ad3a4363094fe2c20505516d7aa978f151e8ceaba94c7c8a60e5912d2e096421

Analysis

max time kernel
142s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40c62297f46911bd76b022553d9b146c_JaffaCakes118.html
Size

57KB
MD5

40c62297f46911bd76b022553d9b146c
SHA1

18b619ffe46aa1b095f74eb43d2351ea768ce5e3
SHA256

ad3a4363094fe2c20505516d7aa978f151e8ceaba94c7c8a60e5912d2e096421
SHA512

255904eebabeb0312850921163441e34f4f171b262bb0182487ae034c735a68f5680be27e65eef50528c61b9e2820d495542bbf789b75584dffc94118991c744
SSDEEP

1536:gQZBCCOd10IxC4TUMRqQ6esNUxAU+4Wa/uJLgGeu4U+tc74odv+lvYqMWObUDWT9:gk270IxUMRqQ6esNUxAU+4Wa/uJLgGei

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000067f2774b855ad83c6463be44cef42640da0b248550b7aa2840d64e9f5f321583000000000e8000000002000020000000f4cb92ce5c590c9fdc5425e6d3e06b888fe0edabf97ef2af9a90e36e344fa11c900000006627722f2e583c8ca9bb7b0dfc0e9c2f55753f863856aada2ebf8f1c17d3024adb9f5545e2adff208c4f8a971973a970f911ba60491dab9610a8712497d11729c38ed3f4f9ce2bb913fb64cbc7913b847b7fe5b275e5d0bd06e058455e9e0f4be396669e4297d32d28ca4c385bfde459bc2d6e837c8041617c7085cdce623661640dabe8531d42f839fc3a102d50515240000000e94390da25ffcdaff8a2561b4f6dd25d62f6abd3bea2905ea8a29d2a880762af680b75f256dd2513ef4cfc036b6be95be8e6acd20b6bd899b8e9695fb4b73de1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434997190"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30994b53891ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000002a838976f5d95e9f11ea2def35942d7c45795c9fe7c8cc7bdd38632f222a746a000000000e80000000020000200000007a9eadecb96c38f57d329376ce309280b4dfdd94575f5bd6ed9490f4d887b2eb200000002ab8a51dabbf271e062ba6f3d54d6e405854da411e2cf780490e77648a824d0b400000007e2a9b0ca5db6d307cae05082893cee6afd6e2f8a4852d3fa4b88363ec4f009b951268377098742f4cb62ed4b3d00ee3a97e8e7ff538d4995ca5887988815f65	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C18F0B1-897C-11EF-97EC-7ED3796B1EC0} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1816	iexplore.exe
1816	iexplore.exe
1812	IEXPLORE.EXE
1812	IEXPLORE.EXE
1812	IEXPLORE.EXE
1812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1812	1816	iexplore.exe	30
PID 1816 wrote to memory of 1812	1816	iexplore.exe	30
PID 1816 wrote to memory of 1812	1816	iexplore.exe	30
PID 1816 wrote to memory of 1812	1816	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40c62297f46911bd76b022553d9b146c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1816 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
db8994912057d76555f77c7a6096bb3c

SHA1
98c4d97c0cb33f679754a319226a0360706c5a19

SHA256
bce7b94f30316ba0480b42e6add21d1b17c912e465d4102797617bc281155fae

SHA512
607a36de3dec7a7d86cf040bb61d484860ec0ae1b1fa666dab6bc08d71e39c8d36dbb72af5ae62b5c9e02eca7945a81a2de12e34529f5cdd516e5d4a42688b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
875426378ad40b846d793d4b0d86b0d0

SHA1
834ad29af4d51d7e223e65e6b5cf0e7498310113

SHA256
c6d7cf0377087efbe6e4801ed1fcc3a6cfb63eaf9a24019329edf8eef1c509f2

SHA512
d19c50c8d9207bd2526770effbefdb2552acb999927f53f2884272faf5b19f8e84684a13ad0fbab81966b2068a4300d1a1c70d6dc65848ea4b07ed751973470b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caff439a49594d628318ca89e4ebddb1

SHA1
34bb077caa69454885cba3c02cad0ae957fb63bf

SHA256
b513d04d486b137eddd31b79566f680e113b1b81314a1dda0b11500464a35d17

SHA512
fe097adc1c59adf826162e770e9d9d92a96ff2edde25a959f2c40f661faf1794b5858d626bea5d6dd5ed6a5a01e4235bf298e7f116ac2b83907ac49c566cc944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfbcb466359158989a3d1231a01595d0

SHA1
1d29bb3bf5329c055411f88c928c962603b4a48f

SHA256
c489e32ab96acea65531dfbcadcefba109af3a1fa66a421112e1e7393698ddb0

SHA512
295198cb44184b0b20f4de5da93c685b37fea6836ab3f3c6c46707c22a76d669c5b9b7b1baf56fb6b5d45fd91cd6f293e3361d29f7e02305d6f4b308f3315bae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d038df634a6623896d1d1586904a0f7

SHA1
544636350b3ba36f7bf838d22b00a395d61d09bb

SHA256
4ad95dd799f6c30e87dcf8eeb943338b59fbadb9a74b34629610df48bd91852d

SHA512
5c1519208a305438a5f03ab136ff8dd9e2429243836357eb1bbe0b4389ea9ac626c5951c5dac8ba29475e0dc92819319fbb0760090a4e31d791f1fb576dbbe32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e41c9e24c3ac3b6367047dbf45fdfbef

SHA1
cd3873d565335cf0fc9cbd4fb438c06b32184c0a

SHA256
0962e82154390ef600f2aff937ab136c7275ddb455018c1dddcebe7427415b39

SHA512
a6e4cbd1d58e03ea89922de3687cbd91f110e59f6b74ab6b7328f1494ec055a4f3d7a9574ad28d281083d66cd6ec4994e570fffd8fd294f81b25211b00ee96e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dac503cfbe4fa439dd24188a6860fba

SHA1
3ca2dd55e9a65945ef14968cfe6447e7920eef71

SHA256
882ee590bc9880420de9641d5f3d07a6ab30d4591d201abd4f1e6507048af6f5

SHA512
598e12d1ffe056cca0dd280912f49283ffe386e0b969f0d1220c57631eb2c114cde7a01623d6e683163f754780d6800d3843e958196d7063aefeab74026d04e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b851feec2705a722e347150e97735cbd

SHA1
d13ed5ea8932bba60b2807f3af9c139a61a51000

SHA256
ed3e87891d38e2b68cfb88ca153864ed1464b2e7e4720965396758e4ba25ba12

SHA512
1d20e55bb55d8b63518a01fe28da070ced2b3cab4d0adfcf0b18bcf83fd4a9ec28428c17ad7d6d8ba5e179a3e380161b787e3780884a1820cfe23708c74ffe3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be172ede12102ab157f926c5abee0637

SHA1
ff46412c0501ccdd620cda3cea9405743fb8c788

SHA256
ebd9a28552c02a15cf7f4e12315dcf5c7ccfdfc705f07d2010198029bb9410d1

SHA512
e074642dd4adcdf76d70e22309613f218668eb440c5a5fee9ee47b77120123521b4ffde45bc2ed3908867b13b6bbda6526d7c9cfbb8c23072cd1cc720941dbbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9396b7cd03102c124b9e4deee6682b88

SHA1
bdd78b87c1a2d0c0866b43ef7c3c0c862a62e621

SHA256
22ee4683b0716e227c7f24752c534ee063318517507505229f2d1194e0a3ca74

SHA512
14da67b3ba20bf6e3fe02dc5bf42fcec2bcb302b24e372434f00edf89e96f2fb86369b6efcface63c7035aebbc1cd61b22aaaabd9be238c0b61611b10545c80d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4db554d4fa5f7d615ba68384c47d1409

SHA1
30b0b1b4c16f8bdfe4c979036579b9e5637b35bd

SHA256
2b173a4f65159fa3882934f216f758bbce79d0fc896d12a4fd007f2e957f2a7e

SHA512
eeb1e6e492519cf1bf6f8efb4cb326b34593d49e7fc8e7b03c3e131ee5d462a4495a87ba7cf7101928b50ada691177bea5d41219aad9b99bd63c42f3a5930f1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf6a92b3686452300e013998f58faebf

SHA1
d5c2c0f69f532385eb1010ee9083d59af97bda1d

SHA256
0058ddd1aa56e51e5d60106739da96f48e717add37f7e41fced6e6a05212e1f6

SHA512
aff220b31e9769d2111ae80109e5f67260d10e71fa09ea8f72fc65292fb4b8af2521de0fe692ce25d1fd86d57e91e0383f31016a942ff23fe0da9c84cd509164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
dd14b506f2b86b6bf14346d36323d9f8

SHA1
7bdc332bfc963d339619baec31db27791cab73d4

SHA256
452e139dd3814c5a6fc0e2f367513a8e2397cb37a0465f272e8a430168defa0d

SHA512
3c88cb399d285fc610e787b4286bc91c4fcc54f1089d8d4634ca441fee5f4286036e279d2e5ca0cfd0f1d32143e163b9cc26385bdcb7e36c08bacdedb02e3b83

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE013.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE026.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit