45c9b3c4270cfd7aa2dd7c19f1e9a78e40b2afc535d2a27971484e0f8990df74

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-10-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2501e0c0afcdbf6b5f6d7837a6bbc8ac_JaffaCakes118.html
Size

139KB
MD5

2501e0c0afcdbf6b5f6d7837a6bbc8ac
SHA1

9c66c0bcb05d855f138d50e05ed555601eb5a6d7
SHA256

45c9b3c4270cfd7aa2dd7c19f1e9a78e40b2afc535d2a27971484e0f8990df74
SHA512

37e2764f6010d3eca498fbb386b01ecdf30d188c7d8d7606b5000e1c4be10c45c5148f6b9448a0954df1281f66eec2e567a4486b361df83efb6d058d3395cbb7
SSDEEP

1536:SWN504fh9QnoYZ5dmlXlyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wee:SWeZDkyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434600588"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000098ee43e604820f4dae71f10c1da92c5e00000000020000000000106600000001000020000000f5d8a5d5e4bab07d58c6504aa6c7e2a5ba055e97c3f97651c4f3b39c1941aa9c000000000e800000000200002000000010ab2188926f0eaa2662af1ac6dc8f42b95eafdcab2ad2f52371af5d65f788572000000051b572671884858e0e03dce7d0c0c0def581611582c3bbb680d08ade455d91c840000000382a3cd444fc1294df369a99298f84c974858b0766a237edf36b66e1161dc4c3027d402c317c137358d7ca1aeaac55fc3986ec413fad818f401b860ec2cb1806	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1128B901-85E1-11EF-9BF6-6AE4CEDF004B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000098ee43e604820f4dae71f10c1da92c5e0000000002000000000010660000000100002000000085785a371b3f11831c5b07d64d39f2b8f25c7265f6618f0a36be410105ccfac7000000000e80000000020000200000009699ac5a674019fb0bd00b59641405f673593c441bd85869c6d2e563b3dfa91590000000c74880744d0c2c95990c66c7741eaff274fc00f04b93e388b6cbba7d06305ce8325067ac8654836e473378da902fc34ab3b3bd74482732a0adf608b07b8b299d1e1cf172a84b37973cd22b5c8823f3768e5eacb7bc64edf46cc96efee2b63664a397f0280baf14e8f090e9eec818c4ff4bf4685bf6eb3b1e3c35607bdaa4519f30e457f139e86b8c0e6d2c800e91b678400000008ce8cca3c8632b9b6cfffa3ca265fa0aaf69420ccf1d01dffc3877c5874e87907ad34be77df49b4b94ba37db131b03d090c2ea38b3b8e4395d2f8fa80416af77	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00055d27ee19db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2080	iexplore.exe
2080	iexplore.exe
1064	IEXPLORE.EXE
1064	IEXPLORE.EXE
1064	IEXPLORE.EXE
1064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1064	2080	iexplore.exe	30
PID 2080 wrote to memory of 1064	2080	iexplore.exe	30
PID 2080 wrote to memory of 1064	2080	iexplore.exe	30
PID 2080 wrote to memory of 1064	2080	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2501e0c0afcdbf6b5f6d7837a6bbc8ac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dc1c2e07c49337fa5fe106367fd7ff3

SHA1
fc2fc3bb8938d88e4e49e5fe1250167dd91ff3bf

SHA256
5ba7be39699aceb64d2fe7e23661e2672f431e69ea5d99ecf4f5e14816b627cd

SHA512
cc878c117efba0e0fcc530e1e314a022c635e6c55aeabb7f6a3bc59286765fabb71ef1fe5b09016b3af088a5a931234136daad611985e39b7c68bc88d80ea31b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54f20b18ae2d8af30610a0cb874894d1

SHA1
33fee62651364aed02fbcf9895d7a6551c0ae0bb

SHA256
4b877677f236ea54adb2fdcd63deedc89ae68e8f1904656efe19583f729270af

SHA512
731467597c9b8c8925d5a39d7c4f7b2997a2d3ef863d0b3d4771ec00e3c5a4c72ad665a5f6defe37043cca33206a69bdef46188e07e112abb579fde6a3d3b73f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b3906e66aa6bd6be049be9344b86a44

SHA1
6e17fc65118cd971ee1ddbc7472c85a99ea2990f

SHA256
78a2142909ae632467fa550b18cc6d901a6571a0a29e19fa52163f2a9d13f1fc

SHA512
d1fa39e99b915913e979c2ba6c23113231705d4b3efc9508a130eed43189cd78e85d0e5e9eef69576f78a2c5c501f376619e6e7e32335a483568b9916eac56ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9221abe3f0bf11bd7a9096b4f404bd94

SHA1
6bd2598dea9a14be25a5743d143d64836d62593c

SHA256
b1e307f306e012793e9ada880f202f474a7f83b5c44ae30519b86b5125d82ca3

SHA512
ca5dc10e9a4e216e7b00f38598ffd3715e6012bab3d89a453436660337326625f736c352e603b7d2aed0d169e57e8162658eec4c68b11e9f953ed085ddfc8f14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
919eb985ae880b8752523f57f18f756d

SHA1
82b337b30ae7b005bbe742940ed4a2f92d469e40

SHA256
36166645e4224498125227d72596e86737de342575352e9edfd29fd7da677ea6

SHA512
db6cbf4d5eb9aebd47a98111561adb314e77563f83ea4da07760cb324d3745a39da753b9802d581121f1bee265013c878a4948663cff96a3a89bf311840dec7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e14efa4672590a9262ec99e45bc4923

SHA1
6196851a0345d1545c5fd7cd9c3205d3cff11c95

SHA256
2445f4ce21bce63ccbfc3ef7c3ec31af5a3a7292960a75a177cbfeeb5816f078

SHA512
9f4f5ca0ceb6ea84551a0ce206b9c39a9b40171f5bcf686654fef46aefd3b6b148980261fd25844319c94420038ed41af9359742d199e6432af282182fdd9afe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70691fc2b5cf378abee768eaf0c5fd63

SHA1
52577d61d78989af9cf7b21ad56025de238a06ac

SHA256
7dd824bb8440094672977dba4f0c648d0e5b79318e9dd6d6236ec2fa21197455

SHA512
8cc571b3d40f7561139958e034b8ff3a2f490fa0b6a0f4f777580a20596165ab56ad36f4ee7415f9e2c18337b419f83506bc850bb6c39450c64d0b50ee29f693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6ab8b6daff13ecfb7c2a4cb70e16202

SHA1
dd2d8ae27652d67ece0a064919feb9cfb0ef27c5

SHA256
c770c82aa301e06b4024d66b3eaef3894ae965af8a068ed9b49e155b1bffb1ed

SHA512
87300cfc668ad736fee0ae00024eef32b6cdb504ee906a65d76261470e175293da649d37582e85aa85e0900ea8b405a14d93a08df95448357d6d959666697f21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac0020e6b986266c5e807a05719ef1d9

SHA1
8d9a984f19c097e47c40ed28be8e3ff44c592e6f

SHA256
594b59c88c33faeae06bfc76261985a47d4b54e8bf4823a482de6583eabc2f39

SHA512
377113748bdae0118b65dfe5b438e64a8e091da2b264d81192f7181cd16f69fdf72f4e32fb448ff0a0c03375ee3988aff110df5192d552cb910d03a593e1c9f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e177c55de64ca2d6143b3c344cdff3c6

SHA1
5b34a539a294dc8580d64ec0eb14cc2b4c67faf3

SHA256
9e30af65986dbfbb416c42171705d4853befae5fa2ed459265de44458b6234b4

SHA512
227930f31ade91fd4a33781250d4963aea71b0023ba8227b41a3f34d6912dbe4c8b2ad7c3f201e8f5178e758f3fdea5ec8b5d4f764e3b1037d7533368156f955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
562023b24b9fa1c32b89ab5dddb384d3

SHA1
85b1ee5cc542344fdf33e9296956438f1b4dc766

SHA256
d0d3a3a39d49b53919f2791c1c788be9cb3a8ea22bf03d5639fd985429cea299

SHA512
40df3f53c2f7c234b2c5c144b6485cf932b7f5ab1035bd1f3e15eb5aea450d65c32c50300e9bad650bf94fc95f5b49ee6231b8d2064d4e23f79cc634ba5e57e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab223.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit