43f7310a06030db4d52c99dd8038eec0274501ede257c9e41780886e20526d6a

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

252c1d2468d82eecda281503ae2f305d_JaffaCakes118.html
Size

18KB
MD5

252c1d2468d82eecda281503ae2f305d
SHA1

88902ea76c1149a3b813d59c2088f4956549759f
SHA256

43f7310a06030db4d52c99dd8038eec0274501ede257c9e41780886e20526d6a
SHA512

15b8484ca66491db1209d02d3d4f42f9ca302f704ec5b4ec4ed886cc3f5cd7a84bd86197f8d7abfa43867e26f50440a238ce18d05b83560be601ea45295c8003
SSDEEP

384:rF3GeGVFTm4OosiFg4D4jdRqR/F7D+vzJqwruquDiTMVPvHSblMNv6uPIjkeetyT:rF+FTm4OosiFfD4jdRqR/F7DgzJqwruC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{661829C1-85E4-11EF-A540-C28ADB222BBA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434602015"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2112	2068	iexplore.exe	30
PID 2068 wrote to memory of 2112	2068	iexplore.exe	30
PID 2068 wrote to memory of 2112	2068	iexplore.exe	30
PID 2068 wrote to memory of 2112	2068	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\252c1d2468d82eecda281503ae2f305d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7a19d4f62fd9cf3b5ecfc6d857247e1b

SHA1
317cc8f1929f2af5e7ce2d92ed94c0c5427373c4

SHA256
b15233b5a5ab389f115ab6711048c05986fc395e1d164ce5eb064a9a7109558b

SHA512
41e7eb4406daac01c82f830023ce0fbcaafb7083e765d074d133e7afd6ea4738a7b85d04c6d17ed9a4c7d9dfc597f97069b0ccf75fa9d51708aebb8926c4aaa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3f483c80ca4e0314934e3f7be5044d3

SHA1
93030f58bc604ee1fbdf348cf19f1e7ed468ef9c

SHA256
200df1a7800702d14774484709f20babbe4ae81e246bddd440fb450e7926619c

SHA512
d9e5398b701612f79ef21d762192d9a8d4e67949aff7dd653803215056474a3874f10632546b05dd0079e2b6ed46e868ff31bec425d6ba7820be2e44fea53856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5ce17a25e422fe6cafe275038bd215f

SHA1
5e6ed4f8d875253d248a35019216a3ce6341f0eb

SHA256
27401d7af17fd0962db829a092253a4076396eb571be7a3e6713b723261b99cf

SHA512
9d0d28b77a174c71ce8c05d689ad8e427d96f0b72b245a91b42127200a102f927340f382588593a6101640f3cbde212898a7b66a379812f491fd5abaeee3e1bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd277e68ad405faf5aa2bc6c6623c357

SHA1
28d1690f1e8defd7fe36f6c5b3200fdff82fa63a

SHA256
cfded22389287a7f6365f9c2f81b868433a34e4ab259072f2682fda341ee60e9

SHA512
586e47bfc7617167582aac7655e2716c027e483ee929b514cbb4a629d571f66ffb3a2c7334f014701f3f29c65a2915fb07e766c2f36796605bb9c3a4637f5fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56879b9ab7ce5804afe9dc201bedb43e

SHA1
903a282dc3a4cd15ba7cd7cc751e1141d798bea6

SHA256
cc7b5eacdf769d1f2fd23a8d810e533709ee593698f4f4553195f0391436b4b5

SHA512
63bac32cbd13878e7556fd31c2bfdd908941c6c9c78f0c1a980dd9db4d6eb1920be2978ef93264f17cf52e6a9f4f16a4acc359bfc18d043c48daf1606007d5f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95cca40937efd087f5224fcaea03b91a

SHA1
137c7cfc6e9129ade540e12104df624886c809f8

SHA256
cb3823f691a96a3e996809867af7499b6473d6862b7506a67d3a91c4304ca726

SHA512
3bf3c19ccff1208175861a5adb6ca9eda7930b50ee142fba46e404c5694c70a2c20250253d2d7bbafcf58cb4a3f013207e6381682396949307ae99f40cf8cd4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1705b2b9793b2f006420525d9e1c0f36

SHA1
73c8739e69cdccc3af97de5164ff6d2f703fcd66

SHA256
a7781fd7af71597f9800d22569996cf7c0df7e8eaca106263e2258784f3bb449

SHA512
b9da738bddcdb78ab38b7c57698107f6bbcefb857fb74bf5951bcfd3973fd57673021731dc869b4c67ad0d60461ceed02f58d78f9c9aa1baf35ca96d511b9250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb9db8e1be61cc9df8094a215fe37417

SHA1
d385c4ad9d43a42025039abcd666bfbe3a04d763

SHA256
a6ef24ebeaad66cef7ea60eca3758d04160be5a3922c4643e96a5964ab75260a

SHA512
f1ea19955875106a6da5437815077140ee561169266dd10ebbdf3e9bc4319058fc3b1c3338e0454f3810d4b6a5126a371fab0c0866a2b3cfc43d7b51bcd93d98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa4e81d1dba6ea214827ec47bbc2742e

SHA1
acf94af3507e2a6b49392411a180d358d6000fde

SHA256
f9ec82083e50bdbe741136fbbdba8733ce9c093c3360e32a2053cec37aab1828

SHA512
ebc3267021c0c6c49b01710901e178560b1af528a202e7cec7e29ca3da817a7a2ca9d4ddbc0a1a708545c6aea641d2a459452835fe746cb0a18e9ccfa0b63e6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65191ff127e2129dcf50940917205ea6

SHA1
ce68eb694375f6e7b0760a398f2424b17e48833d

SHA256
52df44ebbd2cb4e0e2c438b52080502999c2a775246394b70c09a5cde8176a5f

SHA512
f4756084ad171d142f579b379e5f7694adaa9a50b43779366169a7ff3c15448cd5df29c33aacf66470f2d31a19ed7d9eca0d022b0c93e110aa21d9976cc966d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48ef9b2d53b29ab640d273e3c856e468

SHA1
837bd76a795e6d1c0d51edc2d257ee678404942f

SHA256
9f9dd106b4e7a893b54b7fbcb3e2e412dac6da126dac8360a6bddf7076e76fca

SHA512
7173f961633550052e839fc5054e7ac377bf253cc7b83d573a5249d85073e5de394e0000415ff37aacac733157a7912fe879da5a6a5fa9d6a85a8198c179e467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
16c0e147a0a447cfbfda89a14cc4f688

SHA1
d306f639239461fb7da3527506d7ae1a775eb1bf

SHA256
54046be126978afb89e212b928a43185f0c4f4b41f15743b6cc90ed24de15498

SHA512
c4b93212337b4443398583505636277ba3e50857bd60fb4523037f4033438d98d292b2902a47f51436b78eafdb1554172c098e0b15344975e7a85bcfadb57e31

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8DF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA94F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit