b1ba1a31f4f6e4c13d9a8e3fab3dd3355079abf97cd3df9bc467784084c51411

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

440b10add740c368a184c0ff123ba185_JaffaCakes118.html
Size

10KB
MD5

440b10add740c368a184c0ff123ba185
SHA1

f3d8dd78538d7ceda80d2f98addb4b8daf5a4e71
SHA256

b1ba1a31f4f6e4c13d9a8e3fab3dd3355079abf97cd3df9bc467784084c51411
SHA512

cc7b6bef72bdb530705fd69a78e82830c8833becc2596bebb65c8767718f862a7bde8b36bc302108e0e14f12c98f0fb0946e0f55d32813b646e37eee807b8ff0
SSDEEP

96:uzVs+ux7LkLLY1k9o84d12ef7CSTU1GT/kyGKpXpGCgpd9lVHcEZ7ru7f:csz7LkAYS/cyv5GCgpd9PHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435099597"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100dd7b6771edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000007a9238535cc3646aa3380ae3a50685c094757357eb20bae9a583ea8227f32ffd000000000e8000000002000020000000f6c72b5f59445c53f8ebbebbf4c933ace8e061255b575e52b5bf76418db560ea20000000e78b42d365efa1905fd7a4358dac183f922d73ac2ec7ea016ca23cc293f4151a40000000f75fcac91a0f6e9e097847e30b4f8aac46898bfaef15fee2da80d4052f7efbeb9f25517e9ecee280e6635683dd84e434a476ed07539a0452f1f5ca5e7c73f923	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000448c8835c837115d28b56a7a0afe80d19e52dc62ba71e860c54746bcce446738000000000e80000000020000200000007921a1e15cceee1b504800b8f4148c071fa851fbbc665c92f859b2ff285b60169000000006b93be896049d41ca6e3007b41c810ec3753f995ddfcdbb08847bd0460613adaa3c386ef23f540d5c9a50e2da4d02b93f72147042acce8bfa232981f226bd70fa67ef8b30a82fbaca35bad30ee603596851b0a0fe2624627da224084874aa614e752774164a068a89830ab6867208b5386a9173f6a4aca5430e94e1b54ce989956910e7b7d68fb16c8d2955fadbda5340000000a096c3b7ee84f46975a555a82156de2d6d681ab2344dfd667311cb20c97380a8554f66ba9c3794a8a45dd225e8928b5f1a214bde6f3f04a1ee2b2a46078935f2	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E14D7111-8A6A-11EF-A9B2-6AA32409C124} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
484	IEXPLORE.EXE
484	IEXPLORE.EXE
484	IEXPLORE.EXE
484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 484	2296	iexplore.exe	30
PID 2296 wrote to memory of 484	2296	iexplore.exe	30
PID 2296 wrote to memory of 484	2296	iexplore.exe	30
PID 2296 wrote to memory of 484	2296	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\440b10add740c368a184c0ff123ba185_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfa1fadf748d21ab5d65bea6ce9c000b

SHA1
b75c129aa37b957f97d5e4df2672ac58632a4cfc

SHA256
4acf53eba3eba4159688a3edc0665c35b0b86484aaffed678c5bfdbf1a872861

SHA512
df80aaac383a9f9348f9a45a6f5513f8f947a2f4694bb26f781f9c15dc8dba0e05dbdb6919665d1ef92020e64e41b50febaa8d1af757b45fe8b2a5f8435e564e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe87b196446e92b64d6d298f8af9bb02

SHA1
e74e0b834d1bf21c593373b24bed830d54873e12

SHA256
4dde20222bcde277ef3d9a148064feba0527b72438d0cb5008803d6d553699b9

SHA512
306f0fa4d388b8557bd9b950b2e1a787db064ee35d584d326bf3dc37575fdfd9590127a5b0713e84afd7c921cddebe6b5bd894df5c3f2c9bc322866cfc60957e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6bce92cc60a9214b4c89abbf553c4b6

SHA1
5c5d1c51267d1f13e4e28e7f5aa48a7ede9a438b

SHA256
7481fbe96bdc8b875b76ca9873d5e237f85cdc7bd3d6ca0292bc50334b26b8e3

SHA512
7447de73d9ced4edd44f5bab0a49a11c42af7f42667934487593a4ebfc7d3bfdd4dca76c2a125df69d43b2ef4a8d6fa4e0134b36b3cb3ecffac6ec28cd35efdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
198d8552625b97fba7145a877641d226

SHA1
57196573681065b8e0071783ae155ff63622f22c

SHA256
756c771e22ccdb9ee1c29893472389c364b184b359565e3983aefbf2a62afcaa

SHA512
2fac6e5d4f63ea26b67640417bbb7889a828905b37d9ddbdf63dabea49cf92306957a5239bc101599e04edc19571abffc159a8832d147e7f0f7d7b0c53800085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5b7952798048eb85ca3da705a6dd262

SHA1
52fa815e4f9211ddff2a3d5c78ae7e18967a949e

SHA256
9e56069c448f50d50afb3a99607748786dd6ede6ea9d23950a4317107072a35e

SHA512
714b5973f18012670d1ecd4eaf7a26a2d4a9ff9e3b449cef2873bbbfa407c30deda70ef0268cb489adf7ff5ad09a8961cf0b19ae8cd75d7ca99e30562c275a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
937f607a855876f2d2bea880da1369cd

SHA1
2d7b5d6411c885ee51ca0aa1190142a8f39404e8

SHA256
8979084e6591e59ee2a262a143814ed0f0e11850ff392f06661ebc5061971798

SHA512
2893388e6386346495e37e6290f2820881ba0682387c9f274b2d7507e4c0a3b91a7d66f5fa70ad3b5e4392eb9db705cab6706ef9f8a17b0b087ec55a08b06b6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89ad9facea3da4b841797e950322dd9f

SHA1
b7bf8cdc3d6a1fc6677098aed456660f73fc0a2a

SHA256
30a314dcbe23a561d8e9f4d1e2b924840065fed2e1a6e903eb39e7b48bbb349d

SHA512
c8137e5c4b528330f7c7ab862da3b4043a93f46d0185ba8673ec767123df2c2fa22ed4bf0d0ad07d20bd5b93cd6b668fe7ab0822eec5174caa7001d814539d42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfbd5f5617bdb3c0acfe59b41859fb28

SHA1
53438b4e5911091ebe8ff23cbbefec63b0e6357d

SHA256
b2805ae37181cc43b8f75e82ee76908ee9cf6e5cbc8ed9cfe270f404767fa5cc

SHA512
a3fec7a432d90771fe7e026b4aeb5ddcd3e6c3efd19d6152120b27339011e470c83282b0d41076574316eac8551669e42df2e9cad3ab94263ba6c8935bcf3a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60ee699aa9f8efaa49590719f15c4115

SHA1
cf56544f155ee4735182385f621f93c08dcd2409

SHA256
7b587997e108c51f223361778e5a3469522aac5bece8172b072e51cf751bee3d

SHA512
85d64230edba9d336c669b7deac4fc03bf1b08d57fc18cc426f952490c317cbac516f5dfe0a2fc9a151bec7a8c19a61ac54c17325971aeb7ff29fb5ba0c094b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf4894c46a86508e9ef232e5ab1ed6da

SHA1
a372b0d860a6b35f1387c88a6d2d9eebd50d4b63

SHA256
05b4c40b5669b4daad714d77749e4b5861cf950f425ad9108d7979b4e216061b

SHA512
098c431ca9ab008d5352e4134b76e349362653c6ac086e4d5e81fed02b668e99f55fafa2d8b9f6842539cb0cdd997291978eecac298080b05cb78be66e3eca83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
555ae4574a2f6504870e4e26aff484d5

SHA1
f98480474fafd4df594afa30e17c45a5bc953fa3

SHA256
543f9010a2dff78907045781cddfc21178483345ca2e03d8d055e8ded798c36a

SHA512
e016578b180c72324dfba9b8238a8dd7625b4ea6124bd3aec03ed1e58ab23b1806034e6516658cb237cc8c0491cbba36ce849794899bf4347dc07d6c5b7e7e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
561410667458c294f6a7bad3789dcb49

SHA1
d3b51fbaa9a3cba3e476418896c95fbb90fa065f

SHA256
0d9ffe8bd0eec59d95b09167ce282a2b8d49a63d10393789f75b33e6ec507a07

SHA512
dc4f2a7d78ed88fbfe80cd5e50963a42b3b29a2e81fbedbf384d330a8d282a41ddc8fc2b4ec93fb85f5a36000f6154f163884d12228b8c2ffb6dd3da381bfb97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f53524dc2329532fa93546779235e03

SHA1
a5352f30c23ce66feddaf65a6df4c2f5131ccbfe

SHA256
229eb1133e4b2cf39404cdaba64bca1868d2981ee60ad22c16c6d7fb43511b55

SHA512
5b450fcb8041a722009c678ae6e2083eb8bdf207a80c540cdc92c587ab306e0ad230e2c0c6445e0b57d8d33ecdb7f636bcb3db906dd704aa3f888108917a5a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e402afefbc4df98a6e866a1816b1f5c3

SHA1
27c6c622fac9c7e4114a78a4640de6826840e394

SHA256
142d98db17959387b0461dcd31c01e63f082540b9e95e8581b7912bfd20108f4

SHA512
71e194e0cbc21c53b443af6dc212396fbf507d2ede4383fb30f27ba816e1a3e2bc01849b16051df63a29d4f4270b0ff349031aea62c527b0f16d58f2ad89c505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6efad9ca35b2309a5df13341ceef5f2d

SHA1
8af7714fb76127576d43d96110be6cf81ad2c038

SHA256
5369cc068974b2d5d6b352206def6d73a367ec2d31948564de1c710e45971413

SHA512
553f7ce7c09843d5311244f1b74f699c16a325b7d6409576f1d449de2f5774e18a0d6b397e4db21e8c3048c5b0c1fe4344e122d37a97168868e98e6390aa7c51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f392dfe43eb25499634e0ac94da008d

SHA1
ab8a1baab6a986776e1ff4e7497fdd4837c385a0

SHA256
8365e840c0d63c0101be2d5b277ccacca4959e5935e8fd1059f6be771d27bd9e

SHA512
8bb8ce0fee2b1e094e2556cebbdc25228107f79a746a41bc6f2497f7d4421c45b8fa1271284a19a365d873fda179b5f3d7d81123f09edcb7b732da89ff3e0b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE285.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE2D6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit