5245decdf590cc2a3cd71fc87fa082397f624bb04177911b8a5c90d29ba5d404

Analysis

max time kernel
117s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3103cc41117500ef8d7fe82ce5f680eb_JaffaCakes118.html
Size

40KB
MD5

3103cc41117500ef8d7fe82ce5f680eb
SHA1

ca7eeaf8ad5777a4ebacb7cdf6e10ac914857f44
SHA256

5245decdf590cc2a3cd71fc87fa082397f624bb04177911b8a5c90d29ba5d404
SHA512

781dae62b077c775ff163f781cbecfb996d05616f973d873c90c317844dc3dbeca6286d3025f38ca9e66bff2cad8d69763ba5c456b6c299af03cf7de0acb5ef1
SSDEEP

384:64DBdiL/937gW4h+XAjp/RW+ujFtFMEFCcNuy41xEuw:RDe/937D4h+XKlnkwcNn41xEp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c6d07c371bdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000ad900aec0227695afbd6c92335903473a25cdbc35fe52b698c9b9205b10373ee000000000e800000000200002000000077914d6a2ad961c3b8d67d5dc665b553aeb204924a6ec5e09ee8cc56f268fe5a900000004e09662da654668ef7105f0b6ede9715cd45913350a8e61f498fd126c47371b34b68877a5d492365414eb38bf815af2446eb85f2cb6221b768f3a20b9fe9b943638c0287957ab193059aa9a8c70e7f9a55ef05bb1b32b662c63adb290cdf0c5e8ab353a322a618db274d8f9d9a7277a9b62110bfceb953e6b8a10571a2ad4aa1fec5ba4bd15186eefcfd2a02e49c297140000000c37218ca3583d62de04946f7ee29f48f7b47cfeace33e39ac5c297413e1dccaa8c9fc2897fa76f1c58708a00d28f0d51ce3eb8b57b74c2419d22d3f9f7e0e837	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98C8FE21-872A-11EF-A76B-E67A421F41DB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000c11ba3a5b2df648bcff128ff5acbb94cac0b2ebbe76cc0d7f457232e89fc9f95000000000e8000000002000020000000406a870769b5621246ff8896c51b01598d5491bd9d334992d6802f3907ddce5a20000000bc5a3e890dafd3cd0192831b1d69bb9de09bb3bc4ba59f300a5e9f00a09a395b400000001857442a4c6a6c43c35828b32a25f145ff367cd48f5f4cc90ccf745f4f1541c358f15bdf4bd2e790f1834bf67ec20c1d47bbb551f882465cce65cbcdb90d8913	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434742161"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2352	1708	iexplore.exe	31
PID 1708 wrote to memory of 2352	1708	iexplore.exe	31
PID 1708 wrote to memory of 2352	1708	iexplore.exe	31
PID 1708 wrote to memory of 2352	1708	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3103cc41117500ef8d7fe82ce5f680eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b6a358ff9e0634e559f62cfbc839fa0b

SHA1
78cfb550900c2edfd883857c3166057e99ab3f5d

SHA256
6aec1f70ca4a8b2548fb4ff9b4625ed67e5b1cbfb0a2455223da443f15018857

SHA512
d09b2d50e20e3fd714660ed7b7aada34f4c69b89a0ad9824ede1613c94fc7df15f25820539d5286eaff5bd0fdcae08e7a54599a608ea200d605728a1e277c277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fd84ff750a5f553fa23f20dc3662acc

SHA1
db00fad830604b62a38cc8112dd7df136971b3a7

SHA256
3664fc9fb4808adbd2d84c6fc452d17e47a994fb7e682fa11e4cccfdf3e89ede

SHA512
ba5b5215b60c3dd34f56b2e85aa63f1aed63df54965ba260728a9b0632f85fc454b947aade70fca9c028ced786e7be58400e94c97ce29adf5bf49c0c0da2887c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
672024b8b22c4dbaa8056d34296b8e01

SHA1
ef18bc4372c95b42d718ffda0728ed4eea475ada

SHA256
2b63b872d2fb8e08355ebba1c4930b4ecf8788a0a4bc4330290ba402e263383f

SHA512
b7752c5a4a9bc47884e15b8c44ad39f2f88fee1190173698110e935ef03e493f2f427144c115f8b6d56f603e025414058d6615c70632e3b10287748b0404ef1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14757272164074d169128e0d2803d001

SHA1
faabf09c2634329d3518057117af5ccf8ebdb0ba

SHA256
49bc1a66b3349cca123cf51f5acf8e9074f140803bfe0004c98936e8a8e1a93f

SHA512
a38bb2e29e52791fea7d9f7c2c9899dec586d276027176966f840c2d807c7bf9eb27378033734f578e9330b5db8ffa6ea9f18564ce5fcfefcdad0f733b8dbb97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7abdf034016fc3bef25b1a977b7c7cdd

SHA1
8ff50a80b9a508561f452c58ad5e2c95840be453

SHA256
950f3cf3f028d2a808095fb16e11792dbd42d33f3aff7d8b9de806f3da4fc7a8

SHA512
859d3f50279435c4ca98dfe8732d26e3aece1d8a9baf98d5d877772972f6554ba4208c51a3768c5294a5fab6fea3c2b4a9aafab596ef4b778074c007b887a46a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a84275e2132a74d4c206bf20c59c317

SHA1
1b02355ddd55a99ddb43fb2bb3eaab7c4fffc3aa

SHA256
63e8a3a5f0821c9033e5118067206bde569cdc73ed280fe7cc2b716521b5395c

SHA512
b898f1f62d650dced50ed67df637e2ada9ca2db6a8805e95cad1426d0b3a4a71246716caa162f6c33a31376b73a0154a2d7f7be07ff95f1da9e843737105f60d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c30005677c51a6ac5e45f6bc5cb68a19

SHA1
111848123575d05e63c6a32a143eb22d56b3e811

SHA256
d42e227f229e4b414fa40ab61862a52c0dee8f99534ec4489c81d220b1522adf

SHA512
3abe5401e282bdc3ab8042c53732a44de973bee5a5219e1e55237e62aa378056aef19422233afc474407ffa9dfb6dded4a2672e327c35000225b56eebe615894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8689c3b007145f21fc18743529a66751

SHA1
e7331633ea93ba1b66044a33df2b477268a53c09

SHA256
03a87dab711abd6f5155145aa3396fcefd9356e2c144c4acbe0298bd4056fd24

SHA512
6691e5e430d901a52425b62cf5fcbba4d5f76a7f106adc2dc9e1c4388bfd0a0da168f89fbfd246111559a5393100a50ef69de8aca81d5c22baae2932f0d34544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f28e066944d8c3962cefc0c9dca92abf

SHA1
5ba2de3626f387b854de6ca2716f3996f8ece6d9

SHA256
8258ffa184d94312f634d21c0a08a4e22e149eb76c3edaa9b28776e170bbc8af

SHA512
24b6f1f7c76a8213497228f72a262c48ef8a92125626b4d72721092adca8588333dac8c48c062534a961ccf030f5e75a85840bd6f2ac5abff52914e6a0358059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe4c88b778cabdf9cac0cbc946dc4fda

SHA1
29d6a771fdbc00753dd3666c6f38946058f6fb94

SHA256
4bbeb18df9c82dbe70c688e1cdcf71556d5401cf660918f2f73b431881c1317c

SHA512
e2496dda6e8e415944acc7b2b8dd05d6e47d0b85540639d1243f5cf09cae3567e137b23d5dae90efc761fd4ae96e542d4fac4b74c7e79ea22bb1f2fbee7f0bdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fbfbf53a1231f5de737b38f4f29cc3e

SHA1
1419978c448647576e1d2b78f9411971cea61557

SHA256
ad12d10a1509e22b16003e01ee5d5d953ba5e38094319165441ba284bc0bb622

SHA512
a9f33ae88bc090a89751d89701140627c2251a2a159bd527bbafe212d6847ca5abb4b3efd5769927b032b0650ca2d278eb20d0f669f671356141c28835476c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43dd7cfb92325e0155a38904219c84f7

SHA1
21d02ef75fa49536ac622ee51653c312fc0c7c4d

SHA256
3e734c2612aff7f5f79ada23122e1c0a583b10a67b7aa7e312fbcd91e8d6484a

SHA512
051b2a6e478567d4ad1ff6ac0db722b855129eeebf3f6b5191fda5256de176a50b6586d9629af19e45351b047f836d4745a128f6799debd929ae7bacb4dff35a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f1a8b07087e4ceec7d6c3a5804ea3a40

SHA1
d39382e1008896a7c3b03e38323cb9e5f7377dc6

SHA256
998c1216140f3f76b358fdf46018815c5d2a5c1b92a193ff66395862fa356785

SHA512
db028b5ccc6b314c02906d6c0647b1e7708b9a75ac04ebd8b3cf6348d35b7ee032575d2dee0399f33dc862ad3eff067aa7144286219494b7baac133908500d46

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFE6D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE9F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit