58d57eb016915a3d1476f35e311dd89661006781553841ae2dd40b7b72493acf

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40ccfd0830a7fd9b8abe84a0a9628984_JaffaCakes118.html
Size

27KB
MD5

40ccfd0830a7fd9b8abe84a0a9628984
SHA1

4c6b7fbfd3c981e4b0da95b3df624feae7f45b20
SHA256

58d57eb016915a3d1476f35e311dd89661006781553841ae2dd40b7b72493acf
SHA512

5345408d4d123ba40ea56206b06b0ed8e54bb481b6d08889989a97b2f387e2dc4fe756f8868730a9dfa8842cb0a86a719a382865d36309897d243b42a7348ce8
SSDEEP

768:lHljseTFmGfWajmnT8foLX7jTqsoU0RDy7zCgXm8Oju/TGLIjseKl:ltulYwrvmf154uQtq8TI5l

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434997541"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B8DEB21-897D-11EF-80B1-FE6EB537C9A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000000a1fc21eb9b23fc98cde0db7ca617232390888e8e7e3be8a2263e7742257c5b1000000000e8000000002000020000000f5cc6e8bff122efdaee8638fa34df8d5931f2e51fe717609a57802f9fef0421d20000000aa6a6af76d6083a72cbffccb09c3b7295e23b73a8a715fc0949d6e307e334553400000002f9ceb65c9b61364c9f1197569251e841b386a6f71b4feac12f8e18cd3491fa0d8105b33e9a817c8a72bd8b9f74cb5e6ff7452fce658a95bf77cb0fd964a7d68	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006e93388a1ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000e44f41abd6b39f4a16db83f3663caff0d78e6e327b42f11198578fe504aeae5d000000000e800000000200002000000068e6b1c6f28f2503e2c1081f55b35770b1c3d675e43360a57ab4608aae2d52e4900000009d40aa2a3e91c346b7a44ca43aa71fd704291f7e7af7fae1a516c662a8a1659f143fa215ba452ca162b4afcfde2588f5033dd62bf11080cfb96ca8f166d877ab4eee8b0f2f82bdf04c4b782f4b3805c2dc0b1a4a0642d1dfc56f0e61c9e8d7acd256faa05fa638c138205b0d8ee9c2528b2bdc87ec2ee859281e36c6fdc98d9d8fb7c7d5b0c4f5346d9640e490fad5454000000024e82f1dd0cdfa52d2c84dbe912652e2ea5c402e77d129feb891a485a49814f3f2032954076702cc79374a708477726643a294aca39f39b8443e0a1bbf25a138	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
828	iexplore.exe
828	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2720	828	iexplore.exe	31
PID 828 wrote to memory of 2720	828	iexplore.exe	31
PID 828 wrote to memory of 2720	828	iexplore.exe	31
PID 828 wrote to memory of 2720	828	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40ccfd0830a7fd9b8abe84a0a9628984_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:828 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7122d577ead1a44ba376f3623b5301ea

SHA1
c5b3daf59b6ec33345a05bd2daad676aae3df5fc

SHA256
b48c06f0ef84a598c4403025a83094b1ae8aa4dca7b6028cd29127dfa95e7235

SHA512
7978b9e3dc4a192869a3b23b8afac24c76cf3926d77c2bfe09f6827ff70e622e6fe8cdefba59628ef48c3c116985a1a7fbe47e4f22ee78197e8e7c7e52029820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86a6c965d3cc0ae66ee1e5a2662b0696

SHA1
7b1d2b56185d89ac91e229decd6ead957fc3ad12

SHA256
4253a6944e1a91683874bc65c69f739556a0b860c883faa837276b6e67456fe5

SHA512
dfc6138e0f14726c8d61bb5105feee586489f2426245c3e851a9a658f69a14bfd2081860e2c15819291c7257c2bcf2b8fc512287154c5a8f52c343c3ad211ce2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d61c2aca4d5686e04dca769d4ecbd26

SHA1
c28cda87bda7c58f2b2ff34033af067762f84d3d

SHA256
1b9262606cb947f864f9e9c7e7cec898f313d2b09410cc2f0764df860e14926d

SHA512
c37f1aa571e1591ea64fd743360346ec023ff8beea456f72e3abfb85bff2d8151004195a64a92eaa530649ab46c7a06b7a467fb7e3ef36081d68d7ace5c3986a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6c71ac8243376e7b6259af3acc5bb5e

SHA1
1c5fa8a588380bbf535dedd50d9dd1a07997be8c

SHA256
03dea7438494ec740d139295ec0a0d8d362267a9d097335dda387d9da68fb517

SHA512
78fa8eb3127afef996da0a12c53a0e4f17c31ca3c84170f37b63e16d27493faba533a47d35b2467cc1d8dc23242c921824485464d0d9661afa9b9fe903fbe9dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab24223156bd01822ec326f139342940

SHA1
e1dbb4ec68536ff4655a8139eafd564cc17bc355

SHA256
163e1700c0cfe323375e96943bbdde013fa332147398ad854be157783cf99b1b

SHA512
3db9f03218493ec137e0c27b8172762094dbb1454b301c2a0be429f7774f0b24ee8fba937430b6e5ae0e6cdcaa539a7d1fd63904659aafed4f30e8f16eaf6cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8114f4a60b4e9dcfdadc8e5566c67890

SHA1
ed438652df83be00f3d7fb00a4cca1b40f0743ef

SHA256
9ae21a3ad96e94f03b43d144265c101325abe51a0fdaddd024a5dc8c08405ba9

SHA512
d4a25d1fe200e0c2d968ca2c701797649391b405366054c705cc3641649b2fccdce004f77267183a3512734737d09458ea0baa243c5f4153b54f9317e1671850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af9bfd2a857ebf666c485dabbf72dc25

SHA1
e5c88344f699db15c75261e172c32f743eac1fc0

SHA256
4d09e1e6ad5d4e8f1e2c83ddf07427fd2f2d4eafb16ef3d5d38b36e3b77dfe93

SHA512
99fe298786fea3b1e4ca86cb263c35aef5217f0668cf094dce98ed42d99807611e80bfeb247f9d8512c21dea8c262cafd8614178ae334e962ee19e5047df78bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4287a3edb62d12d662df82b5e5b1d3d

SHA1
963198ade646139e9f01edb1d2aa1373779735e8

SHA256
f0aa7416e604144552a1e50b530894b16633bbb56d184b55acc79bb752a8e827

SHA512
56c6840b68839ade9340f1ebbd7b5cfd34890a36179e9ffb6a141021c578271215e9bed95c9f2e5cae14e773b4443234221fc223d05a33f4eeeab33e5b8ab1cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb13657648ebbaa26080f59c642a98d5

SHA1
994d9c12aa16a758066e00b829d2c95ec4403faa

SHA256
591e4104385d8dc7aea47ec0f444d08c2de23a5b5a6d074acb526adb68ba41aa

SHA512
15158d2c3f4b79fb6c22209600df29c2d6fdcbd0af2c4758ffb7cae5ce5604b0dbe844218dffa237fb96baf536acc91b561ef1d7689e4d836cd33f7de5443041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edde40f1a8a124ff126128ea75ba4855

SHA1
4d213b1308074f3796094e1b4dffdc5780b76a94

SHA256
5f58be3ada33015f26195b9efb0f20d5a0397b358aed5b1b4b38891c71f5a478

SHA512
9e3ccf7c415afdc230ca37db803f6a81562d470f2fa54b8e3ce1b6abc3d9d511ff91ff9aff7c593daf45cb8a7c37f3f1e52a1c728658ba7d552e782de83c6013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa978758ebcb10c9ee611300af47d3a7

SHA1
e5fb5923003f008b1dec1a28a44435e9fb5b245d

SHA256
ca3744ad95fd719460a907d267c1857386c506e5c244b4f850edfebc2bbbc8fc

SHA512
8d032189292df928bfd50a34dd6cab7a5f9d636bbd3fee99a6d923355fb9a8687f0aada7d298a1468d2ecdc90c43dd1a4253db3d7e12780aaed75464e7a097f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97cf7ba81ccaf227999392a33194ac21

SHA1
f013fbaaaea910892e6444e424ce859ebee95674

SHA256
41e52f7255a48e8158d5adb9af4ef23af608683eeef9ab34acb034fa21d9128a

SHA512
246ce454c0a6668c8d9731c721248321c13632e0d1f2ac16b743e7ede5daf50d4d34a67cff17e7ef67efe7c3bc2dc6243bd61b1521473aa67a01cddb5e4144e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2b74ea7342de0e28ace1809ea514314

SHA1
17a438a0392f8dbe1bd173f2255f6b00e9a23872

SHA256
5e53ad1db9b297ec13bed2203cf5f21901d4452cb0be777ade575ba294a95f5e

SHA512
5699c046f827822107c13f45a28ace03b9db6690a111e8ade91852549485edb946f6464007c5a9e8c9877bf0b68c0825c0e10ff8e2e0690618c29fb34eb13f78

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEFEB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF07C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit