651d01b19ddb8155b57245798b93c996e7e9674dc9487e06cb61dbf5020d1c20

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4508c476c37c0b82a5fa3b4d22293668_JaffaCakes118.html
Size

139KB
MD5

4508c476c37c0b82a5fa3b4d22293668
SHA1

50f85d3e226cba3ba4eb2fcd580593093fa49417
SHA256

651d01b19ddb8155b57245798b93c996e7e9674dc9487e06cb61dbf5020d1c20
SHA512

cada4b9a531018ec7df6df8f4f544f4b4472a4f76ccf517b004f9d22a6e3a00bd844913fe037d2ce24aa356dfdaf7b2128b64a56a3d1ee65261f97dd85051495
SSDEEP

1536:SgNXdgqoFXQBgbbXICZlDWpyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP06:SginWpyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435115678"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000535709aafc10a5f4bc80902ff8c019b94da3300d8dd5a83bdef227054bec599e000000000e800000000200002000000050b02f7b2b8d855240295aef81d20fb5b0cd0e6f69018c50ee5b55768068849b900000006dc3991ba09c3a594072475e28cf213216fce5883604ecbf9c1e6e4d25246ff5964be5902b83c933f03b6a8fef58885f375e1609b2888e0ea7514f7639436dea2837c72802172d6d6c36808300c8587b64033d0c6cd36aafc38715ff2553da479a39d1a0180a33756a49ed6e7de6076fbb596fcc83caad7d6ae28a5a330767876ed725473ce57894102d5db65b0d6ec540000000b7b1f068c053aeb33c8ebaa056a7b0902a85c41cddc18ed0b122ae751d3db644f69c8da21c1603784595f385766b10e2f4db8ef1fffc610ce5f1d41d7b31bac0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59F2E121-8A90-11EF-96DD-F2BD923EC178} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000ba384dbe1450c415a8fd7c416c74e8655c5d2ca9832f499fc95980eeda5abab4000000000e8000000002000020000000a47328c4acfa418849f78f170d3b2b53105cf1c106458ee3c1c000990f7d65ae20000000fdfdeaf92fc11f696afc26a7687f38a2179b723c073e0bee1ed1b35bef8b9de44000000021514006f1fd7350692512476254dc1f70fe81192f3ecda8aad7aa94d7032f280cd859ed49f3a59c36556a938f23cd400ba642f7550c2d2cb366fd6ebbbc4133	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905533719d1edb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2940	2164	iexplore.exe	29
PID 2164 wrote to memory of 2940	2164	iexplore.exe	29
PID 2164 wrote to memory of 2940	2164	iexplore.exe	29
PID 2164 wrote to memory of 2940	2164	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4508c476c37c0b82a5fa3b4d22293668_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17cdfe741bf3e285099ffcfa66bbd7e0

SHA1
14e744b21071841f7298ccc813156e7edb21d23f

SHA256
b572fba2f89bb7678408fd01f19de5ffb5483aac77b11117b262c7eac83c9901

SHA512
eb2d705eec7238e90a5fdc11e61ca0529412e61be6b8181f9e17d58e2bafed4041410fdf275cb7f8b629bd935c05f8c7ed1a671be3864a79e595ef023d536e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc01c6b4fa7721650745382c78be4385

SHA1
a560910c6918eeff22d8208c875723b80323b118

SHA256
74314dda7041382343bd089d1ddd51f92d23b2a5d39b61c4b1470ed3d7dca545

SHA512
2d9ae2a83bc101d70dd15a347fb1cdfe51de0ec899771399ba4ec91dc913c2634fb33170c41ab4d646396e032f7f23263824a1439b8e255bc914585576e92dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4769637a8ee2572c73ad09dc38e3890

SHA1
d5aaa87643ac092fc27c7d4ef19a1f179b6a4577

SHA256
02c3ded38bb842d3fafdf22046bccbfdc7283b08cafd046090b1413ff9ab6663

SHA512
f3574a6c10d70628a412a07afab51ef0fa71276a4a37f0de6c05fe01c1fcc4c7c0c85d55baf2b9638f6016e1745fc18f5d8e70b9d3be4f23d2b24cdbe81b514e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ca7ca37e81ed7da46a52bcc9d9791b0

SHA1
f1a12eb83c06bf42244c6e8ab10e3ef7b3a9003a

SHA256
ea93040d53269300c9503cb8bf5d9bbcc668594263ac3cbef6b042d08c3a0d8d

SHA512
42a032807a4b933c0f14707e70b7ef5b7f1f89f485001db7ad7a64b76a136f8444f7c8ee4687759d5dac307d0d1fd3772b7fab5eb10235eff54252294d0ad781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb240c6dcd004bd72c355973681e17d8

SHA1
11a058ce475f07c1e6e27aa4019492535f5cc64e

SHA256
8abfe6714a876701e25e952f99af175ba01af5b37e4da4259391e5cbdf9b4347

SHA512
56b5536e42f04b3adaaf60cdab6d5a67a89972103cb41cdf0a7c78c7a0c340ed6ae65c7e7320633c14b94e8a74fe690ee9ca74ec235add864607425248a64228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e43bf02ab96ef31943b9ee2c30b18ab1

SHA1
11ef3420956f74c774d24b7b9562f568f44c91c2

SHA256
a9aa794482bf92a930cc7edd76335e585fbdf795fe4f35faf860d4755b36bde6

SHA512
9d81fd5157bb9e3c971997dbf54b08782d505efe73c39d2480dd526360c1dbf21023ef760f48b81f624b03eefa61c58de09b3b40468b3e523f7f01cb3e5101ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7bfa89d7d87a0a15cf1827bd4c4f76b

SHA1
b93f3a902726140572c70ff6e25192f0046cc3e8

SHA256
1cecc125c4c8a1d128555a42804dcfe04cfdfd202e18ea73349699a7bb40ffdc

SHA512
4238a6479adcc406509857b88c0abe164b058c6942ff62bbdc4984f8f5dc78e20d6a87dbb1deff9c5f303d90c68c5d3242ae4d586e7aca5886b8b50caa5ca5e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1b0b01e06a7ba32fca03e15c3095c76

SHA1
83d559226d4ae7730026d7ef5077c670dca8b935

SHA256
97789693f468930321adfea8c523da7fd924221156894bd7f82a07c1a8644f3e

SHA512
3f6ddeb64d095220c87460c78a015c042b75c2602c108eb3c6b9148a2cb852ac6aca0cd1bb9ad5df41aa0ec981318df1b2b8c6c2f998d9e72c42b9392f7ccf9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3568c05b00fedb41b66480de13e084fe

SHA1
d58a67eef07b207d07a86bade87a42e6191f9a80

SHA256
cb219e12d0800aa04316e4fb3c8e912b7713cfb0d818a29dd73678bc0d433609

SHA512
306e2f97ea1973884ebe9fd72f7ecb6cb4cfceb34bc756a5d509aeaf03e38b953e054e56f605cdbf74cb9d094ffbcf3c6fa903ee6816f537c39583024171f299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42d20d4d36f182b2f51c79d148d45d2c

SHA1
da87776fd8743b45054646ab9d0ad677e5e34011

SHA256
d69f12b060987a6fae540e6a77eeb470249a776752c5aa4f6fffe8d8a2d7ebce

SHA512
c469134cda5ad5aa3c84868549d5d1abb4fd677017abcb7ce51408e4e4a9477af3e9c5cea1df3ef330625d2c7d1ed829cf48c0ebac1f43c9f09f60cd3fc57a11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a7b5171794ea0a93120016bf550d622

SHA1
6fc77fc2da855ece05efdc868708c48d2a8315bf

SHA256
c9b65f9464322ef0ccacd5eef7508e3ec12a8ce733f7dc93d8b9a16c9214c1a9

SHA512
b187132c75a22aab88334f4ae188ed523a6f3f14540acb99f50a4178eb76232120d3c6964b35989532a80c9618608a98fd122fd102cd43250fdbd4e606e1982e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabED2E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEE1B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit