d83d70c48f0a4f4ee30210f3769a5f4fc7841f703ac02d2acd27757d1e104992

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31118d2bedd362e7895f5952736df653_JaffaCakes118.html
Size

141KB
MD5

31118d2bedd362e7895f5952736df653
SHA1

79f87babae0e2c4c69b9f1f8328848c4a038a978
SHA256

d83d70c48f0a4f4ee30210f3769a5f4fc7841f703ac02d2acd27757d1e104992
SHA512

b87b4a512cc7b9bafc41e9c1048a3903307ba023c495690ff55dabfbc7b2b58f2d2ae2441212cb8451742899dcd1e9721ffb9118de39d4a871ec4b4a79f510b0
SSDEEP

3072:S4+nlhjx7dyfkMY+BES09JXAnyrZalI+YQ:S4+lVx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434742887"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{631C2B61-872C-11EF-A364-FA59FB4FA467} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1632	iexplore.exe
1632	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2548	1632	iexplore.exe	30
PID 1632 wrote to memory of 2548	1632	iexplore.exe	30
PID 1632 wrote to memory of 2548	1632	iexplore.exe	30
PID 1632 wrote to memory of 2548	1632	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31118d2bedd362e7895f5952736df653_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f262c3b4edd227f7ac0d63eaf26e022

SHA1
741552bf7946f619734a30b24a032bdff9fb21ff

SHA256
9af40866cec1f2dd82a36bec6aa0372ab07ac6fc8b33463a5a898f4e29f97558

SHA512
a28b3b56b52268f63a0dca93e87667b65ba7874b5905ec97b8675b67586cc2c155fb9850a9192bf26a156b5e5765b83cdc7e0e09d0665a49a88db874a1c4bf41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ade2d4875dc2331896f254e30cc44bb

SHA1
759fb78927aed7a842cf5db1b39a4fc4de68e2fb

SHA256
5dd19f09c06cb9d94079b1edb03f8428d9ee703aa76b13fef1b039268c5f0eef

SHA512
6b6d0c59f1ae63d8f339673a61f198124220cf71e05bf1196648494c48fe5b9792c7aad7d899f06325917b870a50ea42647a7b09a909b253fc3f098dec01b253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80ef7bf06f9cbd144a42a3a5ea571eda

SHA1
4c4f4f34e218698dc17b4e82d606be1b8bfa6633

SHA256
b5e760aba47abc13a021434a9870209ae344e975557d28d65110476291345436

SHA512
43056abdaf41f1628e30528c1c0ba68c2df4be003277bd1c8afbfafc734c58e7203ea50886e3a171fbee70b2a6dd1057b3f013171018e13e93b04d5ae2557f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
518559286427f07ade6aa18d78e7b4ef

SHA1
e9c73dc369e37daf56357c3fc40f8b2921e91ca7

SHA256
052309edd1345f6200c03fb285cbad81c0853d631970f0946842e3d61c72c630

SHA512
ed0f350aa4fbcabb063619c85e8492bdff8433087b3a77351839b3ecc2cc98b24b9bd8c4d4041525f2e3a38d49bc50b363772d729695586996f5dc2cf7b0d1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61f571e466ce98ee1d04bbd389a0d059

SHA1
2d462b1f1feb92720afdb26a1ce2d6b95aa19be6

SHA256
38f6a8052cbb3b16c2c1ea2b1d6ea1e4edb31015aa515a9b3e525f75650f5f3d

SHA512
852054a4cdb20a840bb12bcd20c9b25a851c6b7bb3a71fcd794a42e3ed8622f55a43bb3b6c1763ca2eaf061b9128d953b3f92db9254eb68a356696f044a8a61b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c9487e798fa7e5e371d3b86df360291

SHA1
caf36de3f0a8d800141e1827d4da6dec1fea5801

SHA256
a56b2a34e7b1ee64a60b99ab2d781f7b1627c340bcd971f0eedbbbf8e03cb9f7

SHA512
cb732b09c23fe06d643f0136985e6a1dfd39c3b489364c34a635e7aaba774b624abf65c50b54c54c8edc6acefc9f7867ccded4f71f9242e4603cbeffaa2d2e24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c6e5d56e9de5e0af83f20c7d46d0ec6

SHA1
7f8da43276bc9051b6a74325106d0f62dc07c10c

SHA256
45022430ee3dbb2f0be2dcafe505c9343d01271e61fcfb0d65ee77d0dfab5600

SHA512
71a7312baa97aebfc1537b4f1bb18788a54bd9a764b701d077ba5c77897cb8742d05f85a538f50c922f427019c0a53177315c5c29d8adc3159840ef2f385304d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6300a6f1fb9d7dc8186638aa8b05dc6d

SHA1
aaead09a3a74b053887d3ea4e0ee6d1fad7935ed

SHA256
e1e5d86cab314610a01dd2847e9a2ce21aa48ed88d70afaca46f5b1f9a09a5be

SHA512
00a359a54a6d6184dd67b2af0bc88d32700d97eacd053e59336737e8df964f76325cb8200bcb473c0dee4b53f5ae07bbad2d3fbe29bb63b8cd2f135dfe3ef5f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45a1008f86d18668efb5a1cb77b90659

SHA1
e72f927030d1cbd7d3067635c131be3e50e1c08a

SHA256
3cca6ff14a3e0da19cfa7cfd1fc7b094a0d5ffa300e1e05fc6fcb06ad632dd60

SHA512
51451f240dfccd16882500bccb6cd28b44cb5c65a1f4d2234ac5390cef0a7cd2fdc2fd9a9407336968e36bdec142cb44628de3a34e332bbb99ac0be0c9a69543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaf0e68ce2fffa30048ef7e308afb9c5

SHA1
f47f5fef932bd5afd2f22be48b4c31c9ac94f6d9

SHA256
f226e74950ce82d3b1e943fac0f62b78bdf978caa5fd57e12d2f1fd8d1b5e676

SHA512
e74cfa246789190543b10816ef4c22e3be19001846a0ea4526fbcf629b42b5876c36ae1159cdd74f4a9f5d4a7895adb99b1c67ed3b16ad8df089ab18a93b8a3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78c2d373c957a7bd4d923bab33fd4dff

SHA1
2e49ccfffe9d28fcb64fec0da0dcc7cc67139ad3

SHA256
77de9eb8fdf2a408e5dd6e6d0a768ac144f520ccd524f92b6fa32195cc7354b7

SHA512
3edad553551112b5f11f6c1bf49f25c6f0d69381b0eb0643308c8db41137260d141a2feeeb071f019b952bbbd4813325836dca6deabb43357ad9ec54bcda7e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF91.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB032.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit