252f6f81198d92c9064522d5a86ba9153bb419b7770ce895d7fb3a0a8e801a82

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3088b4bd13e973a321863fac3651d303_JaffaCakes118.html
Size

56KB
MD5

3088b4bd13e973a321863fac3651d303
SHA1

464f84fd29a16de7cbd5926e942e6df9cba31906
SHA256

252f6f81198d92c9064522d5a86ba9153bb419b7770ce895d7fb3a0a8e801a82
SHA512

cdc24900292e2cd4884f903a05cfabd0cb2fb366988743e9906e61316adf2294d5bb493f413ba6698e148f5d6a354b77f08bb8a28dce32c3b17b63ff307f9007
SSDEEP

1536:yVyPd0FQ9tg8nxr8gFef1rtjkWw35nkxSVE1iFBYHcM9p2ahAF3/k8lK/LtTQ:0yPdRn+ai1r6Ww35kxWSuC8M02kvblem

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434735137"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58568F71-871A-11EF-A528-527E38F5B48B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2824	2232	iexplore.exe	30
PID 2232 wrote to memory of 2824	2232	iexplore.exe	30
PID 2232 wrote to memory of 2824	2232	iexplore.exe	30
PID 2232 wrote to memory of 2824	2232	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3088b4bd13e973a321863fac3651d303_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e159f6df80692259ed36e02fd531d87d

SHA1
9054ee40ff93fd9c2d309edfcdfe3e00b3238ee3

SHA256
6f21341e88a7b6010c26065e7ff258e1edd77eefcacdcb2f647bb8cabd483067

SHA512
d77dab4ce3c420511630c3473cd898e072e38190c5b40b17a9371b68c616177a9be96920219d7e9524dd0ae63deb4b5fbf2f4bfb68bc0133b8e3c783ca70c357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebe51eaaf8486abe6cff7d2faba0bb30

SHA1
8d792d4addd5525d0d08f99633dd1868d749ace2

SHA256
5e11a9a5b00e8502df642f93e8263380c32e68b8789f4651e407dbdbf6d5076c

SHA512
2036777473faff1e71d3e80d44bf1f92f0d295996e3df9e97d2ad855e29f19a9cd46790c59f919615b2ea81161b8cd53b06c85022e70717e399ece518992df60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cb54fc344c66cb6f570a41e3c68cf1e

SHA1
56a00c78ae96fc7a166fabb7fdf3f615e64c9af5

SHA256
61346984c19c06b28ce6fda186f617add1f05387606839cf78c85c2822fe970c

SHA512
0851f4fa872c053b4aed13427ae692405208643a107332fd557a519ffd0ade5bbb561e7f2b4aebbe7006b5f08a1ad83b844324173193687144317def0bbaecc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0c8c20f8b2b6ea4942c6548f61dd030

SHA1
c34f9d403e97a5c4cae3e03f9c80301bf853fdd7

SHA256
166024fd2a9ffbfda8e3bf5cd552fdf3f0c48df80396d38bffcbaf411072729d

SHA512
a30eb451e522a510360893052f25faa83811c79e6b1e3fb785453bef0be5e0277e8fa3c4c9ddb63764c63b4872633a69e95bff4a8b79802d0f51c5d6f5cd175b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b374580a00ad0bbd822ea211472db35

SHA1
f3547a368fcf3415b4d659c55a3ffd5596040465

SHA256
001f49bc61e60da4b25cc858c17ea8171358472af6d2c32491744f4a088011d6

SHA512
1cd177badb509e6d63bf7081a419c1f1eb57b8647745510ff5c30281a260b980a31bf268152d2e758b392d5d7e1a478277626230aa9ad0e7a65c008dd0a3df2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39b7c30e1af0c3677cce7ef1042da8aa

SHA1
d13ac67934ac549d8ecba8676ea1d4fa6392d418

SHA256
c8dd8a578f78c47515d469bd60e676d1709f479931d5772273b17ff97e55039e

SHA512
e59b57da2134844d2358bbccd11feb4ade756ef59bf2eaa0ecfd20ed3794d6854a85af9ac0ed39e29a9eb69f257519c555edd98e76bedbc2895e18df0b1e6e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2b37c6126023ab2ee869183c314615a

SHA1
49ae9e6db0fa1064b8515397f329e59778311e4f

SHA256
020fbe54c6fa4b997077497e91aa95d6328dea632d516eb3bba9c44bd1798d20

SHA512
75a3637a3f4646600f89f1a82ee4a998a54b877c87f7fdbad9262583f4b8f3d1e589d2c586907ac925791a12a5da7b36c1ab2de93f8b058315d69eb4695dc5f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3c300945938d811b1c070e6c547c587

SHA1
56ffd105f38e3b7f1accd1b691d53af0f63c1abf

SHA256
88ea58cf47bf8fee520f2aa32d5035178893561b8c03c9fc9149d165dcc24d04

SHA512
cbfd67ef9161f24a0abd8734fab281b333ca515d80bf0ea7e388646d842a318c497f612b5c8a154422731697c78e35f111a36a74f98edddca163051013ae93dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a0243616df07bdeef7c22505ce2fbd7

SHA1
cf8d42fd6caf33ddbaca79dfa45f49859b0d4742

SHA256
6c60603d76c6b181c3005e59ba925dd53133863f5f590b9b487287999b4093ad

SHA512
80c429846de4eb6b77036b935f11d3abebfc22620beaba577b9568bf96bb45deb0e586f2bd78a1f65ef507359f38b32bd887b13730a5b66df44052bbab7452c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dfa353e6046466d6995a95df1e3cb22

SHA1
ecd697a9706a895cc9c7091bba2fc4651d538412

SHA256
bae08d845406691fff4d9433b50799f50449cd37aea17be1c0d89dcb2d4aec6e

SHA512
a59e2beaf796907e5b3d1c52f62e08d3eda24034ab2ee002aeabc2b4234ab25007be1d9229793176bab3a73a2b57849adeb2bf36ab0cd50a1bcfb1ab47d9e16b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09ccfd29e7786c8698a368b1c21469f8

SHA1
98cbf40a2812fd8aed20279f946c3e1dd456f137

SHA256
46b1bbf508e20fb1a17ac85bb273516613fbc7bfaa28610ed3e8d78bd9d49e33

SHA512
2f446de393c7978cb6d09447025d2707f7ffbe0b54f32f110aa6aff096705b4951c80311d1016213326250d1f61ee7686d6a51308df0b2be11b3bf16ce6585c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e268051b8fd050966f5f8c2c8fab4083

SHA1
0246f69e159f4bfbb367864c62e4ecae3bfcb366

SHA256
5190233c9e526caf170cab9517c8b3641f8d52a687b5c791f6657fcf634834d3

SHA512
6d4da67cec644030f1e67c460057eda4b350eaf0adc06730a397c8d6bd30d63aa2b1e57c7cd0df6bf85edff677d1ad95fd6517e700ddb5a9b1d4c0585d57bf02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7530.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7542.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit