ca6a4fc80124936adb7f4d3ef0eb7181d372a821608d530189fd76567da19f89

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

407f8dbaced2ddf508cf68629a098578_JaffaCakes118.html
Size

41KB
MD5

407f8dbaced2ddf508cf68629a098578
SHA1

6fd08f9eae01b2d89e3cacac45d8b4a7120ea3c0
SHA256

ca6a4fc80124936adb7f4d3ef0eb7181d372a821608d530189fd76567da19f89
SHA512

0e34bcb1ac19e3193687dec91fa75fd376bd62c639e2063d496d6d49fa56619e1548e249cc4c9058fa10e37376eb37a643197d3f2af8514fbebb63a278c5dd6c
SSDEEP

768:vRR64WOmaPHDtJBrNs0V79E62POPsmofxsS7UEd03YYNy1VPvPWPdktEDORgk074:vRR64WOmaPHDtJBrNs0V79E62POPsmoT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D94C991-8973-11EF-B120-F245C6AC432F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000019fc599a1553241892398cec05e6367bd56233d88f35d22790b7646c486edd5e000000000e800000000200002000000019ff6aaa35391414308f0f57e4be2ac8be0e3813b82b5db29b094036fb8969c0900000005ebbd8400bd242cf2b124340af213fd63800ca6a7ea66e7560b53544f105a853a31a5e1d30b94c35beadfd59ecd48ee855c15628a98db53068a43086ec15d98e7d299c11c055e77c9080e0140df9bc4e622a5058ccdb534d2caf819335514d9c9ac09748d1d47aeac5348e1eef245354d7dd83dde9ea59a71f0a693dcd57d812f280b9a8226fa793cb9e3f1b0438417540000000da1100795203f63972909a3fb83f5860f24aead87dc946f535a3ac138cde85e32714d9a351c7f14e9f7078517cbe5e089252af1492cea85276b96ffc4fc6519d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434993326"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000003a26912fb2db0063a39cceaa2e2c5204b68a9781b18f0f3ef36f8f2178c1f3a2000000000e80000000020000200000002ced40071b2c6f8a1034e4aa100b148f7e2ba70370daff0acad87bd5b99860f620000000ce289078fe5b562cdd88caa3429c456a3f668efeddcd5309a18106ff098b760f4000000026e4c4026324ad9be6cf504de4b4a18dc2daa0540a7da83630969dd3c1182cb2dcf01355f7c2e6b04af1bd702be70e579a859bce736b77410e2e9c3e28143940	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e3de52801ddb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2808	iexplore.exe
2808	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2736	2808	iexplore.exe	31
PID 2808 wrote to memory of 2736	2808	iexplore.exe	31
PID 2808 wrote to memory of 2736	2808	iexplore.exe	31
PID 2808 wrote to memory of 2736	2808	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\407f8dbaced2ddf508cf68629a098578_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b7eaa3220c8ea38b3e36b1f0cc2771d

SHA1
16b46dda242ee324623d0adb58589b9a45479a72

SHA256
147e7b9aaf7e3fc590ac18d4aa8da74908829eb22d4421978ad5338599f10bfb

SHA512
26858c8ee3b2e1e2d887a5e8b0c99eb0bec3f26880de305a17a118bdcc3af5a1fb98a76731a644efef94b30778f56a239da3868b6cdf9ed00be8b51b5e7445a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0174cd35770b7c8b3b6e19e84973e494

SHA1
3da35c4b285a071bcfdd4b87c07e43d4f87836b4

SHA256
e3cd13aaf690193d72e345f3ce1abd624f57506d3a229c008f35d69c42fafc02

SHA512
aeecd2d5ca6a9b2f4b427b8150a7199582f3c71446fa4fd80aabf4a43817cc06d02c3b4032523342eee5f4f80e13a7c81939c3cb764981f2dcfce0a9317c5433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f306bb606a495d6af20041dff199cb4

SHA1
8fd0ff3e9fa0d038fcd61afd4e16532409db9ec2

SHA256
dfd3228b41fed8584159eeca542f569b36b5696e9d65cb7dd4861ca15d2186ed

SHA512
8a14ca9d77a0cb5bc21d6ce6ae16e1af065995d9208fac37594551a17f0316326edd92abb3adde484788e52a5e4de20d6eebcc8ca1b8bd12d1e27fb6aebf4697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
935bfc413418b31ebd81113845b17e91

SHA1
e145afa44a38fff75fb8fe71b1272846f1c37f55

SHA256
372782a9340837568ab890bb1a8cab81c35239afffce9fec856490ece7e8e39c

SHA512
39feb4d5d35708f97f76dc340ba26dcb20d5728949bbeb6404598c0e2ec22ae46511bb0f798a1bc8f3f058a2fd68a0b8a02f4b52c66518ff612f677041d2309a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60b2f7acc268853b3072b35593568e62

SHA1
dab363a75fb4c559d334f77fdc1d8462ed18bee0

SHA256
d9a49de77e63cd95cfd255e9e81f69648a601e22cbc6f3b51d5594696a6af126

SHA512
e191a108a6c3fdb67356cd3294df38bd66404e428317947c6af9ba6821f3d51e61eb0f4cd0cc9a5416f6d3f79c9e290b69fd9c76551e8a5a68027264756bff9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41ee7a57c460018bf16e6f8f4d86adfd

SHA1
8e59c524c4c04b3e1f66ad1afc7629df44b96d64

SHA256
b9f54be84588e6ecdc1c3316ee9b3b25ec431aae453e4e8870d95e935c78d1e1

SHA512
c12e7b7f2f1bb3bb235b5536b62653ece6937124d2222c184baafcf210074195424cc147046ef4f199bbd584e3f3746e515db675a627bd51d87c014b12a35920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3be253380ce534d084cd9c0b558524a

SHA1
2215bfd84c9c0a4be8b28ee8f693b2745bcd6f4c

SHA256
c42cd456e7c812486ff1453b0ab7fc7ffd586cf2d5ec9a150254157f5211864e

SHA512
b671bb0fdeefe1b2bf3af1180ef9aacdd1b7a8b6883d3fe16c53b618ee5dd8a75e6c4acf8103f684832e97cf1e353141e4909e745a7dd98fe2981a3b1646631c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dac12aef46703633bd89560536a65ce

SHA1
e8408d1580007b0d8661385d41080f364240f452

SHA256
53e959da9a45079089a6f4c75369da3865ba3ae5d2472d34183dc9b0f60a35ff

SHA512
d206b8fc2c47c639a8a9326539d1346c59e0d3dd173ddbff3191c6738e3912cb4ee9f9eb1ddaecf752554e986f3eea3f267591872dc9ae72fb7234b915cd593f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5435f6bf79f4258e466dc252ae4afce5

SHA1
9b7187efab618aef8a7690870b7e0154dbb9b4a4

SHA256
75f5a08aa0201b32ffb01d1654451b468b67f19e6796b73a2988bc0e85b96fdf

SHA512
da95f42b2fe7b37fb4bb1ce2176f2c10adea18138e8208a2d26b617fdd4937e55a1416faa811c2982dabcd8d48d8b1db556b7b65f55246a28d100e3b8f4a74b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e0c86b2d1177c66a13e5225784280c0

SHA1
7ec060d11485c0c6ee1feb8ef11c60434e4d4ef3

SHA256
a9eb9820fcaa339cce8f6b91274220857dc1d6259cb4ffeac23018b400ba1344

SHA512
29e28adaad85347b82b9057971d134324c59d48c14223ddf335d1b9851ce64f8820e30c000e3665b56190bdf67b6b10537151163fd342ae63ca796fc419b22de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d3f1c066426a8b26e0dea495982a30a

SHA1
af48503e22cdba5090eb721c1ca6bc95d3754ed7

SHA256
809441a5f4879481d57f520bd9c0ff459fef35d5ee0dc1afccc4e0c216537c7c

SHA512
eb55a049ff1ba1580da2325a4ba8ad28a47c0467a20f6c0eca3c3ddbf22bd95b21b30242cdac9f5c529364c3cdd83ce83e52a1ef0c3565d0282846a04b9c6fa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6ded08357778c769147125d1b8edf18

SHA1
6d11c2d5beaaec1a56eec8485d3adebfdf6b3b11

SHA256
87f49275d2b74b119666b06488af8bef866291dfd792cdcbf4e9c15f9b45b099

SHA512
a4be64380b260e1f58426099ceaf32d0faea5af6ac9f6e99e010b9edf8e6f67dc6d0b09c736440838bca06bb8353a6f949ef205040e29d6e9680278ab31af70d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d8ce1caa5e3912289163bea48758da2

SHA1
f6cca632dc7d99fea325e71976a7a2c1c86ae7ac

SHA256
a4e16b2583ca4b76d9c44b4c1a90db15eeea2e1673f7ed8b835711e22d920e86

SHA512
234661683fb494950e09e921902d0c2e0fa75eb3ee7552e04096047572d59dba5ee0df404b6f8ae04969e2491caf50ae4237af282fcebe051738b840eb413b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ba46a16263456d624a4eb0604133d07

SHA1
949d83dcd1f9bb2e90db294b1a9ecd862eb35ff6

SHA256
dde30d6ac4a356a75757056f5b498faa3cf42edb0831d2b8723148b969eb12be

SHA512
952f555a6653ec79605374f7cd258bb7216f96929132d938a1ac389d5e8e0d1f3d715640b8c466b0e60b2654bb51e79a0837acbfc3c18e3bd1b70419e4d495e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6DA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit