f7181b1aaeee9a86205d9969633fd444f0ebb97cf607ddccb281f9cd36957f66

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

154bb98d137ba7c6fac7700abcd6031b_JaffaCakes118.html
Size

138KB
MD5

154bb98d137ba7c6fac7700abcd6031b
SHA1

61ecc76aff353b80a461cd01ce936f6212271ee8
SHA256

f7181b1aaeee9a86205d9969633fd444f0ebb97cf607ddccb281f9cd36957f66
SHA512

3e2387a66e33125afa6472aeb04b44bd2b0eec2babf618c501ab411bd2b508514cded9d7c58283cc46ce257bd63b1fa05e0f3262a6b4e5625c5be630c76cf78b
SSDEEP

1536:STdVUhAUPlRLyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:STzU7LyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a26bffb416db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000001b12b519971bcd9a1200b5a183bf8fb41cb88c60e7ad6c2f05e503d8e3e6230000000000e80000000020000200000002dd697854e54b3dc453507ea2313074e6e6dd8a77474bf8c51e5b88a57275b559000000069379fdd407348a211e7d2ea836c68a03f860a631b0902c3455c2b4ffac6cdfb40dbce86fffb2a25e98a20c3e4d992eac069cd508f832d6f2e5e0b5e65be173b3c5f5a3fb987c711852200770967efaa34a1dffd0a508b06fd42be72b401cb0a7c17f074d7e201a4e725394a63c2b5ec388d37c46b4af3313bacea21e863d4906862fb8e2244d757c3c7565172a6d8ad40000000ad80c8c3bc4d2856f4e3d26f4251baa52a13cbcd07e229d1eafd84eee62d3a26f4da0102b84436d7de50249456341ec566e8fe6e07d9d50421a073f16b7a7a61	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8A791E1-82A7-11EF-A1D0-5EE01BAFE073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434246184"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000b30fa40e0ecd7be93fa345c89c845425a3bffd17c5a10580aa86578bcfe85211000000000e800000000200002000000023dc50618a085faddd564e27ced9a6b6ec0dc7d2a2022e03e626631ae602433a200000005c5bd6dd5572457e40f7419dfba9af38589b2b11009b6d5b6df04d9b8699aa9b4000000024569a4fa0028e49d7959eb7280c61d72bd5c119ed801b94856a62921cf3d1ead2a57800f59e3b7f7b3e736ab0e0a5c5f2a93469478ba3c375973bd2b2e8f96d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3024	2640	iexplore.exe	30
PID 2640 wrote to memory of 3024	2640	iexplore.exe	30
PID 2640 wrote to memory of 3024	2640	iexplore.exe	30
PID 2640 wrote to memory of 3024	2640	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\154bb98d137ba7c6fac7700abcd6031b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9da001e448e4c68e10e08e9e8d28b724

SHA1
b7702e6863ae115857a405c351d44de41ea68c0c

SHA256
0e33be2b24dd52b67ebe6ffa854ac3fe86b1558029e8c7c42cc8ca49f34b1adc

SHA512
5bbf0ae763dcb61f9641d25d28e83dfc9f50eb464f83230f10b6261325537d255a5e023cf02dceb932366daf42dc244ad7a58bbba090746c5807bdcff528859c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22dca324cf3d1a863e58ed038477becf

SHA1
22ba596a6f8a7a70c0cb35af80794e5048fb7aca

SHA256
3f5151f741c96b5efcf0fa844418369986348610d21fda9bdec76f4d01b83234

SHA512
66792a2ad2dbc81d7300cb4035010c87b69013e2419927315eeb001cf491b7c3e5b04fc1c9a86c66b5320afbb089b95a64cdb6b8b58b33111efc1436f6d180ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6aea8702c41426383d8c3075a3304889

SHA1
bd9324600c7617c63aa2e0f5dd30ea43a44357a3

SHA256
fa6db36e9faf1f8560785ecf4670d72ee4bd4c247a6b67d7fee64dda98b613a5

SHA512
a02cefb905c266d5223d46b304563e9b99c8ddcbf5f047515f04714d73d6b5029136ea7140390c60deb5d98e788f7f343fa67eefcab67038b1005c1f72b54811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b09e8d753fd5c6aaf2e8454a570446e1

SHA1
67f5afd274852aa9333968a238c61d7abeb833a6

SHA256
156e9a6eaf1829980efd060ceb0d582fb4cbde616acdec296e329ec6581a699e

SHA512
baa92486628a2dea1b159da59a621ec4fd28fe86d2a4ae9260243150391bc6bf92dc757b90a10792e4121eae95ee8e3c046e85cf93bfd80e437cad0e8b7141a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db57f12a7818949e187d27ce34658a07

SHA1
927b18237514bc7c5f0de9c3cb985486b00268c2

SHA256
051483db57499a032f1ad5f2cda0c4d8421f244ee9415ab602520fe0e05cb023

SHA512
9cdadc6509500dee000674abbd64f3d41c23aa9e39a515c35725d95b33356381b72f6d744cc279a433b5f5bc1871222d27f7a0fa0beab3f7750153b1108074ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e946d0247c3a699d8acce19e2a8a5ad1

SHA1
34d718b0f2a629f9358ab192fb6af1ef6d8f4ba6

SHA256
9dc2754011acf3fdcce630da64015eb2dd448d2f949eba580a7d9a387ae54ade

SHA512
729702cdd56f89395c2e938a82248ea12609bafa3e7c8e5e1b24e9cfbb1ea9970db87390c5f7c848ca4b662e5d5a3ea1ef71b8cb11bea7901edc82c68ee4d0b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35b795e921ac98b72a14e0a64657eb89

SHA1
d4551d1377bc4f2229167b10c475f0129d7f4dd9

SHA256
2211832cd14a4f2eeeb3e563e492522ebdd250630cb459ab94c0be7445cf1213

SHA512
1a4b61a3ac85134b7cb62f8a0609f5309acb233ae056ecab131c733369579ca1a48fe8c01b47b372516e2f0cea8432c69dc1763a92193c7e508bf284c31a3093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51136b9d87367a9e335d2092e3bea824

SHA1
f8aee2c49adc6ee58221f159bb1859fc75362d0e

SHA256
bb630ca683ddf7d59e7cb922ec319686b7c18e7d93c8ce14629010025ec02c38

SHA512
ef7377e67435af7801f7fc9c62dd77fca9f7f3daad41e26bd8ce95487313fe1ff0f20a278b4cced808df6e738414bdd2228a4c19b1a66790d133670072cb06bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e30af22c6954b90beae9c2e37e17642c

SHA1
93a18a65cc537077f896070220ddfa4e709508c3

SHA256
5198b2e91c675e0ce728e5cc5725c91b3c969ba569b876274b9de06d0e68e18b

SHA512
2dd9b4b3790fbdfdd4daa295938487389e2e4cdc44e2cb77305a09aa209a6202cef7a2c5bcb25d444e7b488024dc25de37db5869fc2ad93c4d71e4613294565b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
346a74b30d050b14cb5b4294f963f264

SHA1
575e8ed58cb116c987d4753669ce93f27d0bd653

SHA256
5888eec40f7ddb78f48aa5127f27defa229f90b33f2b869be0f1b98c2d4eb3d9

SHA512
a2298d9909e768ee45844a5d7ca9a5b577403b3981a802984819785aaec96eb9dc83d7af0ae3bfe8f3631318e674f06e337844af02c99bdd3bea675fb62ca9a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42c2bafd0885a827594fb400adfe6892

SHA1
3b61cdb299e3750f65d1f722d19597f002652da6

SHA256
a088243d7ccef999188c963d8029f772310ba8fc4347f1f31b373b67c418e869

SHA512
d18c51c99a84949703e00bbbefc42e8777b6272d9369cc565b2c3b245d135a82b0d7877014ab5a49d1f4202ea68406b651a2d7077f6c2b4c515c2cc80cb5ee52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ba080736a13459fda0d2619f38027d1

SHA1
0b1c3e572d8dc6ef1be7794986d87d7824c6685d

SHA256
1cbede80095a5cce038968ec898a93b1e1f4f2b12c1bca08f0c673c87bf74cec

SHA512
3cce092f6b1df801cc34202fb977972504ba95ce7b5a0b9cea52646b4f5e0440dbef8948374c4de1a9c560a798e9ed3aa4c43276f4656bcd39fb705bb818b4af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54dea5329a92f39692ec055fcad77fef

SHA1
72dfaa18c1540da821c9d176d64451e8cb8adaa6

SHA256
282e1b19495b66dc052e478d6eb24c13a8a65ae8a824b3bd79cdac7672b48f23

SHA512
ec38b5c9949e64156beab9e06288315e930f074c541507aff0db222e1d18e24208b00237d6883088f1973f4aba2c6d1a7b3670165969a6a2636872d297a0cdfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41d206908a5fc825fb62fda3148db4b8

SHA1
4b0486c62cc17e6554beeca010d94c1917d454b8

SHA256
64de8bee5c626c0ceb4c7692e27493138cd8b812f3b10bb3dd74916f21389987

SHA512
7ed8b52d9ba2c4b93e23ca7acf667db4c00b151885b31468e414d741dcd75f7baa1b048d86a7fce652b2b6aa498b7599c5a0ea91b09340e8a28c3478a90c7540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da975d91848176658c540e0b3bb95219

SHA1
7fe1c7b0da10996f6696600eb40f014b6d2fa5db

SHA256
f848aed562f04010ed75fe88cafabb703b2035816efcaab9c10b5e94f77d7cfb

SHA512
cfb9f12ca43a91bb52713eeb301260fc2b73542b8899678ce1ba76d6b20025a0425eaf256c5f23875b9544ba9352bf3de3e2bd6f0141327153b64ee5d65a72a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab46C2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4781.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit