4b97f7233603a15dc93c2378224fb0dcdf667cb6425a170039e86b08a169a74c

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

148877101ae019f0afe4bb766f4304a9_JaffaCakes118.html
Size

63KB
MD5

148877101ae019f0afe4bb766f4304a9
SHA1

dbf69ece57e4d36a126fe5d1f1ed6fdb28a223c4
SHA256

4b97f7233603a15dc93c2378224fb0dcdf667cb6425a170039e86b08a169a74c
SHA512

a241db31886de7352f343beace6cf09f8d599efba1a76bd2e6c63b5ff6e372785f787e7e3481edaed7f171270ab7daa0c6973241fd7c59b7ab09d46c7b29c0dc
SSDEEP

1536:S+jOAk9Yczk9IlmQdsYJ3DySAuyfGU9g9b9ahsBc9mHcY:S+jOAk9Yczk9IlmQdsYJ3DySAuyfG7ca

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05ead1d8e16db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2AE00051-8281-11EF-8CD3-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434229543"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000026efb1a9c6b1dbd9d43553d58b3a7fc9159503683e64c0949340054173c37142000000000e800000000200002000000017727b1843e56dbccaf57896d039e8c752c2bc2c3da64eae6725afeebcc9428a20000000c359549c8386e5163f100f9b13337d5a424dfb44a3956cb9c1e833ef8e6d4af240000000981095868e2e7a0dea8195de8e7d2edabac4b5171367333c7721ea42e0182ab076b3d2db973a91de0453a67a869c859d2885319c2f25a04a913809bae0a0cf74	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000fded9e6ea78f618df7c8b30fdd74ef3c246fb416ffd9261332891b368ca04289000000000e8000000002000020000000b64604cecd74f110a191d69fa2f2d7f445e3b13b71a49c257319ff2b2d8a5f7490000000501782c6aab975f9c73909ef55d5199d7c4764510a81aa850ef587040e0784b93999412d4663de3f526c9d164915ef5394073e6fefc637955f73f26e8ca40ee95dae90404f99305d27013cc1bd2999e55dd40b0634cf0cc79cf7caefd20ee7f859b5f19f37a20bdcaff1c2422822d8b1b5cbe2f412aea3c844bb79d52a22fa69b4b0e2e4177da6b75432c1c39e57a372400000006807e4f1bede307e5a8d8ef83119468a9e4d0d4c8c56665ec313350619ea1571cb9687a54f8f9a19a62b5128836ac33f55eddf8edeeb7f66f1e66595c7c143c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	iexplore.exe
2532	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2524	2532	iexplore.exe	30
PID 2532 wrote to memory of 2524	2532	iexplore.exe	30
PID 2532 wrote to memory of 2524	2532	iexplore.exe	30
PID 2532 wrote to memory of 2524	2532	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\148877101ae019f0afe4bb766f4304a9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5e1fe562e7093a3772b6d8ea9b643e1

SHA1
2e1b95e762f330dd25ccfb0495c5fe607baffdd2

SHA256
c9ee18eed725d8a9bd99f807f71c2a1d1040263e076ced5981c1c036d2600e05

SHA512
f832190d83074a094bc3b813e040bdc771740c2f69de7b0f07e4c2e25958dc8ad14dcf90a0c94654149aab7ae3e42211d932d8b4a7f71d46a31942f05647a282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdda045dfb99453ec425c2ee800081bd

SHA1
074b6b91c62fa12f4b9ca6d1d8bafc380951b815

SHA256
348492e781ec6f40db155a004184441d62113bf36a3708a5f2f31a16cee62e70

SHA512
50ce894975e7e10cdf9796c155e93846159f8242ad0bfe1e8bc18e0d13ec7cea4b81fdfd0a8dec06f4460686bbb27ecb656cd2f56a2a8cba7b6a0d136fc5dbae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60dd9fac2426ea04f5ca5995dd3f8f07

SHA1
3265a2d4c2be2063b8977bd90eb11bcbdc7cd07a

SHA256
cf851b89e2b4ec79b4516b2cbb28f7032c8414ca4afd43bfad51731c05d71c45

SHA512
ad7cc22a050b7beaaa0f90673fe6a9891b5b75969e637716a725ffa47a4eb7c734aff21f79011d254845fcc561c34ced277968fafd73a44f998b83e34b6be800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a48730a5b8f4de12681ba3cdab9c2e0

SHA1
3404d82b8ca22bd525d2ffda5bd02e3a3e4e391b

SHA256
5438325c04b51e477367e6f0b096ab3d504da6eb634eb02f4d1ef5ced660bb47

SHA512
6ab9b92256d9421404659e3ccd088a8a9027141567cbb60bf7c7e178ee70a4d1059b0dd36d2f5c032825a323e2ed733c0da66dacbb02a3c40afcd41d5af63ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6e1413a5a51ebbfeb7c0f5dff9fecaf

SHA1
9ba5329d15391cc2e1b97d4cb783713b2e687498

SHA256
768a7ec93e153c442d88cfa8ec3e1a5785b69c6868c0db8691c6e687522f6f36

SHA512
0c305bac73012ee94b90a26c2c3dd74bb0631c79f3402884389a4908a08df786f9ccd4a7e2fadd574333017372898288e7fa8449d0584ffdf8ad9a602a827a0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb0fbdc5bb32996ee3774dcb5376d9c1

SHA1
0140c607c312037d7892d4260c1b87bdba4f6297

SHA256
09657a4a19df4b74a8596157e56edcf1bb2040677e31c28e2f8902065a7f2221

SHA512
7ff094432aa95ca696a6a29845a0f5e40410658f6fe45267bf2a857b8f2885d18571c0c1d8cd183799a92019ea3d715eda572e7f9c7aa4624aae329c3150b7ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a37cd08b0eb0dc82a55ce9fb24e9e0c

SHA1
088cc88e20b34f979857dc33a9b6c29d2a09153d

SHA256
47053b1402fe8408580573b1a7cabe2bb7ea668459d3fe98102b873e9abc12da

SHA512
bfcf52696387010812a1056178600553f8bb932063fc684a89586b746e2b7f17c9e39e3f04c2370624334b218de116417462362575a88835cda3cce5b74146b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
068a05728543120d52e5817267c3f504

SHA1
28fc531615fa65f2667709d201165365b74f5685

SHA256
b2cb198c233687233edd0c6d93e170bf3cb04e831fecff2bd04c3bc8c7772ec4

SHA512
3b778b619903c7e691b31945a4368258cd28c5c5622684c81fbc02c3bb10348dda7d3b3e89b35f3d58dc695c6cbd57ace4967538fc93498082fa502d1583a88e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
186772b15438cf79540ed6e1ebb11638

SHA1
b5e1ed7803510f282a63dbb788e3b4d857667764

SHA256
e2de27de070e166e94d0bae0257d4297a4cf9385df5dd7adfb342d566364193d

SHA512
dfb489e0efbf8cdf87ac271347e46a294e0484180e8175ab46f75026faba0b29681ecb4f2f3c87d005910a689ea7a4589aba94f30990561fea800956dc06322b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8d77799a45c769f0377294f3ffb3e31

SHA1
35eec12d258c9070f41bbbdaeb61664515d517fb

SHA256
0ca18b173c47be33675a87caeca5f24e9d35bd3ae0d0852c63073f7121fbd811

SHA512
848760c5b0a592f01b1d8ee7016ebe47e99108387eedcdc3272ba8b133c8886a6f718f290c8aea55d32becc0faabf8002cb38951bdd0c85600d505e3a88022c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5355c2bcf19641cd4644fd7a9363fabf

SHA1
c97901a70235b48b52629150fbba25db8af63478

SHA256
93f045ed0bd50e8eb1efb19b88be2d686ad17694c41be2e06f77ef62ed5568a8

SHA512
cb65045c5055350ca45df377ad31cf96352e0e8336df82c546ee285423669a1e1d8572e4f26fbd5547042474e5af4c9de1cb6176747ce11858318fbd358e564f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35d4a5bb8200bb0a1d572b8dd530064a

SHA1
896e4727a56147da4aad737368d2b75aaf6f634b

SHA256
932c00310c24480fd0f63081168823b6f7fc85ab42b0d0a261e7227e2300d770

SHA512
35d5165d122f350bc73f8d565986c312f53f2380a73823fdb3e4cf9e46747a2a3bdf80f4cee31c376bb93e28b78c5f864a491ab4038be27a25a89387252a85b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be13498cb2385dac6168ea7cf81c18f5

SHA1
db68c4ab124ff329d5d9bd15915200e14355f540

SHA256
2a15fd025428af971331a271ab1ab2395d64fe25bd7b5b32960f3a438390b0cb

SHA512
e86b07e28043230753e6cfb429080b29d9ed36c6d85569c1e33146992f1abcc4ac6eb3f639cf5bee79a5b41c777a84c6db5f95ea608a7f85103a9d13072da35d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4745a6352b4966ab2adb0b51d38951a

SHA1
879da955cacbba47acb84b98cb6cf10c4fa9522f

SHA256
e5aa5d0f3daeefd25492cdb97511df8ffb5a52ba55d76e0cbbd7bae377bde602

SHA512
92895e3207350dbc822249f2acd1fc7a1bddb77f608a3fc5daf8cb1be1384bab3e6864608ed64621c175beb4e51e9c4ba11a886de792e6d72d21fbefdd36f59c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab23e4b2b9524d204009964c0d532ea6

SHA1
3eaa2c269636acf167b6a78790d4627a8bb9240e

SHA256
5110ef726f577762767f6e183a490eb34623dac382ee06f29c1971fa503e3fec

SHA512
d11ca589b6b43ab7db69f62364faff72108a3c4247ee20a1f7648cda1daec7157d370ca1e7e6180fd73a089505275fadefc4b0f4e1f3914bebbf08f57a37a37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ad037bd780a9d7d84efa40b79409dbe

SHA1
1ec92c71ce0ecd9ffa6f711c9820605332f5e226

SHA256
dfc0e1dc51649e23453ea1bddf3d5f937412161d6c048d38071b007867baf29e

SHA512
62669ef0062524f28dd265d0f704979b3ec9c458c6cd049b7c044945162a073dc77792b773b3a4999a3b66386c972b83e520ba977bcb8050d8d1f4aa2e66ab55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63C5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6426.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit