8b21be11c86d811231b10b9962067ab1b199b34722656bb943e9da8e94e6cdc6

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/10/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

369c400c144ee173475fa1d6ca9ee095_JaffaCakes118.html
Size

11KB
MD5

369c400c144ee173475fa1d6ca9ee095
SHA1

9f4bfed410ca4dce08ab519dbbaeb35c653f1ed1
SHA256

8b21be11c86d811231b10b9962067ab1b199b34722656bb943e9da8e94e6cdc6
SHA512

876bade1d5c3b904533a5cd43857d12023932607e89fc207d47c84a926e567cd9c9a7eaef82d84aa038650869b28bc774739ec009c16f88de1fac805ea16eea0
SSDEEP

192:SIwc1Oo1cBgBC5N9DaqqCaThyCaqr34b47FQ+cHg7CPbSvHSHTslC/:SIigsN97wThjr34My1g7QWvy+C/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000a5d01876e99a7bdfee12ba619b3aae73e9dcf276a0df7a4dc9e4a07afa84e8a9000000000e80000000020000200000003fe57bfd6667aceb331f90e3336a675cb7a1f03c05fbc4d7920506e296e534bf200000007fcd2120f52d4ae932a7e13af8e59e99a8aedbc81d8cecd91b4ef7fbb81090bb400000005c61f08595f5c6b3a199be305590c5171d949ee5607ee0a7aa8918abc6ffb2fc7746d0e565cb117c66ab2086e86970d6bfcc169ae23e108c4867fc087d81a4f7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000001bdfcd4296a268ea35aa22f8b6a9e6e9e32828ce869515d36fcae07afd1b48c5000000000e8000000002000020000000ed72b25c55bcfd203d52307f36b4ca0da2f59dcabaec9f4494402dc4c7008b0390000000e8a6ddec6b207063ce8c640a79acf19bbdcd7e3fe7c539dc49d39bbbf61187e3cdc7fa1b8796adb4462cf982e4bfa2a50709a9e949d97fb963e5890450324b0e014ada24188b11f9a05d40a2a8d51077052dbfef09b4e154a995f071794d5549a312a9b5b355c463b3a9ee1105e9a9c9464b6c5e52d267250255755950d5e15b16775844dae1b321c1e6a21576bd0f0540000000232407ec8e38b4a82fdfe600940e94cc1eee9afb9457dc9cb74843a21afb40197764deb242ca749ec5472dedc24478822a68dc8312728b4914f5b079624ec693	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D03E0E1-880D-11EF-ABFC-465533733A50} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004030041a1cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434839434"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2804	2176	iexplore.exe	30
PID 2176 wrote to memory of 2804	2176	iexplore.exe	30
PID 2176 wrote to memory of 2804	2176	iexplore.exe	30
PID 2176 wrote to memory of 2804	2176	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\369c400c144ee173475fa1d6ca9ee095_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ab72b59b47f8256d33d572e05c9219e

SHA1
029683fbc4ee2b485cd40e689698c7d17e440a06

SHA256
863a87de9a795fb25eef65710220f0c5d27ae0758d9a4365a1c09e642b6398dd

SHA512
5b7a7fbfd95bfb5891796ea465e7530e7e97d3be19e085cbc94e6770cd69097b943dac33fe4f2fc5f4f3883398db21c37797de13d6cb789955aa661f216bc029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1b7f584107114e532a84c4b7fe5e8d2

SHA1
6f0e35af3de5048fdd4af9a0f3d09b3bcc31bfe0

SHA256
56eb25114d0b83122aa968cdda0a61f568ae148b0510f4e864e24fb587935443

SHA512
3faa5c2bc8421719c31030fc13b6858c81d86d0e370b727b3dfa58fa9aebc94397a88a6533321ca569cc5e7d78ad73143d529dbdd312cbd652da3b47206b0e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30bc13a573b909d0e42d94ff3efaf153

SHA1
4c315ed05c03ba5bdc5f03462742176ea26912da

SHA256
ce5f1a9119ba459333cda0954f03f90a56e63dd1f36eff402657c7a6068d04fe

SHA512
9e21e29b81a8ba3ffd46bf512af6ab8d2127520bc10c4f593f205562937c8a701c8537206f29760e636db61b4045dba02b66c0ec95c609d3c9ed92a196c7ffd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8da13c2dc17f3f9d0a05c2d13a217be4

SHA1
d44d3eb32290124ece0c29f19ff5ec8fbe65974b

SHA256
36126a3226626b0336e2e87084b71fbdc7f4ab3acd682d87e4c77dc70cd03a62

SHA512
82b4e78c7a8d73bdf00d2fa93c3c80cbdc2a43ba8f81758d214a83217f2bf5e4e38aeef0f923cd9ee7895d2953e37510622984b49205f219387dd1a327452697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98c6d677a5e5c1ece98688e5b8882747

SHA1
8d904b6feb04e70b73c17dc21113820ee86cb0a6

SHA256
47cbfbe75305fbe6686a849dee27cd9dd901956649d49d008a289d0a8d143197

SHA512
d7d3a01e768767035a03dc469399634c47ee404e8aeb89ff39534117750c1b3695af94af929c6de0e8cc66c7ec3aebc5e8268eb8d8bd17f645c8a731ce7aba1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
265828fb1a7759c1c7895346a87b4c18

SHA1
d75d43de9ae15d272db3ff78b612699d4901480e

SHA256
7be47bd5de0b7c0c500ef33e63ff7d4497553308e4aa014d9d2a328b0683f358

SHA512
575d8df9a4fa7702910faefc83f0a11fdcf1d76b3ea7fc51530284c165706090e2bfa37c826f48e9146a149be202ea6007bcffc33fc404590a4a199a9270e472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adc8acb24d94561c04bd64f71beb5818

SHA1
df3c634e4644855f26e5298ed32c1114c8983468

SHA256
fc8cac9fcb9de3c4e2f4e9eae4f4a0cbe67271a0322dbf29d20bc0c3eca15380

SHA512
568a2c3dc6020b36b03d93f86f33b37b2c1cea2f7abbe4c77ac3a26a76d69b27e9f45c7fd9f57b191750c681eaf9e2a3b31f3a5dba85badd0e2a2575f2efa311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58f21431dbe1cd2a6b8d5072de3644c5

SHA1
d4f0e43974217cd5b5d111a2b22b18c656747df1

SHA256
68cc20cbca23e9dbd757528e1b718ad0b06bd904a7d5c169c740b4fc52d45d48

SHA512
e66f5c4ea68d00eaad535dd0ff7b86bcdafc3e317c32c234486a505ad375f9be5fe9cd6736dce3a312b3eccc90c47e8b94f990737a1ea210b9a419ca41c1a1ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa27f47ad207f15d53e527ef096a1340

SHA1
2a09bd60f51537a530bb3e6fab700627d892bf5e

SHA256
af8f8458d6831f5734620ef7d96957563d1bfefc99acaff3b9f5e06240f88149

SHA512
93430e80440e651a58f5e7d61596041a66d5e73d3ceed46b028983947fc3943bae1b2446d448228dec307423a6e0ae150486ef8b7c73a14214b1a93ab667034f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ca96adeea24831cb42ebb19e7cc09cf

SHA1
bcc6499c1516f565aa62d8c48d78d302699f1856

SHA256
bec16229a1d1fc08149cca73d687a4cfe354e116aef028cfd0f6619ef13f5ac9

SHA512
3e0b0e8a781dd3d65a723f4daf80a21964a1305577affd2522c8defc0762623a3d7bf8836b76b1392aac1d109c9c6202aa1f02da84becec66be8d9103279f88d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
208be31c9cd0b456e57ee324b9d125c7

SHA1
f839ad125a68681d9c1814969ccc5f2d5658e355

SHA256
c4b048cf81989d93cde9bcd941f7c91446b5ce190ac2a0c19c0c385d08c9f315

SHA512
2ae69711927fdc3735c67bb81c1ebfef0fd20534dcac1f27279f7b836fe66911ab66c2c7c2605678fc4b85566033a9b4b5805057780a380e0584484e8513152c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dd5c1733fa1ce9f2b943e911612e521

SHA1
1c215b1803d8fb0831b562237e88547a869bf10d

SHA256
c8c26d71ba97d6f0bc3810eca7d8826275ded0b771b528c5caf2af8c635377d3

SHA512
cd7125384f9568e172d53ee079f5c5c8aefd2ee61ba7a820920a951189cbd473c210502dbc5fa81928b17d87af4c6465e25f74119f55ebcc2beb1b006d493f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6970.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit