b60434a362da8ceb5bbb85be6e53685c9ac553981d5a0bed34ac4f6da06740ee

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e7a2af2ec784625d182269dcc899338_JaffaCakes118.html
Size

13KB
MD5

2e7a2af2ec784625d182269dcc899338
SHA1

b46b528ae598ce0016d3b50477b88a7f882adf9f
SHA256

b60434a362da8ceb5bbb85be6e53685c9ac553981d5a0bed34ac4f6da06740ee
SHA512

8d119e9ae8ef33be8d58d3b7c52e1545a4d2186f425f39089a7b40ac46e9440bec1b94b4fd1780b8f9e13c4aa4ecb29afd5e642d9d46ca6f079ec56fd131190c
SSDEEP

192:csz7D6AYS/t6E9EoHsyy16tbclEePHb76f:cQ6AY8t6EjN4ESHS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b33ec3941adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000f0ad9530282abe79a13c0d4d6c463f65b7ee25059a861da12fcd0a54b48ebea2000000000e8000000002000020000000bc6badfb7f6af0e27be097e67d20227705bfce0a7e4548994c7d577391ece278900000005a95b53f9baa681cb9101f7ae66346ab98276082fb591ef59040618591a5a2ea1f909f1bc5a1e370c0c22a730dee2d60e0bee9ff69ad80115bf7b3877fa45d9fe66af83b1d9b0c044f54ec6e08a9c02c07aa368dcae5354cd188f025d74c8f1b4a3fae67359f70e47a94732507004f8f8652603b8ff9e7fcf9c13135895d329b164a4329f579cdeb683a5dddefb2a72340000000490dc166a88384b1bd9ed3969e28547932b62b2cb550db0c69529b9fef4d97bfd74e079f51a6a0e3d070b073b32c0ce67912f4a83d2aa0c68312641ac95c9fb7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000001193751e481c57d12f6ce94bd65ddbc9b2e2770a1e3ff4a52e5fe0a781a9c15c000000000e80000000020000200000000a36d48bd8b013383ee1a3203ce87b764e69ff88f63cc3c7f560f65541869674200000008a5254baa58acae069a0dbb90697d52692a217c6b5790e1d98bb5e0d15181c9d40000000924e0d4b3810ab828d186b715d06e3a815edee85ba43b04ce1d07b563d96e1952e59b2cb782d384a91b1bb2633fa152880f2cf0a5784cc13b50060811a2b64e7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434672249"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECC977A1-8687-11EF-9081-4A174794FC88} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2088	2688	iexplore.exe	30
PID 2688 wrote to memory of 2088	2688	iexplore.exe	30
PID 2688 wrote to memory of 2088	2688	iexplore.exe	30
PID 2688 wrote to memory of 2088	2688	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2e7a2af2ec784625d182269dcc899338_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c478e0847ce6d8a91baa5e670120c425

SHA1
2c4de3c2f5c0afcf26205e1e38399a0595816481

SHA256
2418a1274f2e5917f0d92ce0224edc160cf070bed3786ff76f92dc68e6e97cb3

SHA512
5234cbc1b1590b374d9e8db46bce43341ebf278b90377cb5de406a82eedd5f0974bbbd18560cdf7408db59d484cebfd5da0a08d490fdc76086e58815c7695a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8fae3675a10159779de92855e99e8e9

SHA1
bd1b2f6b26a4f3e31e6386d50f688c8beffdbbe5

SHA256
c2b085aec5a6251e79694d2e1a629a10e76fed98b179c648ad6ea5106856ee65

SHA512
ce981e31b40cb645a3253983f0f013598c3b23807a27157370217b3fa8e0fb09e77b900340425ff2d2ed2878bf576709991ed108f09a568dcabcc428bb58d876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba1f5b80e90c90392bf95e617516e065

SHA1
a854d963a03b8762a5213a89721f2e4491b8ab6a

SHA256
d0e611a1a80220bd435875e6726e9e66c5eff5984575bc10b7c26c122e0f2ff9

SHA512
d79b8ae2c57be972426aaf5cd462e6ca6322ca0531b86d8373586636f1a6c068931b3f2c43debe9337879c8536ce75af66c61bd5cb01a33a0bd97c83a0fa01ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
942bb8d210356e4fa259a4579561557e

SHA1
341b1626ea012a7ba9a3ffc9111103b9eb01ab7b

SHA256
c93c3c5862978fea7e6e339e4a9b8f3b8954a3d44d2ba6178ae1dfc040cf84b7

SHA512
8a039748a13578e3e5223fb108034f07914d59ddbeb1796d2dc369cec1701cd5050f33a9b97cfd1cfbde0c5dbda71066efa37e763be07cba086b64f2e2452cd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82b9ac3ff7f9f3389c97b64729defe2f

SHA1
7f95c2a599f1ea3d904c19decd28b9b81a99d814

SHA256
07682473b9cffd7c207d201de2b8e2cddc55dbd466b4ce8aa55c90aabcbdb486

SHA512
1aa77e9660478ae0779861b083092383ee453209518bc508087bee6122230a12dfc5728b6099f352dc75b26b00deafa2a82d7faf9e5c26cb2413dee4b171dbfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a0df282f6b9c0fba691f885e93f27f8

SHA1
f80a27c39e2f6e6634b0ce6b5405cba83e0225ec

SHA256
c5824766d131e7d55d0ed2561930767e2ade915ff9580821ab11a2208f4e62bd

SHA512
accdc29559f0b318803c53dff92c33fefcea91e28a63849e593acc3a6b62097012ba2695b1b3c8fc63694573b2735378194331466eeed32fd87b71117dfd1d3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81a148a39e16989f6f6e3abe18529e98

SHA1
640fef613d57fb1f8b3184127b8afb12d163ea49

SHA256
915d4f9f2c676920521b0fe84d930e25011f63e1cf9536d183aba1fdc60edd75

SHA512
176c5d994fa41ea9ce84432556e7d07a04700056b8300878977d2dd365211c5f12ae874f4f4f57b81bd23eb3f82669599b51883f28a03a57e89c022a3369e7fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd424c3de93f898ab4c20adecdbd3246

SHA1
734a2d41d26889b7aa65bd3792716d5b5d5dc9c8

SHA256
eeeea520d32df048563f4c3105e5951b3d3e0b91b52bac69f67c07bf5da70dea

SHA512
2580eff5c272108c1bfbdc3a96162c712189e1da9b76e6f1e24c395720a1abf707934994145fbaf600b1b17c52b0977d818f6788d119d381065d34a3e1af2f69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbc5fdbe4984cdad0a4e7bf7e135942c

SHA1
ed2c52818606f3254f78fa7c56e09470433df228

SHA256
baa59b66788f928cd445d95c750e945b83bdcc44ddeb3c3f25c4d767064a784f

SHA512
e15e43fafcf246edae0495149c62577acf4edce9bfb9e44d125b1dd2119d833a873afb6a05fcdfb577cf454188164a9bd8306a90c3d8f005f01398b18ff1d08a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54849482349343fa1c2f9c2bfcb47bfe

SHA1
992e5a0939da65dcf92fb68f6e42b065180b0019

SHA256
cf4a57a01b26462d48785dafef22241199dfe012dbc4e72ac61c15b5cf8f4087

SHA512
0d38b1eb9f4f6fca56fb689bcac9b9189c301668b71f512cbd8b8aaea5d9e859504eae559e224b33f57beef7983944f6c74552fb774742ff703b872a13913446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0102a58b8ff887c6ceb971cb7f42004a

SHA1
256b880907f04e98a5b1f4f303bf0059b12b3bf9

SHA256
843be11abd7478b73018bf96223d72d49c1f1662914350f13f1da3d33cfd00e1

SHA512
82b087bd722803cc57a8753fe7cc39b8056f25c26deaf11d9d5b3b4bb849352fd983b93a7aada677bc812b090758e8c1475c01af9ef4c1a0a99f8150d2b5d56e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBF8B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFDC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit