7ca24ce844809b6c96b2a5ad8ce250e09c4c1f3bf593f2eb21e45c6ef2185b81

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4354f5f254274d2df426d31ba5c3ef1e_JaffaCakes118.html
Size

11KB
MD5

4354f5f254274d2df426d31ba5c3ef1e
SHA1

6013ce4a983a2c44cac7f77c13ff5ff6a6b45b7b
SHA256

7ca24ce844809b6c96b2a5ad8ce250e09c4c1f3bf593f2eb21e45c6ef2185b81
SHA512

41a85e471d9abc097e9f5c27e990be3f2bc5b9db61e2c7dc9ad71f3e1be800926f227aac0ddc0a6b7438992836850f621d9d4437179fc432bc93b226ca786fd0
SSDEEP

192:neWqUOF+U4AVSQCTQhrGkkEN65zYmJi41SuvtSMrfEg+R2H3jDWDICk2kN78b3LC:pat4ASQC3kk2DsREg+R2XODsN78b3LC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{223F0451-8A51-11EF-A1CA-D22B03723C32} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c89bb36f8ab6924f88c2374eed61ab1d00000000020000000000106600000001000020000000a87b130f16fcf3928656259feef61875de26e4077bb542efd04815d0623c0631000000000e8000000002000020000000ae507a6b23c98658de05aa96977e7de60a5874029bae72f9dd07b704aa3243e82000000064e7e0cffdf8e698ce4c7b6775fd216530cf6218f82e3780447076485768676b400000006d0bfe992ddacfbc440e7fc83f6dd300bb6c8af4df4d02eb0a7aa2780d553e579d0f0c5fa9615bd5fbd37a1deb04748b4d85e8bd8c54d037c53374ebbb7dd8ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c89bb36f8ab6924f88c2374eed61ab1d00000000020000000000106600000001000020000000e84cd063d8231a5b9e44dbcdf67b8f822db980a4adef825a7560c1abb4310498000000000e80000000020000200000007f35e43e0f92f5fd6ca83144fabfdb1a11309163002c059719f3edc7341db78b900000008bed174d822bb2f9af9d0f57ec2afa0e5943986b00ed6eade381e763cc6cc2a0e3ccdb51f2c7bbdc241d420946eac3fc1b8829b69ffcb3954713ec70ad4b4e1d72738879da86960916d9c20c87ab84c535565002f31022afe9a20d893a2955fc248d01c856e7a79ad5746597665dce3f9b1021b43aff33a96e311572e32f8592352a8e1706ce70c8b4ce1a8cf6ce164f40000000086bb06cc1b1b08be912e99a30b2578a1c4d3747639836765d149565ad508ce9f78a18a739b5fe201b8c48e889c4c2c76e59d06c383df494c97540fa2ce1b08e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435088525"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c8da0e5e1edb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1604	iexplore.exe
1604	iexplore.exe
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2572	1604	iexplore.exe	28
PID 1604 wrote to memory of 2572	1604	iexplore.exe	28
PID 1604 wrote to memory of 2572	1604	iexplore.exe	28
PID 1604 wrote to memory of 2572	1604	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4354f5f254274d2df426d31ba5c3ef1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1604 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f8b76d5bb9352eadba32110c1e9dd778

SHA1
f40ea9044122c87aaaf4e9132d99294bf4e81e77

SHA256
3d348e6cf0e6613a8099d20a0e17cd7018b61aa1e7fc970364d92358508cf258

SHA512
f32c80e855374ae2717e09782519de6a99f114ecf24b305d64571f1978ef2dcf1edf174d19e5c15b2ddd5ee406454216b13e7762ba4e6c79d763e53527931a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a633ca929d2cb9cde83409fd261138cd

SHA1
70e60425432ebda1ca19153992f949629bcaa1eb

SHA256
9bb9170f02258582e5a556513381db87a3a8bb7c9c1a0a73f8d0d56286050f63

SHA512
3e880f482a1c7f14dcf5ed14ef3cedd0392e9b47a2bfaf40a3461f8769a26e24f7230b993c02051be7c926773046f310d1544a03600d49eb274fbabb4e9692d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aadbc7e16bd658b4d51e45c21fa7b2eb

SHA1
fad6b6f33f95601c12d8f6247ed3d19b72ae1d6b

SHA256
48f9887a8e5c9161488cf99fa9baea6d65b7b338c306e7b93613165c5e4428ac

SHA512
c5bfd1dcf5ab120ac6aed0b581521999fb946f8a0bee0b5a8d88d7d63c93c9a8caa80340ab53a2dbc558110d4d4adf837698f56c1f695a6ca390f878e4db9ace

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1b60697199139c04e6689d843c50dc5

SHA1
344575731ff2a93aac94b46acefde57924bff107

SHA256
039098be49c0d2863fee79cdb72189aebc215781144a0923f791a52b417ed4f5

SHA512
9f7be3a6994dcc18375a563afbe4f1011c208f767b58ed1effd89ee9179b8ce6ff662a21eb188a2321b4f2e5afbb9450b98443d9b550139dfc20527b87dd3a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80bc2f0d2fb184d71f22c7034a3a34a8

SHA1
f8627054304518329a2fd218027091b21b9293d3

SHA256
941081f346c9eae68e2a578083d22669d0a1aeb260b9f0fee6202eac04d9c76a

SHA512
aca42f6be2d3ecbc95d8c169bd6c1100636dd73914e77dde3ddbbd26dae0ffb61885e4a15a338b662b930705ff15c4a74e39a8bbcec74f90e061db8605b12f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70b3f6a5a8e8fddd3f89e370672539a7

SHA1
407c3588609eb9f35a5b1b536088a95ba3894bb1

SHA256
3c246a66b6a66b64071b35022bfa7a3055d3921bcecf5c6036319920c877be99

SHA512
bc99d9088e61f70cc7a1bc013ada42591a78ef3c21367e25bb820596e3612430ad262ff75b327c99205193cd60d9701520374d27cb14f03302b825506b14986b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f82585f00019ee81ba419a440c212ad

SHA1
e3522d55f3c0fe0be7d8719259ec11104fea8f82

SHA256
dca9972bceea75b46d557f74160f4fea77c3a75928b5258d9c6e58436fbb7ed7

SHA512
498c90f57e83c290b66015d579abcfa1aa326aa1a55bdb7aa37318017e94b1b3fd76bc3a89338ad3adf7701715638252d442a07f407f288c36ac2ed8d570d5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e14e19d0feba208cfbd40cade2bfc030

SHA1
500a0221e70e08a202e16b9f552d05a68e9d745f

SHA256
45318a7cc9320e0664a34294a773ecfb7fcb214df3451c87d264d542c38c8ead

SHA512
f6a80394a384d4be3c79283eea657cd8975d72004b6fe1cc594ef16e22cb3a7b681ccb43680759b59e8ab3c0c671f8a3fc93de7f00f065c94b24be9da3b5ef1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05334793528abd648c9d7e21b6af56c3

SHA1
332d847482a214781b4702de4c10bdcd98a8d093

SHA256
e714544c8565c0acf6462c4582dccba6dcce5b37d804121d8c786ea3d369aae7

SHA512
d941a151bad5a89a08e495dab93168d5d0b872249690fe0fdcda7141857c21612f7927c3417cc515ca8aef10b55dd2bc441a3592e83fc218b91f9e8b7fd82010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ad86b4bd61c56e882dbd4f013de8d13

SHA1
546385e0ef99ecbf7d41b3323f3602590f7f8325

SHA256
68f8a3b05782332fe1c30778b218284884fb5ccae21f614abf34ba6143d9ebb9

SHA512
baf5277a2c9de39b297ee07167783c13784ef2f886691895c2aa77b6920b4f4bc21fd3a97097003490d8bb3a074cd8d3bb9d8d063c7658cf4b99ca14d73dcb28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6fde71fd01c2c2f2c117244d855522b

SHA1
666280e3bc1e2e0ad68005b338b4ab14e6617ed1

SHA256
71b7e1375e621bfba27e383648543f391a9872218d497ce84984678ddaa91193

SHA512
5601b86c5ce677d094d4c4d02469263f455903de0f0742e7b639254ff16952fbf8793c25d10442557faa0759b83171170897d412deb0e582cfaeb151c7409a76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e4648f52d5ba3df60fc748f8c2900fac

SHA1
a0dc2c4ab9b0019704e985a4ef7e7619e1effdac

SHA256
30d0eb0860aaf0c44b45f30fc45c1b48e5a91fe6d3eeb70c7aa90a1cf18091f8

SHA512
a6bd4f95e6bc3366aa809125e269e2d5a0da1cf62bcaf8fe944b1cb590319f12f04fecc2056a9ae37dcf53d181c68c9c4ba968f256ba0b459f1cddf29db9cf56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab46E1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar481C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit