6461c8021821a0f0d01ed89374fca7614bf6d54fa41d30f43a930235f9f1ca27

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15dce7093f8c011c2be66499909ac353_JaffaCakes118.html
Size

56KB
MD5

15dce7093f8c011c2be66499909ac353
SHA1

692b7a56b83955147d6fc8f5cbf2dc251ff98e04
SHA256

6461c8021821a0f0d01ed89374fca7614bf6d54fa41d30f43a930235f9f1ca27
SHA512

09a59ac76b1a87b4bebd251c2dbe9c61b39aa2252ab7b8f1b59a2cde19bd0d988e06064a8b78fa0862b3aa4dcad264dfb4535b07d7658f81dffc10d7e50d6272
SSDEEP

384:Au63Krto0lNWsdg8BKNRIVDDpTGITHWWZEelBWqSNZE7GKNRwNHkXsWaGCqd68s0:nlSSyspwix3LHMzxjX0pL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3008B2A1-82C4-11EF-854E-7ED3796B1EC0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434258328"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2636	2380	iexplore.exe	31
PID 2380 wrote to memory of 2636	2380	iexplore.exe	31
PID 2380 wrote to memory of 2636	2380	iexplore.exe	31
PID 2380 wrote to memory of 2636	2380	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15dce7093f8c011c2be66499909ac353_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
60b4a4783f38ddf46c4d849a81a12083

SHA1
fee0402a849cb0dcd11e0efbb60f89c6e09ed3f7

SHA256
3e6d3613f82c6b7a4cfd4da5118ff857541c50f7f22fb188a80e48a6e38b5cbb

SHA512
2d6ae37582e4569bc38e06afc0982e387d9cd67bf9c038660a962e6bcccf30b671e2556f50904b8a748dde0fe5863bb35f7beac9be8a8703eae266028ebdd662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a2e15fc57b4b070ed5a11c80137cf9e

SHA1
d2dd211777142e330560f45fa675b5f824f55f08

SHA256
826608b455da9ff5b0174d695dcf4e6b8f79e2c083c35904b827e85c62789575

SHA512
f27d95b87cf63e5c212987083a93768d3501c2a070b3c8eb4ecc0fbddec188e61e5c18f8b13abcc5568d09f6299cfdf57ea51c87d59c3008e76a834bc9ebfb59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0f36f245e9868ffc96f38f37359f326

SHA1
f4c96aeb14cd948995d0cb9a806f1dd4446637de

SHA256
0750817db336d5fec2b69fa09e246b9d9a42166c30ad3f51917ac44411318e2d

SHA512
c52000a20537319424d4f0d11d299e8942cfc9df1f31f0a8390560e016bae8a6ccff19d28b7810462f2e52276e914b3aa35307aa139629e294575349f7bd9b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9dd405903d73bda37b0d4f2334d510c

SHA1
06f121278ab78fb8b5fb091737b1b6af3a3837af

SHA256
381ec5d3ead47210e6e9b680da0810a09778de5a3d102904202146a7b4c38335

SHA512
6afad4d8ca8251fbb7472fa105f3acee6831bb4a6c415020e359b5d05a5dc7d236b77504f8df8313f850e3c55b06916fad0779411a2b1c7430127cc55d4a531f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7af7b64f77aa750ea09da9f125268988

SHA1
58c1107083e3a99318e388a5a65cb1643e6d6de6

SHA256
b6cea766baea63d4e2e1002554c11625c10873306e8414a02005b86c16703157

SHA512
f6a1c37682ca97e666ce33001f239e22949846eb100bac003c54f259c932c4a5a9f5ecf4c8cea0a12b803f17bbe17a9419cdb3b437645e07321e001f3182e79b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bca2ed1fa7e97b3e3143135b94049c3

SHA1
91ea9fc0966471cc7f1821205741311b11d8f4cd

SHA256
3d00e52481c9dcf7be0afa67ea2b9b32eddd1c7a38588e34c4208dc9b3293e53

SHA512
73b17cff5ef8d12de52b90cf3b5a0775c0be39edbe97462e26795639c178736b1378d0a0d8a58b4febb1fc2d6881fcb7c90ff2d03bd11d515c990b4cfad4a5c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd73aff970f52d728915c5810fd353ca

SHA1
79cb1847419f4299602f3e338d47ea54ae64d66f

SHA256
b944f69146e616cc1350f6300661a277570767fd42e98ba8bfe8f32c1c9f93bd

SHA512
942335ac3889efebb147eefb4c17391409d90dec705d510996073d50b7a705f1bf34cfeda9e686b9110bd3b748e13c9659ebcb097b58d2bf783523e71f295d50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25bfcd1ddd2e64622a7ed722cb3106be

SHA1
7fd750c3e1da6b674efd35868c5c6bfb85e38c6d

SHA256
3e50274af909605b57a6658d4d99e4f907c4d67320cd4a40cc65796df359271c

SHA512
54955ce74a7e759166dc224a528d0f4b369a03da7fa68c1652c708ebe76f3a66005618cd9ce0e8d949c115ac4452f3e14167343cab16a104bcdb446769ec4621

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7789cdad35d217881c2860b3b37cf20b

SHA1
79fc8acf6235d92387ec38e6319253b43a888890

SHA256
ac05d7516c9ec30a20c51853577be9ae3a13604f488b8d06c97263c3342191fe

SHA512
d18d464348569a0e36e056ee955da62b33a3d1df35a756204a11de27f85fb1d1bfd34d9953afd550c3170539664671ce800a3a66ca916c8ad0d621c799959fbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5034c6f5570f35b342dc7ddb5bebef0

SHA1
57168dc05c508eec0bf615130e7a6c929c900a87

SHA256
f93bfb2ff9a8ed6044149e48c81cba5d481b200ead99b7cbf808e066b2662323

SHA512
4263b17bd4f0ead160ed7e7fcf856e001da22045758869b2f58873a3fa065f012af0b8ad60c8814daa8dfe1d6ef06fe6aeebbf764f1a376174f059ffbdf4007f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
685f9e9aa374d5fd6d9089fd7a0ff6e7

SHA1
fe1e56fb7948d3beb053008fda1f0f4f7c2a2153

SHA256
2c6836e6ab437f3263043822a523f5e960f820bdd595e7cbc21f68739c07a442

SHA512
e863b336ca4d1a46befbe7bffa821f21d54879390b9be87ca20a0527251b46b3961abef7e749babb3ed1f403c987922741def9f449331300181b5e92fbf48b3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD01B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD01E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit