0d037d066cea471021785187fdad5a22d628bf34fcc44936122f4aa4e54c4d32

Analysis

max time kernel
136s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38edfa97f4b2a52e8dad01af99c22ccc_JaffaCakes118.html
Size

72KB
MD5

38edfa97f4b2a52e8dad01af99c22ccc
SHA1

d60771fbc0185670e71d3effaf5be2fc985d8c38
SHA256

0d037d066cea471021785187fdad5a22d628bf34fcc44936122f4aa4e54c4d32
SHA512

4d5122070631fe56957efee2e0b55a6526c199a8980d77696909388a0e2e6e4911585efc162ba1127397095a80d5e2287caa38158a91a9ad0b9a12b71ffb6da1
SSDEEP

384:S6Jj2Laj5n9V9LlGDzcod6DmRPiyTm4rE8Zn8rfkHycJ/rXdxOgPsN80tzzrw/e+:S6JTj8QoNyvRtrwzV8qR7MdmJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{062086D1-8868-11EF-93A0-E2BC28E7E786} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434878451"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
800	IEXPLORE.EXE
800	IEXPLORE.EXE
800	IEXPLORE.EXE
800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 800	2972	iexplore.exe	31
PID 2972 wrote to memory of 800	2972	iexplore.exe	31
PID 2972 wrote to memory of 800	2972	iexplore.exe	31
PID 2972 wrote to memory of 800	2972	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38edfa97f4b2a52e8dad01af99c22ccc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ebca50a39bd7b4d3025731234e77b9c1

SHA1
332f9391102377d1eb2a4fe95d2aa141cdc5f048

SHA256
f35925adbc2babcaef7911e86959700f5f04fa6e1b80ed00a82e63475a25bc4d

SHA512
38bcb29cc665bb352b847353f843f6a2fe5b68802bcb3bb8eee6a4f35d40bd9886758750210a0fba2205ec6749c42e7478f00ab65ce2bc3c3b8b6433ee16b44b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d28f271c7810d60ed5fe2b3d426759e5

SHA1
f586a15f581ea1f1d77c8f5692053c4db4d7dfed

SHA256
f4c0dda7b5d41847a859cb2b99c24e6dd59768653a9e4cff9b7b75bcc3897e2a

SHA512
d51d61aaf6fdb95b658d298592c8a3ff8560a1e91ae450407d700dfc717ce8966e1e999afbedaef6a2859df62a3e07cf59416fdbbe1b5deccc0c633b55f53c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6bfdee6c190b7a85bc8a556f47ae457

SHA1
3de46e3f5155de4a383c4f2788c9b448e8dd0f95

SHA256
9ac4946a30fcad0a94b819559b4f9a1caef13c31c6f8c5e6ff47734e0a1afeb1

SHA512
1f8c2aaf512ce21816c6c5d2400752c585e3f86bf86bb52d0daa8187ba6568fb54546bc71edf0f8bca5fe84d8722bc80109d55d269a0fa9e98f27bb782ca4e03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e4a4dfddc4afc8aa98b0946c4c8229c

SHA1
7bc55882475ed2afcc709c20fc1b962e561e41b2

SHA256
f701bd008c87c49cc1454f664567da7e2c9cee52df6efc788a166342597ff0c0

SHA512
4a0c29846d6f80e37fa959353132a71413a39f3648ee183b8a9eaff4a87e27b44eb9b95c3ba03636c34bb306ef01880325b51775fc0058ca4c82ad3fe7ceff2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaf0169d32f1b3dc12b52ba48ef1b3c9

SHA1
c69d549f515bb230fc369d728c669840edaf6517

SHA256
97df62cec931fdfb8a1211642bd1d2c0f11c205a1247da22e40199a402e6b0c8

SHA512
15fd5bd5661a7208143816feff793f6d7878c8d2216b9b9174c8740036ca6256aa61857e434659f4e7bcf107ed8095e54de29ded0031cdbdc9a2ce90005bde0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cffbdce872d86b758743f546a5ccf64a

SHA1
1bfdb17ecefbb3baf60f18f49aa83004aae42a48

SHA256
0c774abd7d333133ef2487665051fbc5e0f18db0d65d2caee2bef305a5d260c9

SHA512
a6ec997ef75f1227a62d06c16b0f9746d6d0dcfb34b750b8230cc8c8ce4a4fa9e2b596285b63218ba75f04ed6fd9cf1bcd1090c7ec7b336b7a291d14f5ba9b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2946110007b3921d577240f09d81c93a

SHA1
aacd43bd8d526a7c61ff29df7c8b906578c6958d

SHA256
ba88c7a949259510faa80bde29f0eca6b992a7c7f56cc3ad757627106d3f8e26

SHA512
72a85d056c56f294373af67bdf74274c47f60e9d79f4e561f152c5a357d2c61eb5394133cf2910494166ed4e191f17deb27a39a86ac4bc4b2208d2f6e92f7a8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7871bb434cd3a75d34dd410355f21bd

SHA1
4ce4a94d21e49a084354fe767958eae307583b96

SHA256
566934b79632fb0a510c1e8042d38661d39017481d1f1c884a4dfc254fba7873

SHA512
df517ea7f62523211eedbbc36a94f5f1a3d243baa139edfc2d011ebc8624d44990f40595c2eca911f5f1046898c92c7e3ece06dbdaaf7fdebe645264b25bd538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7da4578b9f0c83dc3ce50ff23a89f4b5

SHA1
9983c723c2fd152f4a78a42141943bb5a1ba357f

SHA256
fc3f4d8488e0339396345bc67275814d53a0539de21c00225702ba8cf43b8a7e

SHA512
9b9e483193299194bc20202942fa97519cfac68c6538a07715737ba6600a03b33b5b22c97eec0ccc7ef6178fb5574dcce0ad691abd73dd91acb818729278b0c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0ab5bee623a966d5e750244a3ddab63

SHA1
ee85cd731b13276c3fc4c34929b8a29c17311ca6

SHA256
d0de318c243bbf77f25547676d33755df7272cbf08ad85e3b35d8fcf6dc212e9

SHA512
094da57c1dc69626b0b5fc1781ab7f5caddbb8469daee0e340974dd1d210c169ea0c5d0d7502a4b41d69696d024ef71615ddb82dfc8a5d062a180504c8b2f4e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f4637cbc31bd7e42913bb2d574ceead

SHA1
d15adac6914c1ac238d7a8104613782efc34eb67

SHA256
9d2fbd11b865dcb62cc11179a12e3193601e3dfedbdb96355abff6b18dee6f39

SHA512
e4436ad3f0e4d48d568341e4d8342bc8ac28642d18f849a728208d3bf5332a11b229352d9ba67332936032ded1e1b29a8c6e4785681fed0095c9d5699de51b6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f28745ddf2e72517f5b8ef992efdd437

SHA1
b7b9867f1e8af76dbe532b86048a8f9eedf31537

SHA256
2298d962e6a3df9566beedff9886cfe7f094754ed8892509a1ce477f2273e484

SHA512
d82c31732f1d825aeb297fcb70de5eb9f5a2cca021dc4277d656867d8aa0417c2f84dc204c3dc2edae4e67215adf07571e878b588484c2d82a6f8a5d611a0a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c856062b9be3aa9d54d77f5f810e5155

SHA1
22caf95bef34bd55a08011e9fde349f056572157

SHA256
d7f2d899107572a65d76139124d612c56fbb1a9846b863f308a99df3e5ba8ff5

SHA512
af919d722b0c57a092949fe1577062bc16ec708a153a22fa5071bea8212c7b2724739464d4bfcc43643fc8600662ef04ae55bfb7e86993d2110f58b697a92e35

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEDDA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEDFC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit