3e36a64f40afbac9d5db0facdcc8ef91dcd66cbeed36e9afa278d74c1882953b

Analysis

max time kernel
117s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40f79e9d86e39df04e74da446bad8b63_JaffaCakes118.html
Size

5KB
MD5

40f79e9d86e39df04e74da446bad8b63
SHA1

1498c64a9f9a7cc12a6e67bad1d9d7cf990a9d16
SHA256

3e36a64f40afbac9d5db0facdcc8ef91dcd66cbeed36e9afa278d74c1882953b
SHA512

fcc9d90c8701020622d710a7aacae7cbac7d76f7064cea777914b5d3886fa785b2c6f2a31043217a882fc7c538619d3a621c8c1d75f0ab59bb6703586ce9581e
SSDEEP

96:7X6crf7y5n3UUMxMVNBfEObAAvQU37Yun2:7Kcbm9k/MlWUL5n2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94910AF1-8982-11EF-856C-4E0B11BE40FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808a0c698f1ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000005952f2fca235bc50a065f140fc442c3e4e0b5e77b810bf18357b9275c6c944a3000000000e8000000002000020000000358daab26bda90d3a2046ffa0e6b7b27cbcc46a8cc029b75d351a736d10554a320000000e39f5cb5d4f36d7763864d7c482c9754f27e7525231249af1c6afab921dbaff440000000d68b6c69bbd9eb990392c8025fe7bc2174c178ee213d2cbf2e476d10421beabab940b92cba6cf0fed9a5d4718b034b319808dcbaab4e8ecc9771c8fdff66a272	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000809eca3739a1eb38b07aa39fc4712893b3a014587fe56f7ce54dfea4651966a4000000000e8000000002000020000000f3b9072a65ffaa8e731f2905d07064bd431009ade21178068f3b3be77f7c55c290000000de8f23e27ccf12690b64b3689c825b770a60ed61ce05d7b2f9bc2f4bb5c909bd27d3581cdf46c6426c69f983a584c7a462dcbd19a7f39e57b73e5def1a938b499c96b7499d4de4b9973351111c251c178a0652a76812978d1e0899ccd7630bff0e7db911e823fb504d5fe77b66803013151460b457a1a63244ab0e3f4f898a14a238d09127e8a1708554e0e2dfc3a0a04000000057d64447e5ba99ef670ea246b764c900a190f59c507a76f85063320ce8026e804e9683d509e557837192cec690fa179d79655c8dc57ed068d1693d12e5f330d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434999819"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2088	2988	iexplore.exe	30
PID 2988 wrote to memory of 2088	2988	iexplore.exe	30
PID 2988 wrote to memory of 2088	2988	iexplore.exe	30
PID 2988 wrote to memory of 2088	2988	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40f79e9d86e39df04e74da446bad8b63_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bed5f37897e46e3397af4ed2c32af12

SHA1
822737250080d1938d4b05258ebbf963ebab6dc5

SHA256
42c20db8e0ffadfce92b3a988598553dfe93f721e296ad87e63db361c0e327af

SHA512
d7562d14538093f0a122708af8a340fd892cd8a17eb430fbcddf369f2605052fdc7fa1b1f9adad7affe90775fe3f7366ccfb7287224459f8aea28cbf76df0520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b710d698d167e4783b4cb56ade39d7a1

SHA1
02e5d40d10113cbb93370e89ab4b343c151d98ca

SHA256
5aec05908856b962e54c1916a1852b9ef3056d14bf79a207173c843f397c758b

SHA512
9c445abe1d48138b6d5efa5d69a90e45790a42274e7e9c6f177e2f7cd8d73b0e7ba457647d43ef62c06aebc004fb7d0d88d27935440bcc1017e246ea118c31ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cbec4c54eaddd9661dd9c8f4e94932f

SHA1
d96f500c2e4269857f51225c12efa65220c2569d

SHA256
a94c93b901e3363edba9cd9109d5c9b3f6d432cdeef886bf3387084531787276

SHA512
d7c426e5f3896d3ec3ffdd78ea805e1ae6bc57a07460a51969f225208ec5791fc62539c768457199a77d223531490a244aa22ede85b8b054f1a3ffa8aef26265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e25f0268f27dad0ac04b512b09f53ed1

SHA1
14bb0a8f65865f89f8d5a9c004c23f8483298831

SHA256
bc56ac0bc4e451879528a7527982a461240513174e6fd13fd136e8adce4d9ee4

SHA512
42fb23382d9070fe5625a506bcb463901a152b8ea82d92b1ae5e89f54407f0c19000e432bfdb638e930af5412e76279515b39a85fd4fc489351760bb841d6dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e64d7af2cdf545f09213fa67ece15dd

SHA1
a32239fc35106fc834dccf494a61d28d3e030e7b

SHA256
02707732c86f14a8fce9ecd8d7285fa1cb742fd33eb835beb7385a18a1d01b16

SHA512
90a82aaff8c5bd53dd09f45ba8a66026bbcce28e27023b194b9a4d30a28fee1189e560bb2cc1f4dc929c4c070af81c14de277351ba44d3c80dbc8976885e5db4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac5d3888ba4179a772222ec2ba925c2f

SHA1
77df54739fcc3453becfccc36333c320bf51b20c

SHA256
5fb8cb3670a59419497701365ae7c2d294e54696b132e1d94b7d7b644de78d74

SHA512
21adab7ebdfd768ccb179dec6680d2e054bd43d9227f91e3029a14e919a54cd9bbe984fb91e1e5de5d0c8fea94bbeb961b86e15391c6b02e9c32a37669e1ceb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a9d0919c6653ebccecef18671dddbd1

SHA1
69d32a54f42f4a8a8b275658ea025c3d4ac500ea

SHA256
26b502fdda7100c9fb884a895d226b132f71d29355d2ee1eac26bb228f5d5d38

SHA512
e44017897d63d7eba70dfc0128528de48d0d74f6681a1ee9245d04ba5ae97780d6a96ffa7e25b9216438dfcfe4c1261e724b43bb94908713d3fd1e941cf34e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e268044a90d3a3560d16f2dd1305b0af

SHA1
b6131dd5c350935b4ce91a6d203dc5d93a08343d

SHA256
974e42fe6484e226eae01316b5b70d5e5ad9306e6687526c27e74ff8f7d2b8fd

SHA512
28ef6ed3de92490a683185fd9ee13e2e9f2e63cc0927d5638a8508df63eb7e70cc680cc87563ca3c8b0cc3461041b93d3d635beb1fa8e9db4da0ea7cced7f335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5bef10812127c08855fbf8600bcda2a

SHA1
18c0586937030b92daba559fab9532d990027646

SHA256
344dbc8ca9ef7caf8ef6761993a518619575425e0ece7b0ad2ec24191ba469d2

SHA512
0c0ed190a8e0bd3e6999f6945324690fc0b1f990fb1c064a7b223b0056695e1f47fa855119d2bcb50cbba1e53a19013c8515a7a02e3469619a84600de01128a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dc186e4861c2248ce6adb172ae88798

SHA1
a28c0cc05524192a1e89aa144a5f058562eef33b

SHA256
2a722d88aa0ce460f18a1d40f24da1321c5ee2dce550868c3c73f389cb4dcf47

SHA512
77fb7234bb7427491ec898a3bfaaa05edd2f73283fe3d254989fc96f810976325db0e1b5d7dd8826e1afecf63dfed6397b8d6611fdcac0fd4a2fd325c89d6792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d85e70c69449a8858785a9d56e21d4bb

SHA1
52de6456caa78af9effcd4e7730aabc7f08710ce

SHA256
1b17082ec4f26597337ec26823544a19d432b328252e44640844e16aa132dad6

SHA512
8072734972e940107dc917c15212dcfe253e7169c71532d683b511015d0918c2a833a2227bde5d32092a1866c3488f3637fd9a738cbff0461499ea9a7da746eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd4d020879941906e3d46a632c14b3f7

SHA1
433b922627f90531a7ceb1519b85fd99fd4bc11a

SHA256
253e93dfd20199fe800d199acd8d0f4a00e79d002c0c351acf530cfb7110311b

SHA512
497037fa779a8414183d0a836a2aa085e5504bdce3bcbcf9e0abb57cd39b456f965bbaa150941b9bf35e0133526da4d6eb24db2aa4af0589b45c753e3d97b099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c9e5d5f40a2fb8d0b57872e45e581e5

SHA1
6ca1302df289f7488387c959f7660a7a4ebe80c2

SHA256
c12359b900535667212cdea23f27e1d999045ee21471956ed59b9d52bbe06993

SHA512
685b328ccf40d7bc45ace008436b1a8d90ff694a6401b1e3845d18585940dfff116500ffd00b9e48d197edb9d170fd725c3fd0665c31b8014c48c123b48eaa4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7acfcb487c91b9032d43ddf07d71436

SHA1
20f48f5885cabcc6ce3898e8b668a4a5a99ccca4

SHA256
8f8d4c2b526b5fe59ff1860d1a09806fed8ec565bc99cf9255ad5587b0cfeb8d

SHA512
6f791e1df15423943292503a3681332de5c5342645428a3df582f9758c891f120c606470fb0880e109ca1f154f7ccff8d2ba0db6a9a1b2b095f942f8c29fce8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6923395d06017e9e0c47fb1d608f897b

SHA1
c07122da8536e1425e65447ffa7e6d8fabe3aac1

SHA256
b61843c26957acbc011e3dc72d691d68a52624af0c3df48e628973ccabae008d

SHA512
04a1789f3ad34ba7e8e9292c0e96265341ddf28a70f0c14e7b0aa561fcb113b0dd7981af7af4fc45adf4b39a99832baccbf721b1e330f6118ad983f968ef2c80

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF7E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF000.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit