0486bc6ca4f649342ab30b88beb5c6bf3c996e74dcd51b1ff74d739108870688

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4326f47ef78154d7fc7b6314451f0767_JaffaCakes118.html
Size

25KB
MD5

4326f47ef78154d7fc7b6314451f0767
SHA1

c478b5eced7ab227323561fb7129a9dd96332fdb
SHA256

0486bc6ca4f649342ab30b88beb5c6bf3c996e74dcd51b1ff74d739108870688
SHA512

6e08769c39b43021a13f15bbe9c77a6ef40d1cf0f19141e8e343b8f34c9b4ae8d6d8c867dc24fa16be1e053dfdf76b80ce36562b5c45bad2b9e24bcb39054a34
SSDEEP

768:Sd+Dm4eEhaILQAl6/KsW/xxAS/ki9QGKXiymq02YphwjFOVTWVSxsKS/S4xZ:tkEhaEY/KsW/xxAS/ki9QGKXiymq0Zh6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000007a796fd5278482e2ff3105fcb80b6e27926ca41c24b258d6866a25cd0a921920000000000e8000000002000020000000ebca8449c5cb7df2a7ca677c4a1e223e6cc63c7b4cc29be470fbd595b1d51f88200000007d32615551482a0140d3deefcbfd5cc2fdf6856e4990c1bbafd2261d9b08b14240000000d927ecb27dd9cf1a8778760e0d6eb983d034c7ff40812e3af929140095f7e0542561921c417b0d28bcf2ee27f5a4db769e45b1f2de668bb74b83e7b04261a151	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30679bd9571edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435085897"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{050CCD01-8A4B-11EF-B945-527E38F5B48B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000009a31139be8334b75bb5c4c10dd1a27b001889b98af68bae4a8c118d373d7f0c7000000000e8000000002000020000000ea9165ce1e4e8bd63f4c6050877cda5d66719372d8ef08dbaf254cb6242ff547900000009d154193ecea7f1e4d1ae5c2a2400909d94ffc92d7f7e068843e8f8ed18b622ee7a70d97345808c890f49ff57f422a0ef749c5923db0b5c6cac1bd8b4d627bde6d1fef4562b4c44936ca82d5d4cc55ef7eabc4347f2afb935e6911a1876edacaa76c1d29e95507a230e8007cd3702efbd499492702dd0fc00073faebdd9c73d77fff75218503dd039ff0a36db41d0e5640000000dbc7f47b7cff59bbc8a33a6360065ce9d43a10c42699dd24f3858a2b845c941df81ac3949f6b746ab2549c352ab47afaaf1f65e32ca2cf85b7580de3aa2207bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2824	2232	iexplore.exe	30
PID 2232 wrote to memory of 2824	2232	iexplore.exe	30
PID 2232 wrote to memory of 2824	2232	iexplore.exe	30
PID 2232 wrote to memory of 2824	2232	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4326f47ef78154d7fc7b6314451f0767_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66abe637039ebf0e99b047b1cfd78bfb

SHA1
c34d41636e1b0f673367023357c5e1986cc3f59a

SHA256
1ea0fbd774a44a07a9d8e1bfd04456ad1ce55293fdbc843dc0cd45b54c172b0d

SHA512
beeb0cb8d84d3c85b4a5033a206392542b1b81566c76c094ac8c4696c9f4500dcb72b07b8a498cdc03b9384cd6f3f7b2639ff1140e1f8bcc6e4fb14e438153a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9db55583b08024628062fcd40f32451

SHA1
678418995d89d12d8b5cabcf9a79757fb8628f1f

SHA256
10085201daea2449f9ee24209c3cc2e6904b42fbe0c181fb09fb8c08c1e8b161

SHA512
8d12864d1597e69310ebddf61f391542f32de05f626a275e6e14cce9b72d39db5eddc2178b71a6c49b46e4dcd881b1c1b68ff1c9e9479df2b88e3a2acb14c396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6159e97ddcffa1cd51acd7727da01797

SHA1
e8a9a09a5cdea2e437e46c4ef39efb0bf759bc70

SHA256
4854531132efb091e67fecde38c302102fe19e4c79ddb93705e747721fb9620f

SHA512
ab945ff339c31641dcede2f7e80e982c84822e3ed853a21b18b8bd0cd4844f95b71e7701209a072755e62e7d2290f0bb73b3a1e6220bad0283ba0ae87bed0156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
600348de6ffa292eb5b57426f71f30b0

SHA1
48e4d10adc7bcbe227d58b65c181d24345fb958f

SHA256
ad5900d8199116d83251fd1c8f15d56c365104fda1cbd67eed095e366ef23d37

SHA512
bb3722529d50607a2a9cea6049752c0dfd35e3c1b8cf1d9c54d1b53bb1ef07599271a600046bc69041a9db8ef91003d6ce9e09e9b9c57ba5fbf6261fe1f9b5d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5d97d6adb64d8908b8884a49a2e65bf

SHA1
4f95d71482a5ca5c67fefdb5c3115977c4e0bf63

SHA256
71463e5823ab51d8cf78a204f4c7494e6eb9574183cd75035fe3a603d70d2ae5

SHA512
d0be3b3abddb8677e617438b01a43bd248d504028a5dfae35443f53efa752f19993c7a61da32c8014e7e6b11cc8421096eeb2d9dcf3191d914d593f41506bbf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2547315ffd65f4ab95bdf300ae92f419

SHA1
301d69bc6c5d1eabb1aaa649188f872dcc52e158

SHA256
e8c8338482117769d44699a1eb40aa3a6899c3444005b001d556618efb52c4f1

SHA512
90e9ff477676d4ffa424a6c186d4ce4a1196aeb258be9f903dba2500e9613054e053939b6af6e4e71693783f4e448a3e4229bd3f0f5bf0f1018ec659f2eddebe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d7a9c0876e8e850e9c136dddae0acd4

SHA1
6dc814b1b96fe9928da3e8a8c42c064e07557e7d

SHA256
9b2b1c74e2fc2d23dbc60d06522d7d893b2c34e674281fdecb758c66a26f5006

SHA512
19293283f0ea1b43b8cd9aac1eedbdded4fa72080859f239be2987e746c4d27311ca923e423ddaabce3be1d292e6b86f921896b9e96bcba32eaa23b82f0777fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a9b3e7768f01ebfe4880076e1582437

SHA1
dcc3beff13c061c1366f98b2ffad48e6a52cf78a

SHA256
e9a5fb829776dab7a87c4b6d1f7fb6db49d58be2582e2837cf823e87ce38dd2d

SHA512
8569a6b68e75c79efcd322140d3f58eadf3bdca6104e32b43e2d5fb892cd5765678f3a762140f25eafdfbfbd0bd4b256d08b339b1f6061339e7c229d747efbef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
407933dd9d9e679baa665ac0fbd2729e

SHA1
e32eaacbba14a2fd453ee1e8851e91c78faa3ba5

SHA256
813f842adca64aa76f558ab59bc34cec64f5f10e7908b53e50cfafc65aae2ad5

SHA512
f2fe4a50bbe678fc5ba4b868e3ba67d3be0e653259d8df8db58ce3a3e296bb62de22d54eb8d7316b6f961cab1497b65fb63f8262b1f3991b72f508903a98dca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fcf0a526c5e420615d5c20f5ec08540

SHA1
42272e29d61e4f5aba56d253a7d88be3f6338e3f

SHA256
a2965b4cfb745248b14ca063d62d374def13d61b9dcc72855fd557dbc325cb6d

SHA512
a9258fe654cb8a13f75eb7df00217fd3951a1b140f22bc336cbdd9f0da291d1b6a22b3b3c7b8549c4af0364541316fdae5016d539049b07e4112b34645e286ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFCC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar103C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit