9d9403fa90f4aaae6a22d7321a85c4a0d4e959a531b8e2c3661c04144784e619

Analysis

max time kernel
122s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 20:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2527c10080536848afb8a0e102fd4f7b_JaffaCakes118.html
Size

26KB
MD5

2527c10080536848afb8a0e102fd4f7b
SHA1

7fdf42af935dee174912b6ec4e6e2c6e9ebabd24
SHA256

9d9403fa90f4aaae6a22d7321a85c4a0d4e959a531b8e2c3661c04144784e619
SHA512

03f1be6d5a5903c5eea326e90485281d9098e807a8d7e56610548bd8b7a0a7d0cca08c84b5c0442c1ae3bab84faf56a7c1097d69e20822bd16ce665ed9521736
SSDEEP

768:ScDtcKv9tytukK0LW/gnNgDgL/1CTpcY8dsae0Sk:ScDtcKv9tytuT0LW/gnNgDgL/1CTpcY0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434601930"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06d7a0af119db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{318D9A01-85E4-11EF-9319-62CAC36041A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000f4226b6c15e43584f43c7a2f7fa7cdd91b7f6698cdb73653b19b0812531512ab000000000e800000000200002000000023797046b67afebe3c64ad898da016d2c74ce4e4595d85a51f54b8216de1cdca9000000014326f48b614e31b6a5e4dfd318ba8122905c9b4af12240b79d523cc36dce35029c80f8de8e09341dddf6162aab425b4a5b9c65c3338c0edc59cb13f2e0dbaa0a941a8779500dcfa101b116bec57e02fbf2cb7365cdb647b4adcfe4f68e3a9f1289fe3194cccf2f812e7be26ff0a1745ea69c8a3696c500f10bec5960383276627f997c62c1a258bccf3f9338a6c681640000000c22e784e90652d14313bb60cc76765c17a9027dc26ea2b6a8990525d56d615c28dbf849a13dd59f8d1c30abe678bd2b97973e63e7f452e6a4dfa955bd089bd78	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000127a8cb220a9a5164a7f44934d42dae1d2cf5917ae8ad807eaa81b5becd394bd000000000e80000000020000200000000f2dd600f5b7b4e8aeb252bd825b6769ae80162b873708f48bc77b66e4404bea200000005774e1dffa2a523963d4e8f3008f600d5207cb18d992101c4213f7ed17314f3d400000002121d4984f43ac8091ca319d17c28607be7f1fa39f1ec3369c7dc3b5f512e98381569223294b3adec295d35f6be174287c6ec5181a47041a975e34c48f2bc008	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
468	iexplore.exe
468	iexplore.exe
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE
2708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 2708	468	iexplore.exe	30
PID 468 wrote to memory of 2708	468	iexplore.exe	30
PID 468 wrote to memory of 2708	468	iexplore.exe	30
PID 468 wrote to memory of 2708	468	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2527c10080536848afb8a0e102fd4f7b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:468 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5b77515afb0af4b479e377195cb9c79b

SHA1
590a0d9bb5396cf74037baef73ad7ef4948603d8

SHA256
fa0a982ccc55f8714d0a11b01b6e096b4ff22f1dbb7afb25b4ba8e2266e070c7

SHA512
2bcb3b0c8a90a3e3da3283f77904f6fabbd3cc1f3a00f89313817388df4acfc7d387c62197ae8fe39abc515f8796ebee4a87f9b1ab128d3b0333bcdab936fbb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a56694380de0993b709c33381176ea8c

SHA1
4d4e89c044f52b8d56a02a2c64b974d45d144766

SHA256
307e80dd430ea6171ca71941d374aaf1168caca91a9ec63be16a6e9a52eb98a5

SHA512
8b276da9f4d7e21fbe95f71df79af10e4a62252dbba4a0a2bac50e8b2d6a90bd7b27697d9aead2a7700fde5c36d78cf74ee4c98158ce79c60bb88ef896113ac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07ab15fcaee26238e8ca5699213c6878

SHA1
750287833cbba05a58793086826cc1e58354651c

SHA256
f40334bc435e30849f1f91ccb5e8071ab48afb620012f0ad840e80a1b040ee31

SHA512
ed5e64b88a10e5b6da362308bbf84386ed2f631f8cc3c82307d6036256c00da1db0ce2cef246d86ace6196b083ddc872402ae0838cac3e3c1ca19caee089c639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e40008bb660f17c5c695271e2a8843f9

SHA1
439c150ab49d61706577fa9f875c1d45e8076343

SHA256
62d634564be4d2a29916eb6f1b5261d9ea524909046a03c56be60d8cf6a304df

SHA512
0aee31a1f4f454f6912462aa9a6b3ae87dd2765430b7453b5610a6b8a40eccddec65808eaa24b0cda66f53660622d14d032b24cc94414ef480a8011c2df929af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f94501e676eb898930321dd7aa13ad8

SHA1
6ad78db0bb5986267d99bc7b71de4ab3ebdf9dbf

SHA256
33ad28290b079cfd8fac8d3cd9ba431996c999a52213248dfba33036a33e9429

SHA512
6c39fa1e0f8be57bdafbd9866e50115a9c6ef3305f9d24b641eac81ab64861f9816059059e6740069ffc7afd95e0a30ca34865964cfb1325afe90a05d5022140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35fe8fe3b440d540a7796fbaf75c7528

SHA1
06c7933feb2c9120c74ccada1615676e3c053801

SHA256
aee1df5eae4d01e07e830b0755d03ce57823c6defafb298b115c20e3093f529a

SHA512
fea348832a78fbf9fab3aebce669635fdf5672e7c1bcdd2157934224c409e3a009d522aec5ff16ea7e38c7033f01e3ece4d0f5c032647eb5102ca1143e446612

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c178966f16aed74e153424637f0852f8

SHA1
3539c46d1fc6833c740852e617d21c36ee27f0d8

SHA256
4eb947e85a4084aeb22c3fb0af8709c96ce0d9ca4ba6fbd15a3da8675300be94

SHA512
99ad156d28676cd3fd0c3c30db3a709e39a2f921140889961d235aeecb58ac20cc3282e17f24080a4e67214a4daf8da67b2ea4aa989134e33a609fbed08888ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0188a617f4bafc2fea75184f63a78c2

SHA1
45d6cf4cee8467d985a6a1c35f2665f3fd5712de

SHA256
b06494fbb7aae9aee4fc57c85a71d26f18afa7ff577c807d83890f73f4757ce6

SHA512
47511f63e5b78326079df71a03097176ff3fd8771a6610bc8be108a0528c3b975eb7d82af44d0c25eb199f02789d369b5d6b0a95cdcdd119b18170681aa31d6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc742fc801f6550a6c3d116b863ef9ba

SHA1
6ca01cf19d25041bcdbdc451a82948fe10345eae

SHA256
7446ec8fd98247f437caf10e12c12cce6e1669c6824287d0182ef2f0705b2e6b

SHA512
545b9347b0489d47e8335810cac7c4e3c4cf17e374e89da9b46316b18263f831565673b074bc9358254aa9fd805ace98c96a98b8f0241b6bc11edf732a3446b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c8a311451ccb23135a919c0668984a4

SHA1
2b663f84d76c1c1317078b252b31a44935179e08

SHA256
27a650d1d1649cb74d2e519d001f12d1d59133de1e986740e205cbdd495ccc1e

SHA512
c663c791a3183df18368426b69c756345273c74504bd34f2f07e2a59f7389addde3bc3a4deb440a52e82797639ab24ad84ed246b143978bbbcf622cdfa9be8c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26fe4a777e36789f6d2b79408c21cec8

SHA1
83aacfa7dc71bb9f5538ff20e4acf0f4b4c7bb6f

SHA256
6b5971b9b5a3106aaef40602722b2e4fa4d848ff83e1b3bbc4b8df9d13f1ec89

SHA512
4fb942996b841c33e4c28afd885061b521bc3277272f845b027b8fb1dc734d10b1a46097805ffac37e28a084313c7476d2313c32bf47a609d0153d2c8264ac8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
612c94eaa5f9fe6a9b11eb31ce5648a7

SHA1
c7a202782153ef78afa9b57a084179594c60d7f8

SHA256
a4aaf00a04c697bc6f3e17578a5cb62ba8dd4086f99ec21e6da3a8fcd8f0c518

SHA512
693feb1c39974654998c9172055e0fed9d7f60100a2acf3d49e8125c4eee0fcaa091887c404d53e4adbfd5f68723699106b67c8b704db2b913e68abe4cf5ceab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB9FF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA10.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit