448b66afe1639fbb4f7d7795d38e4f219af55978f9345a05546542df84d4dca0

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4114688cb29a9f87222db1069a747321_JaffaCakes118.html
Size

39KB
MD5

4114688cb29a9f87222db1069a747321
SHA1

7a8dc837e429466c8a703cda49bfe6898556f28b
SHA256

448b66afe1639fbb4f7d7795d38e4f219af55978f9345a05546542df84d4dca0
SHA512

81176440a770bfd3e041d0670463f595fcc52caf0e8288ae7aea7ac0ad1293989de20a1f423e7221816296b2b52ba02f93515a1acb4664be8ccd395360fa3157
SSDEEP

768:/lLnzVrb4reV2P7rCH8paJ3oRoRrYLPon9+mGz/rG1gr4OE/mkrL8OxSSP9r4Cci:/lbzVrb6pP7rCckGoRrY09uz/rGy3UmO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000e3534c648fb43bff5776cfa2b8630907f8275b47ad73345168f49754a4e1c9c4000000000e8000000002000020000000f5962b8811be659b5239a7644e8f4ce3909f2d59f55609e0c3422a9437c8f8cf90000000ddf0150350307b61407e1362cc6d50c9d01d84f48c96c47cb6d4e0cbbc3f0cd91a1fb89344eb18c65ea49a457569b7a9d94f94dabbfc369f93db859cae24b8f5e320cf7bd129dcab2bc1733d202d26588bc63a4b2618adee2910c252e4a2ca4b0f106ec29fd507a13f381acce28f0927fd563618ff06c37168ce248b6ffc27692208c20988d8de2b3e901dd2e2821eb94000000027bd04ccc5eaed71ad6c02085d52de479af1e6b0d0a532d2365e1b4d67db768fda15bf996e3254c9bbb3e7c10e9f37ad894843744fc86fd23e241ca1fdd3e10a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C775821-8986-11EF-B4EC-5E7C7FDA70D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b1319000000000200000000001066000000010000200000009094d9827aca645b8ea4cc5cf69d96d7969a49af2deaf0ca6857203bcded86c7000000000e80000000020000200000000df3a036a39e8747b6b1c5a6a955bedde6868cee0a631e1e65eb053ed7a949ed20000000b48a219ab92f0cd70da417e135f3db0139d1d5d16f3fb4c450aa15fc5379a48b40000000be9835aa314f3f23a92cbec2556e5d43d573c359928adae195f8f305f326c0a3adb0fb5ffa1c09757f68de5bbcdadf62ea353292904d99864811817d2691aa14	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1012b711931ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435001381"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2880	iexplore.exe
2880	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2840	2880	iexplore.exe	30
PID 2880 wrote to memory of 2840	2880	iexplore.exe	30
PID 2880 wrote to memory of 2840	2880	iexplore.exe	30
PID 2880 wrote to memory of 2840	2880	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4114688cb29a9f87222db1069a747321_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b313496133954f8aa3fad37d70fde94

SHA1
7c372bcbad5192c6dfbc762055d401ac9669f262

SHA256
761eb4d31680fcbcafed8e5a68dc6ac82a31de417dbcacfda3c40148582b9593

SHA512
f0a371d9fc1a7a6ba935e9e18596901269d46dd71f210c76243fac50ca9d359895a8ddbb533fe4271510323840969eeff8f882dc68519aae6b20da502d85b84e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a63e75027deb5a0c2350f9008b273dd4

SHA1
ec57791de73a14e7d8d67491d4740e9953c6654d

SHA256
9a7613fff4a2ef04d02658457e078936a0227c28f9d44a04163e15196f279292

SHA512
ea524bd1d9b78acb79a2ee75db62493258abc9278aadac357ecbaf2134545f2993cc0e49fb2519b04dbe829565c926ae3014a44d78de9fc85d8361be33ad9c87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cec31492488d1da10591fc98aa98fdc9

SHA1
857d32e1d954122f121734eb02adf09bf8fe8868

SHA256
479971addc01a2639a3eeb6b19be39d09b7b9d8a68257d6657f23141b7b8f635

SHA512
2accbdeb8447af29b38e846d6d27bd351720397ce8794bbd4ea050defb56cfa3e966ecc74c49eda85a1451125fa8dcdf16e0713451590826d4e38c91012f9d81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e1032404d4aef5111bfaaa730f7ea7a

SHA1
2e4cf7bd18a2cbfef0ca4dbd8d628894a6a02323

SHA256
587319b6c75d974d012694d7dc0f5fffddd0dd86a42d173e2a45998e3e38b98a

SHA512
7e49f431cd1ad110cdc5f4fb0051aaf18a05c20addf818fd5aa13ab3814fb39d714d6a3bd9cd6ac689bd643f4f34d68609069cedf2922b2ecabab5fb29069e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c2fdb91ee88adbab32c36082a9b0282

SHA1
a47a63fb8a88aeaecd98d26d453958842abf06f6

SHA256
91b61fa3991dad288b378abe1ae2682c4f335ff5a0ebb4e33ef1e4cc96c08a10

SHA512
dbb302512a30f33910b74f9384c24ac40da440eb65e42c460d6160e586a2a94ae325a5dd5b73a54ac01e4a084a5f61aacb530637431acb1c0b1368589370afda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1f5160c730e53889a9f836de8b5f4ec

SHA1
0332b2378382785f7ec0139042c70869f067c643

SHA256
c4fa534650dcbeef33c3ea00444ef6b125d1d814763c96f4a16be90bb8e0d911

SHA512
2a16726e3fa8c0fd686dc14d438312aa126f4e257caeb1f556e98334dd0f7114244ac8cd978e70cda27cc0150e6fadce7358d2357944a415a3e5ea67cd853337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
357f19f1c6f7160bdec35097ba7337e4

SHA1
9f96cfa2aa368a71a4702384ca12ed7da1cc9f19

SHA256
7f68a04dfdcf800c75ab0b22079dfa5af97f5d1309595d40a0876268ecaa5616

SHA512
5d8c697d0c114b11adda755bf7fd17214c929f48e4ac917f62c302d37e14498d37310032f1ae362c4904efba77a574573cb302178b3830398e85b99229e19907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbccf7adfe783ca1423eed6e3d17dc2a

SHA1
6d6e0da5ba253b516cab62618ddc28706306c9ac

SHA256
5d85611f292b4f3bc2487f7bf3d2a525e616899e6a3ca1f761cd99a405c9b5f5

SHA512
7a9bf01fed7536e5deaf204972e3e3ac2271ad8ff19bc2ae80f8aab271943fa3f199a81e9f8a1ef5d750cd12e6edb0f21b5e14c8a65650be38ef86223397ca6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10a0d9c025a7d33f3f5d55a928311a42

SHA1
b9ee7f79c56f411dff31dbcff69699ae79e0e269

SHA256
2994fbe16dc858572baf4a7809998dfdafe2ed6f28780ce0726095f0c63fd749

SHA512
1ebd24720e1de9f68d9351730e16a19a3bb7ae8b67927b0692b4c8526c7a8a32d1b96d21f0b7cb086d86cbb06c8a973da0a033360889226df9b4d23431ba1da2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bb206eae4e5b48b1cc95cfdd69c70db

SHA1
f739a90f12557a0d63cdf4c03df36560a42275de

SHA256
9188acb37daed5af89fc1e0dcbac682814d13ce51f18b790cf1b8cfc30cc85fd

SHA512
c80f50b72182092cec58056076b9d482c0ce39ca895d977cba5813134b274e62d3a0b1c1d4315816bd7209e097f22f6c141b50eb50823de734a1f55a567fde83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ebc4706cccd356ae2ca1f95c034ca7f

SHA1
bb9fee76b5f45f227c1042a64446448fa503b341

SHA256
5f9124d5d652baf5797aa89df6677b3afb4c2e31772c30d6514ecd79e6af491e

SHA512
034e77259b10803ca0087014818cc216a5dbdaab6d5308d7493770efbcf8ee75711ebf2638cee09db081fa878f1eaa92614cd558372f68c5b41afb3287f4a8f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83187792a53618eb06d7f0d1b594808c

SHA1
dea00dc05242e12610c99c3cd5e88bd77a6b3856

SHA256
e0e1383cc9fc8047d4e667f11ee8c33098791f4b834913b4a943e58918bd8f4d

SHA512
78eddde7507c1547d874258b9e22fdeee75006457e4126ccc62f292dbbc69cd7219f36ebcb7f449736017d46fec3f3691ffaa6c1da33cbdb279d649d082b1216

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f851f0385c4c926777c810c62e63230

SHA1
ca107a52e9797e704781c65437148a6d05f9983e

SHA256
79208ec6e9156f0f5c066c52731defecc433249a39ed6473b19f1a1abdf481b4

SHA512
e6d9b63c9bb639f8840172eb3738cfc1970ee171b23818870bb65fa0ea84a51d256ef64bec3b9585896a7f812bff5f8a28b3764c637320d830fa9d1273e767c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab66F0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar67BE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit