6fbedc9ea9fe1eca452c20064e921f3f30b7bad09cd4f9b4b0e095080062eca3

Analysis

max time kernel
143s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

278c3faacc4228016495701e4c06e703_JaffaCakes118.html
Size

139KB
MD5

278c3faacc4228016495701e4c06e703
SHA1

52233bb4043fcd0543a79c0f561547412bd2df8c
SHA256

6fbedc9ea9fe1eca452c20064e921f3f30b7bad09cd4f9b4b0e095080062eca3
SHA512

cbe98577cc7c23d204fef4e2567174f55296f0377d0d99475e7bdfd8df076f68ebcb70c534502c39194e3a8f729dabb4d65788afcfabbd9ef58fd6b7986fba10
SSDEEP

1536:SSNUYoTlVLJ1wIryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:SSPOw8yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434619582"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{450764C1-860D-11EF-9E7F-EE9D5ADBD8E3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305daf5c1a1adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000a7f8c980039989dba7048d83dd6f431799e7e9ae7aeaae8deffd541f06643090000000000e8000000002000020000000110e9f7102c48fbf62134fa7b58a3366e349b2b82fc1ba7cb01c23e769633c00900000008c0164d827373dd5de0d6b6b9838c294e7290e7e72909a4bc35260177c4760ee0466d59214f7cab30b23525fe5005b8c98522c2d6dde7b25a485e176bd74b56464e6ce0ea5606412ccc8c49cc4c5c8c6a38831e8288f277ec7a931268732a4c59d5736662e54bf999f872ebcc2d06cbc1f7952b28f7d4b6d4d4d5e6fe8c6f25b8bf6d2327e3b1802417116864043b1db400000008e64570a1a48a4370dea5ba46441f76d8f5aeb3abf2d171b193be11d56bb69b246a7e3d6094677e98334000eb1138ff6e164e480cb0cf4b17814f9fa38c6b574	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000e4cc74cfef8e09e9dcb06cdf75a83f8804572cecf4c19d76588a7c52c6ab637f000000000e80000000020000200000008e0631f63c738f1780e5af54ad4a055f3eef40213f5f645b12edc067cba5ee78200000009763123d319878443569882ec712a63fb6430acc4779fc8ca5d76851e320801840000000908752f5cd312f0b354d445f24e39172cc223073721ec743bb5343f1a96290fd96c37733c2e6ad29da43160f3d48009014d32b9e0a3708d17a3cc8b7ac95cc46	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1852	iexplore.exe
1852	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2360	1852	iexplore.exe	31
PID 1852 wrote to memory of 2360	1852	iexplore.exe	31
PID 1852 wrote to memory of 2360	1852	iexplore.exe	31
PID 1852 wrote to memory of 2360	1852	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\278c3faacc4228016495701e4c06e703_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
565035412394a9371e1880ab2c8d4b30

SHA1
f6ca8b6d9d08ffc5363d952f51743d91e86e9b2b

SHA256
638ac837cc26e19b75e5ef212501b5616c862e648ebc9e7b049d7f90ff91cf19

SHA512
c08ac6284d435164fd8ec97ee160259dabc13d6f1420b07c2cc90fb08e056e5f3a7f3ad45f5aac460248b4d84d06233305802bee63137827300f8ea8aebf561b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71a60e56a10dc0e8b74c7640d8c96427

SHA1
560d17c43e0a9e190aea41b6cdbe70c010786b85

SHA256
8fd7b54caf256c10d5ba330711d9cb237e77891d843dea3fe6a8e527e8a46ae3

SHA512
4fe88c6a11fc06f818d1283fd8c528afe491933f983abe1062d78d241ff3095348281e35a0aefe51c72b9cb56848fdf5048d9fe7beed8faa7694e5cc71817273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
043654463f742f11cbf72f0eaa883991

SHA1
62f647408a1646de47040d54dbdbf35e84417e1d

SHA256
e5c25f50d95c8452a1363cead4782c9ecc3d49008cd452c386ca96279478a1d3

SHA512
cdbd1523d5515b04265c9c931bb84bc655f4742f1356652f52763e40ac7a1be437d1fcdc8913955b63f61fd023badfa63555cbc337f5e09b1d20327c337fd905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7760baf4b0a110242392f510e704296d

SHA1
8e15e2c5f3f03a5a7cf03dd3b23b5ccf1faedde8

SHA256
16fe4aad19b05623c48340697b4ce61b6701f5e29ee2a0c2263a7ed31b03b4b5

SHA512
b85431ec9246451f4c16dc3e0dbe920502a747508addf73c5688de018f6fd0727e68a32fbe73c838d5a90adec16a98bb5b645336e553f8ecf42add45d2119b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
870f78a3706b0e3dfce4a23c71c272fe

SHA1
42607c050bb00509271153a08ee9207ce1d2185f

SHA256
d303eead0d58729bca13d354f173d07eea836d5646462dc4762cad105c07c7a8

SHA512
2a05d6639c7950a70676c4efc1d494db04d721781c333502517ee2a7f66cdc8b3b215bdf2877a2fa209382f3905b40dd4a3c41c12700ebdde4f5c895c36ff3a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
082ec0c70854da128298dd4e8b0b2d9d

SHA1
c4a7a8c725ed158d8605d0234ca9239faa7dfb09

SHA256
2ddf7c42c2a98b6284220586b3e845f5bf85942a630ff5c460bb2d996d13a3b8

SHA512
f564ce999e3fe1861c92310e1ed4ec81651bf0585aee4157fda0c6f38f70ae894936a3118b01c2333927c48873c6758f80aa4ae08d4de2f32503f17dfc0ff9a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1ba2d1bcaf28a364a1abf09974eb0e1

SHA1
61746a254c7c8b9dfc1fbf5b2fe09bbb35c30575

SHA256
adca8cacaea5bd604c86dee7743ec616723ca74a4b199f48a01f3baa5eb7ba4a

SHA512
3739750c93d90101c21372bd5ff4459bd68052a068dfb3d4b23d11ebb0068f6848c9d289d094cc9c5fc285c11f5069e3b5e70e78a8be4e2bfe34949392ebbe63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b0ab6f183301e50277302870b7c9edc

SHA1
629aebe2f3f0ed3a615e7c4db2d1a2ede3f982b9

SHA256
d5e18c2564ef88b701a5994316f0e15f35eb70ccf628245fc47035c08c270d08

SHA512
f0e3b4b9d806b9c4d9ebc159d6f710b06f1fd03ab2312e312c06c16f2ab51c2f62b541437a9dfc410aef519516e571f252d89d23efbe140965cdac00a0ed51c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc08cb070ee2e8de62709a5525161ab5

SHA1
2ae6de4bd32ba2e4a8caaf9cd74b23312e39d67f

SHA256
57aae076fd3f0d6ca24736ecd58c1fc0acd8b651b51b1f1ec54e7b2c799a78a6

SHA512
962279bf2d9538f1d9cd2f01e0423322e45450fd7ada659b511c4014ad162b939e9790105b01afd1271c11ac54661b233cf83fe23ce7c31063036d9f014b1cd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f29af797299bba5400b6fbf7597480d

SHA1
e8cd2fceac44310c0ff23ae7a7a996597e03b207

SHA256
6041f334b937e58de04d7a082a9983af23c69c34830faa872b97a1b919158d32

SHA512
a61d8e3f103ea0c69951595132e39775e874a2a4f824656cb266d615334edd74e66e7e36a61eb7c0557ae4a68e129936eb9911455559bbc505ae6ad542d6e23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1339961a05db9116acbb34c94ccaefe0

SHA1
7d7892512eb368e111891488a744258ecdd652ff

SHA256
ccbbbbafd01319c00453a41d72f67ad9264aaa0016818afa00b8ad6a5ef275c1

SHA512
cd208d4ce412158e9bdd59fcab257d1e524e4b9427aba52185f4f51f8037b33fd186b598f90c73c410155decb1fe39dd4d0fb39c8e64e8fe69ee52683dc32a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d18f440954ff5992289da915999302be

SHA1
33f422653cc51afe3cbe6c2c22a1510ee4bd08e1

SHA256
c377b157c0f09be390af0d54b500185dfd093767aa243bfaa8532c412983da9a

SHA512
9cf1dc18c39507fbd5095244ce3fb698f13832b259a7ab70711144b77b40e96820e2d5a34dd7be47b69149abcdf0f124d0e6a4360259b696eaadf164bc2ee68c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d1cb82d8b71fddba711ae58064dca6a

SHA1
862b1e2e82aeccea7d97d060051c094360027fa0

SHA256
0f68a0473aacef076441438d04ddf9a910233d75e25f0c117d668aae7634e4b7

SHA512
501571f1a70e637f3f48095b72cadf997727654f22604c555f094b1c757d72464babee2da0574622a47e2c3007c3bfbbf050458f8e08717ede1d5fcc528643de

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEE47.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEE5A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit