8dc49ac1f783576ae0d12797bf54a25cf909a0d6ea7372793af1347ceb5a14fb

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30663ca7076d70fdff7610e3a57b5b87_JaffaCakes118.html
Size

38KB
MD5

30663ca7076d70fdff7610e3a57b5b87
SHA1

e7501a421fd26cf71a1a773c7d69421b68f59ed5
SHA256

8dc49ac1f783576ae0d12797bf54a25cf909a0d6ea7372793af1347ceb5a14fb
SHA512

218db2a01967b74422b1df3a8e3732761325b40353f17743a03f7f8908fa7b0ccf7ed699a43dafc4c5e00d9ea6f2016f0e5754aa9d276d501b657ad9c91f02fa
SSDEEP

768:Sstr6Dn+Qeodhkx0JWGrZvQgvsGsyaxk/m+taa9vI9l4:Sstseodhkx0JWGrZvQgvsGsyax2faa9f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434733177"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8ADC8B1-8715-11EF-926E-C6DA928D33CD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2436	3028	iexplore.exe	30
PID 3028 wrote to memory of 2436	3028	iexplore.exe	30
PID 3028 wrote to memory of 2436	3028	iexplore.exe	30
PID 3028 wrote to memory of 2436	3028	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30663ca7076d70fdff7610e3a57b5b87_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
363f8b0a538b49b258603ec82457a26c

SHA1
72646a725fd2e8b29a67d67af762dc50a68db300

SHA256
8904ed30be15da6224abb69669dce2c00a5f05c9312d51c030475ca3556e5d24

SHA512
ffa0a18288681f75817fe3c82ca22ac60739f848b037b97fb971573a27dd6e74371b72a83d076106383854e04765dfd5329a9621678ee912973db8f583635c49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e66f8ccdfc93059ffa29b429f71e6e5c

SHA1
4373d8f016b73bb5a5f91c4aa17e4ef24ba36bec

SHA256
cbc426cedff16d120f727c1c44b2815a4bee8f307a5dab7a1b792fc9aeaba830

SHA512
1fbd6de91db7759f1c96239df978f716ee01e291ab0179de087202d8b1b3c851c09d514897f398d13b47e085c3fb8b322745359a2e239ae1100dffeb4faeaa0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28bfae49d45c45f8e44b788bd42df838

SHA1
e3bb7b2e0e2d1a0fbc9fa210d6e4ee70ce6733f5

SHA256
db0c59682c9b78cc22cd5a97c0025b071c58afafbe30ae49ebddc2a0310e29b6

SHA512
7b22a09181e339dab82f22f51adb2f36b4471905a146fc3137842e9694b6dc09af95f11b2b54c4d070ce6fbac1f9c1d47e9e88d34e4a48676d06b3693abcc26c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8336304bc17ca65994566cb83c243e1

SHA1
c8cbd32438974cd242d62ae2dc70dc2f9cd4d104

SHA256
59cab2745fbdd54525e158764d2f6ba5ae9ec3d8a4e6ff158a2233f69f961c79

SHA512
ef1f8b87fa936b13c8b55e96d098bdd8d0a6990fbe03c7f68ce9a7cf84d752af3062cb47ef87d8554e29d570b8506f5fe69e75ff14781193e8ff9fcfe4950125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00ffe960615e4613874f6dc034292e20

SHA1
8bbeebb8785ebd162872497ad214c8a094eafa70

SHA256
899afd620b4cb3bc9c54b20d1034c69c025aef2e81b2a0f40e27d4f0a28ddbf2

SHA512
8fb3809c0f479e855a75eb27f0a6a10ca01a875ab7eb3ca696e8edc6c5c1d31246593e13b2b5dcb3d9a18f0fc26ea33dcf41d6642fda5485be75696fbdb1c0a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
724cd769e11f27274211fa782301cb6c

SHA1
1a3dcc3501de344cd7665c507ab1e80e13b2b08e

SHA256
95e00a75ff4773a9c1d8a5ca9414986d7c592f7cbf284a77615a750940a9302b

SHA512
5ec6ceb55737ffb26d2e119eab8444ddd712215d6e26b29ce4e2230ee84c22705496dc007dd8e7b07b2aa3662cb3b4e1062e93d58f24eb492841503282205fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43abcd367726b767f27a7c3476f7d61b

SHA1
0fc103257830c2ad508d9b6c34c1008b42d883ac

SHA256
d2340a459b06bd65e8deee993d07e79288fa8ac1c426699ec24e8205d3fe21bf

SHA512
d7bdbb1b671eea7ff71dca2f95f633772508aa64d5ed23459cb73025d38bcb97d0b279d5827043d72970b21ad9b90f5e930cd834bf2ae04deaaabee0377a9be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28d7feccae750035c42db740bcf7092e

SHA1
ca785b40767b8b9aa8a9bc103e409cd21f0e26eb

SHA256
0b885afadd990808a98635f1753a9567caed79e0c79c78f84b5f80fa8c4dec61

SHA512
9b79a04c81eaed08d009f362768a14ecc80fa055f4985f1a5ac90b5f15b1e4f7c6c95c69c7d556c24fac5e1a30b34c17fff161552d8442af245d3f987efcba3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4c7806cb61346efcb1284e48eb21ef8

SHA1
8e8a71e59278fe58ae1e0b13877ec756e465e1b5

SHA256
e79a44b1b08ad5194381bd08db1e30755a8cae1df493ae93e5352c67bdd1267e

SHA512
f56e16989402088db0c91c3fe8b2cee86f3ad84bb51d82689ffc439de209fdc59c1502e509e363ab2585b7006a78573fda0f3b702165eb8452687f635622fb63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
913521513a8b2bac28abd71ff75b8540

SHA1
f934da9f6e54f8399e9f331accd747ecd2a94224

SHA256
ff5b10fbf71e071e33953708e73b4e9a40f4fecba74e7d5fe3c6ac2d7b6b9107

SHA512
1df0c2dfcdc8a5838109c1c44a00a7f2e79b307fd5297d23c48f8d7bba4d5d33a9cf90ac320a35ad96cad48e76b7713c723b44271288816f21598469e91317c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8069eb9aa66e17141e15fe85cf894362

SHA1
44fb582314cba3ff602d1589a3152a9c4cfe0be3

SHA256
cf8f0e34941b579702bcb70e44dbda6b4a30de869d33bf8367a3b3c11d34fa35

SHA512
63ce18ac82d0f1fe926e2f2bdbd74bc39fef230bdcb0c2d2b798eb18d777e7086cc6898a5872860ff9c05ddee4285393b7d074f896d36fa8ced5379e16a43988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
554e59855e86a1d65d607f3488e0b41c

SHA1
13c7172ef745f8fd56ab27844d83eb9fb63d8e11

SHA256
e5baf04a42ef028989e3f87187786232e93ca8a085f0e29a196e3f7184e2be92

SHA512
1318632a90405cebf3ee9b7897a55bd786a2ce29571801e49ae3ac2e32d88c36efecb1006a14dfcedf55df176cf16972566e56afa9ac00b9ee01612e39859d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7E92.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7EA5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit