19408d004c5456824ef30ab762ecf2dd9a8c68c47accbb2afee0484b99f82a85

Analysis

max time kernel
143s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45a226ed333e8335684e2613fb15f26d_JaffaCakes118.html
Size

138KB
MD5

45a226ed333e8335684e2613fb15f26d
SHA1

a63b3f1f42d0771de53fa2e9ef38f6f0e042f226
SHA256

19408d004c5456824ef30ab762ecf2dd9a8c68c47accbb2afee0484b99f82a85
SHA512

1f294145325897c5ce9ec9db05952014ef7fdd6d77a41d3cfa07ee31a21434d9a8d7300bc553b3c10d028370e67e292ea1d25b72b54f3cbe7b2de9d4f28aed11
SSDEEP

1536:SaHKq53SGu5fdBs5bbitfluyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP06:SaRyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f56562b31edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000b1ad7e5eb3ab43f8b634d31fba658e598ffd637446339d2afacad73b819e9343000000000e800000000200002000000089a197a6ab55256cfc88edb9150b7d8d4028bcfe147987fa73d1886469682bf890000000a8e97229917849d12c510e27bd80ad80cc0841bb877555ece3c70a8cb21cfc569cac0a4477039a3fd6d82cae224cf5bd2a78c569bc41cf9a82d98ec6ad109ef9aac1431823bd961a8afcf547ea44936e6d547bd73d042a56bb07a29677be76d690fefd74216f3b39bc15664acb9f70c878b0478b040a3fa8504ea74b4c9e3a1ed3fcc59a25c0f67cfdf696bdd97736e140000000dcbe12ff45f3826d683082a8b6727b935b01e498c7d1e1356b002a9f1ba2daceca73aae4e9c7e6224ab2b96c1eb3799cbbb013bc1fb9c5a1b92cf15c70ea09c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000172317737c1ac9cc259a70222eab9ac86ee07ae34703ddc3475c243421f216b1000000000e8000000002000020000000201a856d51e3f9cc9d559e99548339c6b45e1173df9bdd49b3d012ea8398cf6120000000b95996e820465680a94dfe8238be0a972287d75faac77e4b14dc8c61a955041d400000008f1f814b2d38606140d0a539b0fb6f8046449f898272f8e24969525ac4a6a22ae74f30ecb22f3fe5a325b18d0cc0cf7352db713857b42ba9e5640b44de88d7c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A9C4C01-8AA6-11EF-B2CD-FE6EB537C9A6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435125098"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2548	2580	iexplore.exe	30
PID 2580 wrote to memory of 2548	2580	iexplore.exe	30
PID 2580 wrote to memory of 2548	2580	iexplore.exe	30
PID 2580 wrote to memory of 2548	2580	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45a226ed333e8335684e2613fb15f26d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
748b14be4d9d57dfa39d6594dfa1d74e

SHA1
8f22eb14144c0a59988b65c696e933fb0dc8004e

SHA256
e12b2db68fcbd85fd399b43ec64dec73239c902bddf7eb63360e1c9cb42bddec

SHA512
53658e09c6f06d93a5fffd752103f1e7d002229e929582df22de31c892b539ab1d7eda900fe11335dd1bae6051650999d9540c4921d2e2f178bc76105cf967d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8455908a2f6ed4fdd7aa251480d43b67

SHA1
481820cf3759c255f8d48f64a4649dadef5f823a

SHA256
377b42a583d874cca940639c50215953d617f9f88b415283ff3c91eda742f1a0

SHA512
50549fef440ae9c6f7661fc7db53c6a525f40850aaccd7e5c965a05af7a7f2190d6fe70f38be39cc4a817ea980a80515dda9c69f6967ec76142493bc546a2911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5867bf7180c27e1e63a13d3e5a8ffac6

SHA1
15121af1890f9c824a59df075e2b4b4071375456

SHA256
87d7491fd730afebbf890b8f31853b6b85acd242b85e040f7eb68031e7a89122

SHA512
5ad9c203ba97df337d086a7dca11b2aeff55afc28b0a179ddd605963b097dee6b412015d1aab1010bf851379d81cfd19ad6e25610f2579b238a6490eed6b4e33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a65fe7763b63d92145b29a651739554

SHA1
6f2fe8726c37276296d3a170860c74c5fa95889d

SHA256
9a3ed07d3017ee3bc0021d278bff4ca439374fd8f38e6f442afc1ee83cf71881

SHA512
ba8b7605656c937f2337061143e1627de634ab4bf33819c7dab684d24c21dfafc159c3467927ab4f03af2607814560061edd589fca2aaf9cb9ce94936b5de52c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b263047e94b929bfc0fc34bab584406

SHA1
e1fa20fda6174bd807d2d91a47854409d04dd75c

SHA256
1246af8ef8ed9012d283afe49c334869166623b5d53c6ad6bff7790611ca05b8

SHA512
3bc6c14a7b22159774aa9a3d1d83de59ef5612e42049651857861bb5b264d771f6483474e6927e7b2f6d2694aee5226b8e73200af855565a77c8da0bed272998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ad0aceb1a577c161eabe92e14d84bd0

SHA1
2c81f86f2960395f902bee0030b45e52fe62793d

SHA256
eda92fee652858906a7197c4969e7bcc8e26bb657e439d473f4bed503930faf0

SHA512
5aebaab01d6159cd3f48f47b33c43023bf7f9c96878efff8917850bab4187f633f877d7632cd454ad6c60fa8279ba7f2c409573028529366e689395899279057

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd22c8da0b69001c3ae3216d7dcbe63b

SHA1
87d00d7b621f92f45d54bc236faa1e83b7700d0a

SHA256
098722d1860cc306f16eeb4572877043ef56008026eca06303db9486288ffeab

SHA512
0049c4360136f1916e0e6902d9e5f75816455df2829fb2d6eb238657d10db43bf1d47a92dbfa6100500d2fc417cfd54576160986e60f63148653abb6df673275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f3b0f2d44bf4673dcc31963a7bb104f

SHA1
ba1242582b31997d9782fb5625d9cb4d8b256830

SHA256
884a27d28e210814557416eb401bd2f9ec433a643f0a4ed2a8f2c156b866863f

SHA512
bde9c7e87a306c5b04353eaf734a330d3899068dfc266f896143e9acca26e42b660aee7e6d139e866ed2579bcc8cc8772329b643bd313acac82248151c843b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c50b3adc338ee74dd16621d0ae0f1e6e

SHA1
de51e456e9f49325203f3a03fa8016e3313d5f7c

SHA256
ea090cfa6800f70b6a0ec496746deb6cf5b402c368548f6995be7374f729cc75

SHA512
059972c76767c9dfc6a9cd00061360e8f5831cebed9d3a6b3dfc70580c7b2c307f332f95db916592134d78d425daf2a51d52feee9a754982468f579756f6f087

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42c05b8096b369f12854cdfcbf5b55f4

SHA1
497f6374dfcdd57d019bf83ee3f183ec7166d1dd

SHA256
2e703601998d8b716fa61cd987dd1e7e1f502c5fe86bcaf2a71360967fb05829

SHA512
956abd25fd593f5c1ccdeb0022329f21b831d35bab9f5e45758d6fc8b94cf974bcc72822c3bad41236dccee4e551b4e2f70c84e3611b8de1c25ed21508bec779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0988626eb99c7ea02250af11efa84339

SHA1
b8ab05b91a034bd22187db937f354da643f91e4a

SHA256
717267de2160e9979e49091ac28d50e77fe15623b4e169a056f78f6cc721f3ec

SHA512
65857b8ae04f24c486aacce05ca3056118b651d8ce56b7ef85487a34c4655f1bc063ab0490a1a81e6b20b72d1f870a463fd52b9ec7dea0e2a47e5544917a4aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA860.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA910.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit