b140fea1c97c82df4b45198b68c6ac9c4d567aaf181d7190879fdccb73d2f1cb

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4663e2213435df3c4a0db335d5c80228_JaffaCakes118.html
Size

53KB
MD5

4663e2213435df3c4a0db335d5c80228
SHA1

e6661e5c10f00b22f815d84ab23364710344175f
SHA256

b140fea1c97c82df4b45198b68c6ac9c4d567aaf181d7190879fdccb73d2f1cb
SHA512

8f9f0a74438e6c801df0c68139ce1db8a9b03cb9284d31e28bc8b038470d087f5a11c325f9b351b938f4af5074dcacc8fb84b9cc52f4d326958218012b8dc0db
SSDEEP

1536:CkgUiIakTqGivi+PyUjrunlYA63Nj+q5VyvR0w2AzTICbbSo1/t9M/dNwIUTDmDY:CkgUiIakTqGivi+PyUjrunlYA63Nj+qm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71189921-8AC3-11EF-94CC-EE9D5ADBD8E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435137617"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000009cc9af74565e38accff22462f80cfe40087f96736a3f9f94e5b1148f3430224b000000000e80000000020000200000006c82ec4d8b54cfac1020cca34cc1a043d85d6dd6ec42a6712cc76cef0e08f7569000000080b526648295e64c9cb01832ae967aca28d2bfd1a3511403567e2851393e05085bc0c08f48cc80983dbf7c18e890fde9f46515df8dffc9d0dad89003e7effce09f2d9c2068a07bedc88138e659557ae7be691983f6f0f12db79351e5349ec18cb61dc3a889b3e971b8e102b35b9a34246e7b6477c79f38132c637969286f944526d2916384a6b0e75190a66f97c7e90540000000dca82b8ae32de514955e3306b923245f1ef9b0dc7a40a72a8028a94409d60b49c3d42db763b1dea0fa2a240bc802fdbfaab6c9ece92ed061d3b256959138cf7e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000012e5354d3470503697d748897f5ce7d48aa39a9645424b9065ce6c78f8f5ec06000000000e800000000200002000000057bf022555cb09f188a15adc820981bde74850a970735614dbad84dc50bfa39a2000000059b17e0edea7a07e4d3df6f6bde082899df2c7a736b0201e34f168515e3b5947400000005ffdef15b264d747d423da30d443ca07e8f4ab81b5e4553f7cc879b38289fde8d29faa6a0a478362de4f6682c4f2404a7a58237f5144a4048f4dffb999bc1961	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60bba554d01edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1848	iexplore.exe
1848	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1872	1848	iexplore.exe	30
PID 1848 wrote to memory of 1872	1848	iexplore.exe	30
PID 1848 wrote to memory of 1872	1848	iexplore.exe	30
PID 1848 wrote to memory of 1872	1848	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4663e2213435df3c4a0db335d5c80228_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29d37f9c2d8ee7e409785c6c5b18ed56

SHA1
8453de58284f29b43cfb740a0eea8328b64b5329

SHA256
34950e067b21648e461bce947e0204fd159e1115d5c50672071f9527765b26a9

SHA512
67792bf624c300e52e6f4e208a2ac09bb6575e64754fb40253b108ee380ccc14c8eb7d82685b01366e76e81512e160fcfe92c4b2bdb322da09221358c3f25d35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e32f7ddce4c0bd061c3c551a2940895b

SHA1
3428de6254b38617dfbf35110a71218f5eabca06

SHA256
256d705eaa41a0b3bd853f46b201b77bcaac310beaa99e5d0e03ffc6b1f2f02a

SHA512
dfaa53354661674df7221f2c4fbb1b4ef779cb5f6ed9f7c1e9c7bf9fc2b632279dfed21731e341efe204a77d64c12ae3ce376ea592cf753f20379a57b6be77c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38107f11d87746b2578ea771f898f627

SHA1
baf90b2f7fca78bae656a7f18bc099bc139b3181

SHA256
a6f2e8da1676812e0dffda185e7a832eb0e0d6eb8b51cccc7cb500765f993162

SHA512
5881e0321d556ce6a11373fb99f1b42cf00c41a846ff57a3b71a298ee4b922d6e382c546101a3818d91e56361a99c2bc5f8db3ea6da7dcc8364bb361859e68a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
939cce4222877e4db871306482e9f429

SHA1
59036d46a799ac5ee67a368af270091483b61a2c

SHA256
667d66cd90f24b3675b6ec49035572216e17e5c3f8a963c7b46c66df6e9a6142

SHA512
04bd3f585239a303bef16378a22c363c623d7857da5ffd98c2b8bdfaf95b4ee617811eec01135474f2298d9a935c5eb593a768216fc78884544ac3334ea9b496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa3aa6300b391c965362d75d656a0a5b

SHA1
b1b356f12d0e68c428948537a3aec90d5d7819ea

SHA256
32964f9e5df1d9fc0ef21a64b7a18b5b368a7b82733a78533587f956492391ec

SHA512
15714136aa6ea6111c0caefdf2359b04effcb2e341663724bbc6a5b21904c40e679917a58ea8862c470a117c78dc7410e92c5a33e1e17d735208eb86a8a8db32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaaa4207b5c38c67e6f233b0467e9694

SHA1
434eb7cdb6544db43134765fbaa9b6a1b9f68d3e

SHA256
f28da24918dfb3765f406311b322085db2a2b149242d9c21ca522aa0d07b306e

SHA512
4eb56f5fe0fa5e909f885873be0722dd2bda32489743bf4e52e5692c75c708f7cb1068661da1d03d3cfc32084111e5a14accdac0ace1f4ef0a271da388b7be13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f86afa9cb5aab48dd27cc877ec11494f

SHA1
7a65bbd0414d739bfbc37d2338c535f32ed28448

SHA256
190adac40a5aea7de5a110ce4789c3b3f097833ff84847814d69d40e99becdad

SHA512
a28a748ddb8114171b6f5c6542e6098f224a494088eff5e67344cbce0d76cef8009d1958e51bd223d4cc04a96ee9630476ae157e4c750030f5404159fe84bc3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b00b737d99f5aacb0559d897121c3841

SHA1
ad171d58478aec047f6ac2891c718a35e7b5d62b

SHA256
b02d3889ffa4690037344969421c035843e557d74825575de76dd07f1233b849

SHA512
32acfb01380f9817fa3e02313e108660a77a7ac70b94fd53fcb6ade6dd079177f0b28e2fc7332f706ae71e9ba0994c6ad0c0a23c09a3d2e8dd5e8495148fde72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e932b84b3c184dee2d034610180f3704

SHA1
506d1cc876bf7d59b675c59dcee4e60c9b25d899

SHA256
e910cb7c282d9326f8853a2bf5ac7544b673a06c90a98e125e8d0d3b1ba5a232

SHA512
100e31e61e5a074a2df3ce26dbfc51a85db869e03afa486e3601fa188c1795edc017ac818040da8bfb5aaa50d8d210d5fde6024685df3ba182bc84fa3256c8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20b0d2b70e954fb474658c3f071cece7

SHA1
08ed4eb5a0e80a5362a7c27d068433b716864c52

SHA256
0a0c43ce74145dedc0dede9c2dc86258f8a470c80358066d613b55855e006cc8

SHA512
4070cfee3d9817456ce011b9d64cee14a3b7eeaefb7736e1fdfeda1795b924de889f5a55cc91d523e68baac66ac274cc095ea32cc203298e6872205064d6e2b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62a30d70f606951598ca0442b8bf4154

SHA1
28a7e3e37e91337cb453e80fa31167e39e2536f1

SHA256
65a0e4f24f32b63f81f87a440b1b58136d64bd5de2a9619e4807c9b97c12725d

SHA512
f903e33ee577e9f49c6452892ad03733f32031db4f9b39eb36a4086558b211de79e0811829c9ed286a6544d2d6972dd5d1e1c3a95875ba3e434966dba2d3c070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a4b0b8a45ffc76a11a668eae6c5aa55

SHA1
4c47e36398b462d7e7832af779cacf9a59b323b0

SHA256
c415ac8d917eff8c9ada7100bf5cf5277ad742a68e2d78d74e925aeca0a72a40

SHA512
1462f79f2c297c2997ae06f4edc1d27ac26013a0cc4b366d1d60f0f57890af10783258a7390a3581f24dbf494e2c0023f1178eabe7ac04b3157ad7205a9d8308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a4ad58b89eebb05b63034073d29ff4b

SHA1
2793e6ddd6ed8b4112f4047e917c4ba6590ea992

SHA256
06f0fd5ffa6f99f15ac49a3dc993215d2f945b32691f81e0f5452a2a901830d9

SHA512
87d79073c22df555a29212850f6f6d9fbed2cbe387ba25b74710a1021ded588f113610773f575f9b3d221a0a7f6b464681f3ada979da4d8ed1db749fe9a9cdec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab20dec65de744acb21509539c714d44

SHA1
587f0fd53b3c8e348ecf5eccca07399980554884

SHA256
995b19e493cbd70ef9f42456b321f006b4bf8bd8fc89ac59b6f7e3c90aa4a268

SHA512
d9812afca0964cf3d3c46af996f3996c4c9bb8dc8cf02c4d55f24d5b08c3d00a8d5407af784f3f1bf3761d021abcef42b2bc5d8301ba2603e340c4ea63ab9a2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
231f7030a56b9150b9bc2f21c7f3bb19

SHA1
5603c486ee5c3e7ffaaf786ed36cb4e029ed7b0c

SHA256
afff8dd95c8e57211c968e963ee78d61dae38b1ff5f55ed5d082ba32ad7eed6f

SHA512
a9fd803a86c90fb2deb9f7e5a081c3b65411dcd4883e63a3495261ffb4c482ed197b1923f4063206b804d11f053fbf06bc27ff1123aaf2cf03f33c41227c012a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCATT3E5\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4849.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48BA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit