9e796b7251875eae6732e70b37e47844b4b4c76bbffd76318ef35c5557551fdc

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3886211a2e971ae116a90c47c4b60590_JaffaCakes118.html
Size

142KB
MD5

3886211a2e971ae116a90c47c4b60590
SHA1

3fb72429f7d28a805e890e3f876e3bf52fc2704e
SHA256

9e796b7251875eae6732e70b37e47844b4b4c76bbffd76318ef35c5557551fdc
SHA512

cd2322f3b1eb79b83efb87eefd9f360cce1a0330e6bdda68412db04473400743764abdd04bf0a4b097447d8e91d9fef2daae2bf4ccd86b03a9ece161c72380a7
SSDEEP

1536:SIHKh3PKjx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SDPAx7dyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434871306"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6369D821-8857-11EF-A6BD-E67A421F41DB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE
1864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 1864	2340	iexplore.exe	30
PID 2340 wrote to memory of 1864	2340	iexplore.exe	30
PID 2340 wrote to memory of 1864	2340	iexplore.exe	30
PID 2340 wrote to memory of 1864	2340	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3886211a2e971ae116a90c47c4b60590_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbd53fd42259f3afdd4f9483d84bc965

SHA1
b8bdee40b948e5b86d5f4375d4f8a3fb57ff0f55

SHA256
f47028986e7c4ee1f7f834d0570e0a9a161ba11fcf7991cd68d379b2a039011c

SHA512
85f7b21e847d75f1808dc95f42c726b65764725b108acc419c4b3c724cb5cd5919f602b9f54b0b09c23ddf61b2253303e89d6f654e2d05adaa758cfa5d273d4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b68618609761a4beec1bcdf0ab6240e

SHA1
43d62435c23d0105e71867ecc581d8cc7496ac69

SHA256
5786bb2d1d48b4a355cdb480c9a6599d3472b8085a50b33249078e3217a0f118

SHA512
0fe8030e00812c84d858b9ce2522e4db9fce3bcb0aa80669ad83df2659d37527de73a5dda969892c79b0273498e3a86a7b9b388a849db677cf4764c2dec61e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e19534edd43a5f6bf03dd1dfebd03890

SHA1
56654edd4146f7296aa49ab41d3856d852e14512

SHA256
b9a671d087bb779ca43668703c76fe2f0e2c06918ef55eadbca3468de8fcaf13

SHA512
5973a3b1cfd30e6e921535ab8f05e9932d168e71e56dcca51efa26ea7c649dd67f94213e57cb28ad13c6e1599be1a82818f66e988cd4fc55458a25b6b38f1c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18caa9eac8d5ddb223e3daf5d1c49bca

SHA1
7e7dce16222a6457d2a89e2018d5c2df96a05b34

SHA256
f0fccfa9adf8a2ac7171a4de7b94d1a84cea71bf46fe6c1ab8806df5e46ae7ec

SHA512
7513ab054e04d70da45a1da56b3c090c854a46f723b1580dcd186402d34d3d2d4800cfca91c6f33bf164e9015ed627034912526be7142c775d6879586215b2c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94353aba0a95775a20705955cfcb5edf

SHA1
a4353c70b3d610c2b444e21f8927db218b4de9cb

SHA256
2abe06c0b103fef17444e4e4e5692efde685319330f92b97749f50bbf8dc26e6

SHA512
18607e667ba29a620b43c8a232bb37212d2e7ba6e0a86673bef4ee7dd8d27091e722c7ebd7ff888df1c505132496319f3602668a6e7fb6ce55767b5ee897a4f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35ca71151bcb992587941aa270af3b0b

SHA1
0cf4f032f9b17dabe2e918fcf46f2e0a13a01049

SHA256
b183dacfd275422d8959cc08e1f51485188adead06e5c85539459244e8ec5b23

SHA512
97165f0c2fb90611cb5fdcbcf614181d16fc85fda9afd18cf35cb680b677edf0cacfab2274654c55293ce4e8572e271482dc8dca3d9b02037989c1a0d9e0e877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a09c7ac1ad49eab1a08833d2ccc608b2

SHA1
b691878cb5821998c61b0b799f2736bc0d0c866e

SHA256
1047438b9193e976178845399cd87ff8b7b20091b6aeca807c4d183c70260cbf

SHA512
e92daac256f504501ed274bb2b4e5295cf6bbd4a5341b959e08c09d3fc48738615ac938118ceec6a0d311d8acdb40045167911f535eda33c5f9a7ae44c2148f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d3f7df0ee90a83dabacb546262e821a

SHA1
caeb1d2ccb3c0797b32a484b07be8702473c2817

SHA256
3f3392c3b9179db82081bb09d173d34b5755f818f94e58ffa7f497c4bb299347

SHA512
67a8dab9d82924dbd6639e98360025b6ab871cb6f86bc1934df8946aaa29fd8820127ba838d906c0eb3944a8d17583f01dfad362226030b1f77b77cb2f16336b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52ae3898890a0b5ff1393b8539957abe

SHA1
556fc2a1ea49658730c23ce8b8915bf8226b6097

SHA256
815f74cbe19cf1f8b0d80fd4b38e301b4e64674bcf1274af69f379ef5070bf30

SHA512
334c4df1744374b3c2eac986b259e5cee119e43aa84343501af91984f96fb8b8ee47ad21369aaf2eb3818959b36cf02175478cfdf264fd806bf58006df8c193a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1789cf5a10228e006342e02f22ff852a

SHA1
8dad1a89e4256c2d70c143e8899d729480e57a32

SHA256
8b78e13b58541d154556c7e3ebbf434d955874971eee8823b429a05c39b3addd

SHA512
1aaf239d5463557833832abf3373b4cf3f95987bf73eb2f2cc61e9854bfb059d2af83d157236cac8491311d51f80d363fe2f7ecf019489121240111bc246ab23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d206b5d8b1a1caccb94729fd8cf0bd5

SHA1
407ff3468328bfd2dd9318adfd056a6aedb57d69

SHA256
d8cdf500865b771d30bcdbb5dacef1ef6ff85734b066c13ed90ac33cf7e7c7d9

SHA512
040bd91cf715a17d1031405e58f63fa28cb117004cb10977b417f6a3d8b51fe39458d8e575b378e05049962e2a9c7e78212643161864633bca4e8344ecbd5b65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1dc30fd48a03a74d5b2d801374a6738

SHA1
c1ac269ec46fc4c209e9af08e396f3faee9119fe

SHA256
f85e4a31ad7501837e7e350213080ba7dfd22cd57ac5f7ea41b24b58014961e6

SHA512
9c3491b740d381d55e498083db74dfa4bd9dc1e28a381db55c34d15dcba44859660355902cfbdb3372f4439c0af8f8a47b22fa438dec5075e0904781ac32d745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c0eaea3d4c84c29f8d9bcae3fe7257e

SHA1
ff655d72674f1ef3e048beb10c9e0af51e1105de

SHA256
f8a7f60207bc01619e6a63adb9b7da49c8ee4056f424c4fcc293c6c5a3e309a7

SHA512
2da56eb6889970a929179e355899d91bbdd04ba3db095fba433a377748de14c325fb689f426b2ff0776606ebff44cf66d25ae4215582958df2491d4318ef1483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4274fa9f0ebb46cf67670cd57a21db7

SHA1
0bafe599fb374c158535f6339d9f0a5e4ebc75a1

SHA256
f80112f519a560ac5a5d61ec54b6ba0213f97b4a9194cd93794c476a1ff14ea9

SHA512
ba984e72549d4ae0c47d52127058702bef4f1881acc02a01f45e79680d49df46cce70442e4fcb0719d82c16ccdf8d297f193c5cbc8534bea86f7f0a747e7b3f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d30db42702cd579ddaf000930667c483

SHA1
566e1cc7891bdfac017a92ce7b9c30950627c6fc

SHA256
6bd4da3287931f2c0d5a316b57d1d7277d404531dd8e66d1e1a26d4fce9b9c0a

SHA512
6717fee8dd3c1bd989a6adb99ac3645f0eaa1d0b6cfe5ee96917fb6d529a88a988db4a7a152626207f8e11083d85dafd403a73068c9a0cf8276dc71b067ca9a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b86959e029def1d3767260e805c50d55

SHA1
9e7f11c4af497e043df7a44d8d4630e04c064b2e

SHA256
462777a0bf53f884ad8077d5c570dfb624ccb546245b7ad74d053d6d946e9dcb

SHA512
eea60b531275f88a4e9427d25fbc826570b9ebdc0da2e6758be21d686590584f66b53030ac7b215e83e88ddc0bf96cb3eb9a6b89e81d82f555892e900b061269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d1cd61e35a850faf38a5bfd2eeb9b20

SHA1
a7c5b8ead4df853fa9a026852a849be6a2b7902c

SHA256
e9d09e0b192b41144a6da01b1668662f9e4a6c7c3f5534724d506d5d98eff217

SHA512
0ef57998fc41bc263c2810671f16232d56b1905e85b5608ba266c0de84090ac4f2f3812244c744b837c980269ef1de7a522834b68887fe75f0bbf9682dd42fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9efd11a6bd73b1bef87fba1bede4e188

SHA1
f7517355829823becb78a8b7cc07fed018ed096e

SHA256
5cd86917aedf4e2dc2ed692c7fc87ff09a32c35e17b123bb215546ed697092f2

SHA512
541f16b3414fd85ede57a9e5e1080115b8a353c3bff8f9bd1b271b7a06f86f24c1c1eaa97b76d519b6beb0fe8146b4b5b8746bd274e3b4f8a5531f59f5bc8139

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F4F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7FEE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit