOdMctpC5I9nC4NwAwXwTdPd:gQZBCCOdx0IxCIwAwXwTdPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000001501e13aa7062de116e015b96084ba880579a5de63fc3596959653b9928a374b000000000e80000000020000200000007f33c3fd150504bbe198b483933c17c2fe0947173a71b547ea790d05be5b94b3900000007fc1f70744a42bcfa94982fea4a83fffea6921ee9c1a83fa6b0dbfa4a7c7eaaa6d8fe17c22f7b97ac94bdc11cd079e27e30b40694895feecd93fa8138fae96765de36b4b07ca41a035a0aa726703eda9681c65a498ca3cddb8c00b2982bae6fb6bcfe3f7993a147b3a40bc77fb73f58565d62d853b189654f0e05c55de2bf41894da620bf1d08b5f0e75d1b7fb545586400000003580d3b55fd12434850c9dd59738e8943aef110c7303519559d56bd000334bd73dc801ab3a6e3b4a71f51bc3b221cea87fa7a3928e94cd49ca4caab576fb1211	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E5ACAB1-8153-11EF-9B14-7ED3796B1EC0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434099814"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000030daeb2c9c9473e9895b4e6affe40e26b6efff73e1b0cc0b8e61ba81189fa707000000000e80000000020000200000001e75f8071cff51ffdbea2db7a5e473293e1d41bc8f7b1e95e455b697e90a397d20000000d50f5c9057176eccc6a808858d838874bc2b98f210526edf9129dff6344351544000000083f16870515d5787c53b91a690761ec6eac76aa1153669acce6cba1fb5fd0d6104133ac6ced225cad9fe15652def21b4f06d3bd4faf11a88ddf7d6f6d8e5a54d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a517f75f15db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2816	iexplore.exe
2816	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2348	2816	iexplore.exe	31
PID 2816 wrote to memory of 2348	2816	iexplore.exe	31
PID 2816 wrote to memory of 2348	2816	iexplore.exe	31
PID 2816 wrote to memory of 2348	2816	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0e6d22f501fd93c2a236f3a6682d1833_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ed919d1e628288038289074fa1283ffa

SHA1
3cb749aa6cc2dda3de234e0dfe385fa60c112058

SHA256
86c2d2c10ea7e56fa28fba5377309c53c792125eea4c59f3e55073667c1692d7

SHA512
1f00e780698f2144f65ee37cadd1231ec88c4d7baa5a9f65bc2d0f32825bc23e8859543cfa34b6e76dd370b138f8b84dcea03da46254c9bf26175d4d17dc81db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d904073fd5e217927e2703a5c568093e

SHA1
7a7d6489faa372a43d4216c80ac1ad0257e9f75d

SHA256
d829e5837b953f5c7404ba9cbf6c7a427a842952473a89c763d7fc23803b67bd

SHA512
61b577ab7224daccbc7bec7069dcc8fefbb50180b3eafb36e2d9e5c316370da065f43e5bd504498005eb9320b6f639a33015c298f24b9ea037a2ea2c2c2af859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
903ce0194dfc75cc823ec2a86f6b3e35

SHA1
60f3ea299d9d474fc9b832411ce18359ccc93ba9

SHA256
ae31fd822bdedd183abdbc8590d83f11162306fe5a845c77ae2b0cd0935b3bb5

SHA512
0e4d9a3457e3906df147872e605b214696e85281d16ebdbcdb1f018cd88053c2210f78c5b98891e8d30d143b329c75ef018d0af75ddce012b490e1a3f3015e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9384451350e1746ca435332bc86d4c77

SHA1
75e12760089f10fd2b7820361fb75dc45e214adb

SHA256
94943140463e664e93ea33877a4157f508b0952cbfac5414656c0e6cdc598d6d

SHA512
efe9e83f946461c038bfb1fe3b033c4e2bd82853c27dd3014cfc5c7cbf847b1b4fe87a3e35a4ca97f39ec4baa5126fe3540bbdb41c5828fc4766a4a5d190be59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee152eeb9fc3c91906cb5f307c7b5467

SHA1
6daad7a69222949babf4162606cdae6bae061206

SHA256
b841877d9e99f7fac8d32f540aba6be3304d0eb40ade5a46e7e52b1c56aa90b9

SHA512
e0588533ec37d7f524d42b970912d46d5640c452a1477f87fa2f3ac037b168b951052cb73bc5a11f8e9172dae157706547bb5156bafb636d8097067ad1cfcfe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
080ee6a6ddef743b8a42642a09de3a0a

SHA1
0a8a156ba3241adcbda75c0cea027d8a676562f4

SHA256
6da6a78fd9f2461c5e712d7ab8b1ae4ec8cb7ee6b1acceb5ab7b982952c71a90

SHA512
35230c1d74601fa06189de1d734e3b9364e2c54322a747800d6a3e08921e89c536ee75f332fc341104f4daf8f699361e06b54073de49f83e443ee844884eab23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e478a0bf684c1f6df7689b5909449fc9

SHA1
c83219ad9dd95be5b7c99cae81a55b7c23366380

SHA256
3cf29879bf8e099771470ec554065e39303dca0348c09379be32a52adfd3979c

SHA512
4c3cefaca0923c7992b73b3c8aa950cbb3045714cfc535b43fa4ecceb557f4c74fb2f90b6ed6d3ed771fd9278ffcbe43691afd2ceae686870b612b716d17ef91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa0c7466a3e3bf425484ede674431909

SHA1
b9a6337737a7d79ed4d0bc229d4f3cc108d6a794

SHA256
65e05aef39471efa97c6db613944be4866fe26e4d224fdcc2fe37d119bbc4590

SHA512
340b67633d83911f28d4ab7da280c94060e754708ed5a053832b180b8c0bb81cdc50520b2232f0cdef94aae8695c01a02539d18f4fa1082e2cf7f031230ccd58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
940175335206f52865f595ef15e2d117

SHA1
98aff891ae399800426fd94fc16b68fd52063846

SHA256
219e357e8c8a902716b24e52c88912928fb8ad527ddf749e247c232186559755

SHA512
1e8cf5568aebd4f78384d3aa97f7cd666ff7bb7b8c244869f183302da35d9098d4b7add15df8c88b265fc0469d9bc3adfce413037dfb0d61a59e4e2a16ce892c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a23d0a79c65db03c3f07f2acba1df6ad

SHA1
677e572824c9d8b5c245fb0ee3f51bb88a719479

SHA256
a742100b7b2241264093b23ed30bd5ab41a1660ec7934667acfddeb3a911a591

SHA512
0effa147ea6ba52e315255f71f25752d277a89a8594498061ad5ec298b384e00448933bdb660addec6d4d425707b4dcb26342509c7b640b5be1331908fde29b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbc79c794247a13dd1462f1712450ee9

SHA1
febe2c74f561fb41e940e69a9eabf30bb04bdacf

SHA256
8dc0e325d480fb6e82cdef16eff749204d1ba0a312416615430de96f23bd9f5e

SHA512
6fee762bf1e755e5dfc269201bbbf014a6fa94d9e22b6fc2031ed46ccd72d8490b98ccc0f357fdccaf6df34672db9ff016f8876410cbffcb2567383357ef7c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27ac35f7743c28d6749964c7c3164f15

SHA1
b3b1946db3cb9082c92d27b3617998108b9bc31c

SHA256
407284e60545b36e61855e71d0f2293074ff3a0092d81be22f00083bcc98bda4

SHA512
d55c1b1023f89823d1235439a7ac2a69308ee3a23d3a27172666c856e10fc8ffdf5aaad8d0349b4c954afbbb0618eda53dd0b05454c9d6cd0947435af1349326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
acf3c26d0c05d50faa469ba7b902d80f

SHA1
388fa6587f9c4b84814c0eb107dd158468a87cba

SHA256
eb675a51e8d76921666cbe9de0d7d9484fd9ad141e9b59ffacef16a91ac6b1eb

SHA512
911ebf536331836fe713a6280604fdcc36ab518f2638a047201719402374352082b90874f59dc4145abf651ff108b7c7daf3d7c2c1065d8b650f600d1b6142a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE92.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE95.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit