4b532c5ec389e7f2fc0aa9757975a6838325608f13c037fa8748175380b78fbd

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13a1afd78023034d472891d9717f75ef_JaffaCakes118.html
Size

214KB
MD5

13a1afd78023034d472891d9717f75ef
SHA1

3d457eee965cf5b9bfa01e550494955c35decbac
SHA256

4b532c5ec389e7f2fc0aa9757975a6838325608f13c037fa8748175380b78fbd
SHA512

891a07d4b3573d19ed0579a840ecf76a1118724c1acab7d77af9a9294b759c88b009b2169a1bb4be1a08cb88d1c52d0b6d46cc96960dee03a3d4009695660c2b
SSDEEP

3072:6rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJeb:Sz9VxLY7iAVLTBQJleb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434212131"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A113EFD1-8258-11EF-B439-523A95B0E536} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1076	iexplore.exe
1076	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2576	1076	iexplore.exe	30
PID 1076 wrote to memory of 2576	1076	iexplore.exe	30
PID 1076 wrote to memory of 2576	1076	iexplore.exe	30
PID 1076 wrote to memory of 2576	1076	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13a1afd78023034d472891d9717f75ef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
205c4444a3ac1649fde163a4f079b1b2

SHA1
41292ac5f608c8dea1f7068fa945def0ac113cc1

SHA256
a816454841c5f0bf750723643dfc28cf2f16e363ee73e39e331e48eb61b11672

SHA512
7d30c28efabd9d750b217d4c59b3d3664eebf657708fd2e4dcbefeb5f84ee1b4e3cde14332851e863d9f8373deb9d2511a82138daee9ef5756c41d7ae8bd5a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6adba150ccf0c221e93c2714c3c8dfdc

SHA1
25ee4bc3e8f28879338c0356a96f0358faf7bf2a

SHA256
9814bef325422fdf33c76307ba97f9cf3f6cd8d548f5b0f1b5448e7a6af763c4

SHA512
3fc30fc921e8ac934c6ad7e81f4cf70f8b60afc3a71ad2ad0c9ff61a49a6fc73e6b6ba3a179711c88fc2753d4a52c87101ee06254525e14e3762d159d98c1b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ede3a764a68e7695b69b62b09b7f5a2

SHA1
3131dcea5f6d9892c37e9691b4da1f87e8249c77

SHA256
4c10aa088157c65b038b43982f6db4a6323a2b2b68d0fdec4b301aa5be788b27

SHA512
dac8ab5779f03f8a8d098f8843f32be62c6443fb704f38a33bfa7358162ffb0e4b6bb000799ecd85b588c637d4789fd0cb4bd4f5d97e8b901aec6d03f0831ec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61337689c83a0b7ec30f31805cfefb1d

SHA1
62d1faa6f2cd7b576d0886c5efb5ccae7c2965a8

SHA256
7e42f21ebdc7c80875b05b463e82e44f2b003c5d216f340ad923904fe4925559

SHA512
59b11eacd9bc07af3fd3bb78c12c69e65740068e2c7b868751f85cc5edfd43c451917987eb83c180e51fb7667da5ddc6e7f1d63f36c7c5d0a1e8a6c7d89d2ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dd9b20e6e6034f553899fa2c48163c3

SHA1
e08d341734e557cf7726c96fff52f8f09bae145a

SHA256
74e80a3e6ffa63c404cb8176dabeb6724a654d0102f45b6fd7ba903edca3d17e

SHA512
a4afa52442cff56ca3b9d66a662352cb4f3e77e6c5f8c7193b07c01bc1e46bf8bc95840368b5f1d969e9b4113a631389ce4c34762021b65132d46afc3e7263c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe4688862f35c00a11e819d62c05d61c

SHA1
04c0f810de35b41a350bf2f6a7daa557bdd4da7a

SHA256
73aa56197b8dc64a2ce6de0869b182f1511184ce8e4f6d6eb808b219b41b76fc

SHA512
c25600423f3688d332fe8ccba31385b902f358716d568a364d68294406cdb35d9e01a5454ab32800b4c5c6cd94cf7f616000d600af96ed46a8ff58d05d182494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e34b6c0b514b4611e9205a027372febb

SHA1
0bfc6400f19b9bec17ff72a2898d017da2f7d543

SHA256
0333801fe119702fedd79631fc9ca6b719871a5a11f49a2012498c2066c3b49b

SHA512
79d1db4cbb68c42462c81dd7f1714775f57118397fb984d38f0cee5f4ccbb5b7844fbde3630e2909f21e335d0ed61ac34df3aa21c4aa133afd56e133117ee5f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
311d75b8021e8b1ec03cf8783936a0ae

SHA1
707884e3dab851149c2329041574aa215eea80e9

SHA256
439fadfd265470c55f852b6ca11b6ee83cca6d402c7f38e2974ed97e8dfc3119

SHA512
266347e5637b96949e2f49594e777be0cd1cb037dd692222348d41ea7d7e1959485e88a2d5c3589a1c671bf880836674783cc2b36d6848b03e12adb7e0938fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80f943e2d6526aec0852e7cce982cdd4

SHA1
01e8b41fdd81005ddadf708d86785d1ce61eb36f

SHA256
d57d068f50414356271de4e3d2be24d00eeafb9bc7c4faf64647c7c91d7c01cd

SHA512
a5c9103ef704e86a0e06124d6c43a8b879b9800068137f7a81fbd473615a5024a3c1607083305e222c93df8cee324e2c245777f5a076dd4f0687c433f03db680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a50944cd7908bb68b1a817551856daa

SHA1
ee4ae4a5fa25f1c43d29afdf87df24e4c6a8721e

SHA256
cd177f29666e82c2dcdf2694bd4dab3fea754ea364d171730fe88e2c75c985e4

SHA512
cc83a0883570960f16c314935adca232b7392a938ea7a7192bfd4065e056aba900112f187270c72f2ddb186e71a3f2045c955e815c80aff196073baaaed2032f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e0095e1e658ce037ad77e452be60f04

SHA1
4d38776e16d206c8032bd97c01ff4fb2a78c8b86

SHA256
e7ea1551403125dc946bf95ffccfc0dd99dde264fc900244c2b682f07da82e3d

SHA512
6bea8e72b3874f5f4e71caf4b38b86eb08223c275ed163ad52d26bc5b7707024b09d214618a4e87cf40a04196de55ba235c64ec108be4b78428c9dd29f0377fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8d824e67b7ca49d9d2cd209f1337b89

SHA1
97f52abbd783a3d51e1e0ab275e1fd56eb5f3d08

SHA256
04f50cead7dd31d5a5d660ecaa8436b5da56b193084f8ff75ef0cc2f5c0d3e74

SHA512
9896276c4736124e4ee24754280a36f5506857fe8baad53f92a013fd3523769dff4d521a8a1279baf6f0a6438c401b3a5810dda77f7e211417259bd64abff8b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92bb0f67e27057008e7ba8cfa9800cad

SHA1
05a534bdfcee559fe28e4fe797d8cc5d96516960

SHA256
dc9df35f9f6540975b614c83d5627be5210e9386fa70af2829a5e1c1007675b4

SHA512
8427bb7da7a686a79874119eaca4724d393349f91049a01848453703fd3f6099e6d528201f4d18bb948f18973e2e5205f1f19ebfbee9e3d435d5048bae32a477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7bde8338b8cc301aa3d555053d72386

SHA1
2c2663c7d1e0192ae8dcfccea9d9ae7516fc2f85

SHA256
30f0d92c9eeaebf11c174b14e7c44a43ca7c191547c71eb00af89a706c579e45

SHA512
2ffe4a5290135405f35203b84c28011fc1cc2e5b5274f5a7f767f08778d62a5c70a67230ecd79ec26159ca96ca8871aacf0c204a5029695e3b27286dbee99b03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da4db9c975684f2b9f01acdc0e6139a0

SHA1
899d2e2fe73047a5bbd6a7df1e4f6e2dbb1120f5

SHA256
8e98dfcbd0f76747707813808609c0929d7447b54cd71b84f5181e0f94bbd5c1

SHA512
a2b49991f259a8bd25d2a0aaff84e11f48ff08279fc8c9cf0ec64fead3633a84bb140cb9acd484580588f056490c3d4cd26ab5711ffef2c2795a63723d02e37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a0612b8c95c0d7990d6d9adff12e9f6

SHA1
efb6cadf413239c3e5402d54fc73f97febd79293

SHA256
01f44159157c8af35e306b8abf8030d2a24ba1f7a062c388e448129d8ee44a4c

SHA512
0683dbeb29c9bc09d9989660fdb94dc4fb31ba42fed79086903eeeddedcebaadc79668a4606efab36bb37901ead470d7ded6e2e6b987c3c08aa0f60e0e95f9c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59b3652bd56347a13ce533b96caa7717

SHA1
445e06e19e36cdf2e8d316bfdbf1483208a91a8d

SHA256
17d494241eff92d4e4a43240df8ac38530a41afc4dfb0aa7737786e1513bc73c

SHA512
0e609258872eb1dbc1ab863f8331c972d593f397d5aa63231784ec5295e0ba3911a479e6eab48d30245f8c2c964c9cf3bfb570194817d88b247b10c50f42fb30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbbcf7504bc1d9659c8a20a39ceea015

SHA1
e8e00d24a69fb63b8c5b279ead7f76cb1da2f146

SHA256
57f7ab264ad3ada32088204cea707ca2bcb45c39095e0a5a463e382728eaef12

SHA512
236572777f93a7ed52bb74b08a55bd8f5a96ca51f84b182ce5f6d92776338b8dbb383e7f67cc043ca8bce0cd4e3576aae08538862bf9a4eb56f8c0a11068ca6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af382dab37c3533060562aa1337d92c4

SHA1
64af535ba3e5e323325290a5f598cf9662c8bf12

SHA256
b1b6557644f639783385a94824105b17940e57bae3d7eb369c77d02e0e671507

SHA512
45fe78e3a3745cf71ef5e63f4fcbc038bb03503ad8fdf2a0c893424ce6f7cf087d0003004dc8aeb9ef0bf756aa72f2cd24cefa9e59ec92ce634cdb96c5f4ebdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F07.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F69.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit