7b3270c59f28b95a5ab26ba624ea517a22980f18791267f7399dbda9cf45a460

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

279e57696da7f8dbe23dcf30c2254d54_JaffaCakes118.html
Size

10KB
MD5

279e57696da7f8dbe23dcf30c2254d54
SHA1

2ba8297e41735ff7e49f42e29e42b044cd9896dd
SHA256

7b3270c59f28b95a5ab26ba624ea517a22980f18791267f7399dbda9cf45a460
SHA512

03c288108eec8ce5b5539fc2f6783f9e5f5e2b325482abca1ed3f1c9ccceb9fda12bde68ba0182b755c71336557a2255b198d51bb7c0a22101fd36a98419abc8
SSDEEP

96:uzVs+ux7ALLLY1k9o84d12ef7CSTUpGT/kP+pSps31DvMdlwe60UYRDvMdldlVHS:csz7ALAYS/I8SgaNUYRravPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7ECDB11-8610-11EF-A3C4-46BBF83CD43C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000046f660201e1e78b58ea2989fec34225c2490ddd84a06e704b29d508a45436e96000000000e8000000002000020000000d0459ed6b71d2bf420c05ed70dde80950243142728360d36d43f31b88b849937200000007fd917bd070f2655a92e4d87c4f1d2d22cb6b1a631f8b2643b4938a76d36707240000000f3eddc9e82baf0363be7ded2e7204c7d5a2a28d527f87491a8b62510e415c0bba9f04bd29723e7bf3ccbcdcb7f27b873c6950b2dffa655ae83392d797fa6580b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434621082"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b16e9e1d1adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000029ab35d1494ec3fb05367daea44b33e31294a1ca318de8cc73f43d550362a909000000000e8000000002000020000000800bbe1508dccd4e068c08e4bb4bff1a159ab9f0e1dc8cef6d9d3e72dcd348869000000007b649b8b07e3e498111dff53b3d9bdde65dd41923cf9fee6514965c126d5da91996744939fb5f71577b72bc30669cb62bfcd63f4c79fec89c5454e01c5f627678542504adcb6344105255ce8f26bf7468c4ab30a10fb9e8eb841e81113bef62229d437b160e33771bbe071854b3c2886d5e17274734a7c6f83176f659a04714c621a6751ec3f0ad891d8d0967dc5b4140000000c71c8efc0a50180a360e181aa14ccd24dedfca16731c7859315f06e77be4b2191e249953e602eb732872bd31ccd4933d9934246f1cc3d55e0ea0e758e17ffa69	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1016	iexplore.exe
1016	iexplore.exe
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2288	1016	iexplore.exe	28
PID 1016 wrote to memory of 2288	1016	iexplore.exe	28
PID 1016 wrote to memory of 2288	1016	iexplore.exe	28
PID 1016 wrote to memory of 2288	1016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\279e57696da7f8dbe23dcf30c2254d54_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1016 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8294def6c30eb1287a4ad63ecabdb165

SHA1
703196bc4618d4c58eca61ca3bfef7c0581c59ce

SHA256
9fac36880713d164933bd843379bc8a6c5be43ba3f5d11baf75bac883caeabb9

SHA512
6313765b4957bf2c9168619ef766ac2fae0786a13803098482701885e3aca92d16a91ab6f618bfc11a47f81fc5665aa369f1748289d8db961d5fa97f2bd01226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
015fb0524d56b12985b0a82021bb571e

SHA1
70820ecfe863dd92bbc769f4fde257da3e87554f

SHA256
a1d9bad9c5b16ce2ce7abf0d05759b042895e3f67fa14a7ad7261cc68e691ee8

SHA512
3f687b12db830f6d5966698a74bf70b00621d384aad10cd6f5d4826368793367449ea618e6c02d977ad8e7b3cae3d9c52e0b6b57efe8d3d86136e343adc6846f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55aee0979f95a2127badb043495b2bdd

SHA1
0ef6c56a81ee46d98d0f59f2514be2b31a6e32e8

SHA256
706cb2dac7441f910505c708744aa56a81848233e72da0f8fee6106812ea4dac

SHA512
0c15041bff4943daa5d749c6016d21f1ef254297dd168eac8c6aa6e89490a8eb23f8e05a65d88e6e4fbe454ffcf429907fc7c9b6ec5aa7a97a5454476ff0b44c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
306426ea7cee2a7baedf06bdfcaaa9ae

SHA1
1c36d475eaf0892e96f010f440061098eea9557c

SHA256
b75e26c1d10037be48835b8217e42720322abba3f6a73bb3b10c892ac9902654

SHA512
b8ad157b208bb76a65f5e206ff161b5da12514c5370a2e19f26f4548f800506df52cc9b8ae609539d4d3fcfa82c5fb6d0d567a9a52bc8cd39cfec05f52505c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baba5290afd07cc22045fe059eacaa10

SHA1
17e49aa725fe9da6e352f56bb678d2a11066fff2

SHA256
4395ee17a65dc05e3479f3664f294b58c5c312d93c5df607e09239cc1330d4da

SHA512
d3fc66d6084b0c2ace86b36ce8a97582d95cc8ba16831d11ed7614339ac96e7fb58b0a2918efb641cb4140d55e5ac0ace1479c9398c9beadb765bcb09c02356e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d53f0943b407f53f2fe4a5e264f1207

SHA1
0347d3109ca153f037063d912bc949ad41ebb2a2

SHA256
b82a61d2ecc5eac95ca22573a3b7729f695ab562a9fb80c697d497270d120736

SHA512
fac871c7ba43043969438398f6e5eab443be7f9cc58b6e2c574cde57d2ef0c56cdf3c1e9bae147d08a4d332b914c25a80bb7e76c34880e2c664d2c0082def4ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15104045cf049fa59c48c7c01cef90b6

SHA1
25c56eae201d9ed3763a51ca35d9c3eb2f2d0a57

SHA256
c3f8ecabde4140984540566bec246cd3d54dfff4b3c573cc440e31f6ab458d34

SHA512
50d1df7638246b80b8d3d07b284050ccbe26055dfa2588e494b31f0a64fd195c51f5e4dbe33fe1cfb1ecd93791952d3fab686382332c37999899b8523ca3eaca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46b5f92ae0b6dc2a78c1ec5d60a4292d

SHA1
74925b474fc832f78e02579de6c67e745f0bc31e

SHA256
c003e54a819d5267c0cb9eceb79a6cfb378c3215b6ffda5272ada45ee6b7bbcd

SHA512
a384b689f8259396384e77e000a10b993ac2efde3db485d772f6872b45e1f7155c53851fa8e27ff664b730fb1d2f9589802563aee7fee71c6f4c3b8ab13957fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c35352ac5fac5cc03065a5022551e32e

SHA1
b1946f57532add9767085cf5171e092c2e85e399

SHA256
439af99ca8dad679e608cb1ef75912853fca2d78585e33105d207846a398131c

SHA512
ab4a7c514bf88d07171f0f47f25994445dcfb6e4e7f260caf46f25946c074125cadee5b8973e0286d6a58d3d70e229401ad4cb0567594ccdc076a22a992123fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA97A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA9DC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit