59512f22bc01f9aeafaf7371dfa29e2aee34eef84c311946d0e0dc6a03b48082

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

288e3018ddb6374cd1db81bafceca6ca_JaffaCakes118.html
Size

142KB
MD5

288e3018ddb6374cd1db81bafceca6ca
SHA1

3fe62db69658c0e510be62de240985a7585f8317
SHA256

59512f22bc01f9aeafaf7371dfa29e2aee34eef84c311946d0e0dc6a03b48082
SHA512

858533d4e54c7c70f5bc754a7b92a674e8e8028cc9e315b65e1c9a3124b729b962097d56d7838add4317315cc0db33e2d3b288c0feda20560046f5e8fff6df94
SSDEEP

1536:SGEOKtJN1cxiEx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:SxJNYx7dyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434627207"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D0F4761-861F-11EF-9CB4-D238DC34531D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2340	2328	iexplore.exe	31
PID 2328 wrote to memory of 2340	2328	iexplore.exe	31
PID 2328 wrote to memory of 2340	2328	iexplore.exe	31
PID 2328 wrote to memory of 2340	2328	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\288e3018ddb6374cd1db81bafceca6ca_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
131c82cac6b6166609b0728580615ab1

SHA1
4c1de01bea06eb54b336243d8544efaeac6ae1ec

SHA256
32267a04acb738324505737414aacf843e27854b5261ddf63874891afff26341

SHA512
9ea842a69e703a75621fea6c180385f45e7750555e8abddc70f349e399a1aa931dd5c9294afa8b01c6eebc27633b8ed7ca5478c480debdd5bb751149bfbc7425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
076beaf5b1bc0e025878e75fd59702d7

SHA1
0bf74df992b6f4b050c7a408d8cbc921b381d4b3

SHA256
f61fbecb12c1930480e259e9010203729b47050f655fcc1c1265a7c592980486

SHA512
345c588575b688ff912bdb503137178fd7f8ecb88b281df6268679a2c478e0b6dc54e8ac603613920c8a31e70c258e40a57fc7fb8b0e70da0334fdd7826f5945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ec3b6e58d97de8ff22932b4466239f6

SHA1
3f5572f2c2144bae6e0bd5a06d74d184edfc9bda

SHA256
d6ae3781bf2ab8846ec2b593e7cceb6ace4a067c7908b3c7140c3dbd2604a65d

SHA512
74e25014ca47291f09d7fedfa82d24b31116d9a5134341d04c78863b11629f1659dfca1b661e483cc4422f4150891f4ab1ba025303e6aa5afed87fcb4dbd86bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85a7f9557bdcc5b784da8279bcaf3ec2

SHA1
96d618dfa1064810bdcff4bf071c00403152092a

SHA256
722aa9e35590dd2c3ab232fe09159fe189f5eec98101fc4924a1697ffe9ff607

SHA512
fe11b100ae00b58bd0bf096ea021928d6c6fc11aa64b8a8e87322981c02c8622f419e259a33ca9a58b0345b191eabce90613ba0e1b654a0a508bc0ecd0f1def1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5df4379a1db69ae420e6c5921b809a06

SHA1
af0e8c8c7da465e93f297ba2cd8168c639239817

SHA256
7ff437d8e9e365d64aedd110cb81500a58742d43b0d381af56c65c9eed2146fb

SHA512
1725b3e579144d6b96b17773c6c997b2d0a9c28d56ebf515b1f037ad9cac90cb707eda8c7d16406c075eb55da5091f1345caad7a61e978789d9c32d220d3c88f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44e81e71d442d5bd6478040584028f27

SHA1
bc3aa5af49422c4f8c76926e2f7c99a8fd71ff7b

SHA256
21afb129ec8bfaace81d7fc95ac85c25764c07758883cc6b1d612afaba3966b9

SHA512
5c97c569b2b2f45498c85b1a05fce86729be1823b252673eb24c953a791525c6c15a3f87446c9591e8d3654c4200e1df98741efe5866326f347419ea45e2afc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
661ea058529cae1aab57f70fad37e807

SHA1
d3ece116af767e87ff499967876adc8f59b4331f

SHA256
990c5d54470410742537c2446cf1e1f20b76b17d8df006905f01f7bc2b6a2230

SHA512
79e06aefe722c9acc03b8917a6976d4ec6ab544b38734099307103e74d2e75f373ff097cfe640c62e8846ae4a72cc98b444b1f84a59c65786c850fd8ca89391a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ec295d14fadacb33adaa863fb96c630

SHA1
584b3f82cb06621b1b28d4ad4d7fd561c7e7fb32

SHA256
e72d28a8ae06395eb39dd74574c477e156e6bfbd012bc646f7409ccb77bd8081

SHA512
c0681c80141912af8ace17b3faf777df148883ff5bf2fd7f7c66f81baa3fbebcd580400b6b5f199b9d781295252d98d18c1f4c53d6dbe7f4224c78ee8e8cd905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
591f99a3b034fc7ba751f7e17e1d47b7

SHA1
2bf4d44a0412cc488e9a0589c53e3a0e38ec8f3e

SHA256
7125c82896b889fa81d970cbec27c530bf950476a66278456e89dac9dcaa5ccf

SHA512
e2bee265b9c112f6bb4e3321775cffbf2e85087f0d24a4d8089aebc525237f4ff05438acebe83a544d3250ffcd7582a1602bc1366708895edc6e97d5cd754045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b38551b3dbacec2b1355eb0e8b1cff7

SHA1
d8980757acd81386cd990c2cb9a3e2d8b26953f5

SHA256
cc67bcf9af8e57946833d2431dfd1b0c04d41d7e8deb305176357e5dcb6faf68

SHA512
7ec8b20d706ec6579077e42ee595e7f3f514a4236b8164ff896d49cbee9f5a3bea20575f23509a54a5e0592b11c39906a04f5ab8bd33e2ee988effa5aeeeee5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dc7a1195376b6a08ff5acfc86ccb419

SHA1
dabe5c7fd39095ed1de7d1160c16a58521bbc198

SHA256
e48410b9d5cd4991f79e01ff62ec9bd130d018bc9e64bf9bea6b49c892760c50

SHA512
fb320c0f65065fb8d0e5a26aa60d70ddd68946b990ac3509a9873d7900184047791bb6f1c6041d1575b2e88c175a448e873f453bd3c0a91d0f18d7881b250ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d8e171e2127ad26fc9e573e5720305b

SHA1
17dd37348c9554fdf3c0bff2b087507d202533c5

SHA256
37a40b6e735f4564ce58bd0a970027f490e524011286674f07ea9b677e343989

SHA512
041b0fffdba815b902f6d013ea6e13ea79ef43cc0b8effbe1920a7e1551ff6f12a39b09e1832ccb116bb05daef5356b970a2a703a7f3471b1ab00286d62b8806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13398203ac72480a62ab2214ddafd7f0

SHA1
7c0c84922f80203c8394e4461f6bc69f6feb8d72

SHA256
ee19cada88856dcf1c19ec8639a14ebe85ba734d2e73de49054a368ff7a89daa

SHA512
34f7c7b49184be5a6c8638f2e8a7583941feb84fecba6d2c4bb4fa1d410390146edf99ba507e1151377bb0e9d669fdc31a5bbc5c38dbf2f5e829f3a1bd22e667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41a4a7d9bb2243d543b1466320c2595a

SHA1
cb825ba3443f39e40f3d9c6ad212e82e2e7daeb9

SHA256
921daf51939fde8d326430a1d9fb182baa457650f89d0b05b9bf60831db26137

SHA512
30f714204fd70d4a80fec8fe3d740e85667910bafc5093304350723a4969588e1c170cce8704826ecc8bcf508648725bcf3c6ce712c7c3f4d255fcdfd42d44b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da65a36356ca8759801e0f03875c4ab9

SHA1
b7e70661f0756121256e756ab8bf09afcee3ba67

SHA256
de556ca8cb7caa36c564f73b219b7086b2271618e535f9c69ce197dd55ee5e84

SHA512
f1a80948c0e619dd75296cf39327b7b287527ecee3a4e96b0f75578c4714eb12799b0e2f6d7ad4a8468e20167c30923b27860d2fce177f771c289c7242d8e2b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46eaab785321f34743ba7d72854e1a24

SHA1
13680793118d219703f7ffcacd7ae99ba049d162

SHA256
7c6a475ca6589937a3b21a10c8a27b6f8bcc98b5d613809a067ae6e3bf322bdf

SHA512
33c3e70781e8f7cc37d61d612515133feb5ed313cfa8bccdd05f738266365edb76e3d3368fccc4b659206999abcfdec5a4c65f647300e69d849465636ea09add

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e70fcfe508ba0cc55db67a6f5897877

SHA1
af7fd20ec7a464aafe206f9de0893f6a440aff8a

SHA256
45f7ddcfdc4f08dbf47edb808f2b0f4300262e98e63d8c513d1841558a18b772

SHA512
573e0ee10da0b6e17d8ab05cfa6def48248a4d0582e9c15068578c2273a2a84c21a75461fe091f25faf0ff86702cc68eb7bba4f3acd5aa3dd032394507a7b946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6309ebec105973f41f7ffacbfd5757f9

SHA1
73a1298cefd18149ab43b4a585320b244bd6e307

SHA256
1bbbd5f2e0f7db937d1bbaf59e468b3ddae163951001495f48227924dc3c6191

SHA512
c0e97bb2158e8793a7563917dc8c1fe765c5b712fb90b402293435ffe85367e448de5e3aca8095de3449bc6e854948ba07916f175a4c1a7e3930c39a5ea2e7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e1ee0ec464b0b0aa1966ab700f82b4b

SHA1
609707dbb85ce1c2846a8daa91f1ea4785011bc8

SHA256
bc37e5e46a3b096487094a3ab434f7f2b26761948d3294956056818e0a241277

SHA512
81b62f3c0a5c1884c435f5a4f829b20beed7396405980f73abd2fa7411387f67dd3201e244d59fd4a0f9899e9e26dc4c6b9be333ce6f619bd86230027bd6630a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF2D9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF369.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit