ce4adeb3271e7c1c56b4d517a5c4414af15171117ec103660d2ab55b73902343

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52096cabafc9a1a85d5e72e440af06af_JaffaCakes118.html
Size

48KB
MD5

52096cabafc9a1a85d5e72e440af06af
SHA1

f87494b7a1ba6131aed014382a7bf61bcfc80eb0
SHA256

ce4adeb3271e7c1c56b4d517a5c4414af15171117ec103660d2ab55b73902343
SHA512

65d76ea9bda6c3929c44ac75dac1791dab9950b80e6452809a7a10e46c05566d2f6ca033a2badc9d06168a2791c65a797a60cd39348d7556ec7d1fcf0d74458f
SSDEEP

384:bIf1uMNKacfupBw+paUye+EvGiUE9S3Ag22sVtr620VU7rI2rVXrG8JjLULM62Sa:bIf1JLcfMw+paD2oO3SNvK1fapYNsQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{54832261-8C82-11EF-8D9B-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435329553"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000f93f325190c583181d8d6822f5fd89f97fc2c37c0dfb4505c90c33196618158e000000000e8000000002000020000000b9dae982037df661251988ae92136829958eb8dbf356c999a7c10dda47d18e56200000001bfd0bc3a1eebf5ebaa50d7e1ec0941d68c34e00a07260e5cb5ef637dc401fcb40000000bc534e72773668161107c2caeaac345f3028648089b3611283591269d8a15b03f7fffb763abba0c73780138979e0493de5cfdfea10b0ba0a011718f2879ea908	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04595438f20db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000002545b918c05af942899c7cce73a5c798f6ec2d57b4c77151771b267f7a3b4178000000000e800000000200002000000024eb039845453b533d7424d62844b6dc672bbc58cc9c5825ee0cfe54e6026ccf9000000016e05aac44d1fc30ee1243ec3c08b51a0e82151f169d3da361d57612f7f8172475f23a3c6ae379406b14b1a17b1c4e3e367a25fef95cdf11144cb659d07e23b2b7e394a8604c616b3edad591cd5652df2db3f894144cf8c78c47c4347be23661971cdbc75f31ac3cf6147798c9b6fb3be0ed9a2e95eee354ee35291b93f0f19988205ed7d1d8a1e03df3476c5e39d34240000000927000305a21bc316588dc3fb3b3a4ad0bdf24523052e71cb4efe0038a02e9fd369e004173a5edc3f2007d29374663c2bbecd70f607a6722998dc3c86256215a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
316	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 316	2328	iexplore.exe	31
PID 2328 wrote to memory of 316	2328	iexplore.exe	31
PID 2328 wrote to memory of 316	2328	iexplore.exe	31
PID 2328 wrote to memory of 316	2328	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\52096cabafc9a1a85d5e72e440af06af_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
be64c57d2f08d2503b2080c19ef7480b

SHA1
75bfa2a6560f9703521c81bd6dea791defccbc59

SHA256
91f44af04af585ce112b0919015346ecfa4f18ec006a985cea1ecc5ae04d5ac7

SHA512
1f9ee814ac0f1ebbe2f3b760bebb2e798f645aaf0d2912fa9eebada384c8bc442d439ba0fe5069cd9fd1703be810714e1bffd921d61cc543c086ea30691654ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e65032ee2a4433dcb880d7034e5608c9

SHA1
46b4ec3bea2da5f7d14da5e0e78d4f5bcea46027

SHA256
5a9dae9508630691e8b29a0d65f123f4fb182a9f7b93fe7bf760c534f12493e3

SHA512
c1e4a478ea537effcf5bfdd645d380cc6511b75b234e6abb9adb525218fe68c47cc7682e91430bef7a7fe254941084fc1149ada4690eb61355c98d46edf5fb97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cf4a046c92635293c880789ab5e11b1

SHA1
7d04bdaefae6d127d4ab80164e96cae2f9289b90

SHA256
f663c3f04d13cad28a43ee8e9a0ba5ce475b1623d0cfce588149ee9a435ac6e6

SHA512
3bd6b54607d289ad1338447bd304d549ae86d9cc4eaedfac9b561913d3af6b562f6b7eebd40c92f8a677ce80ccd514f17ecdc499b5b467564d55b3bfca0eedf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2750191a19af2e5c6d36b8af0c99c9f2

SHA1
fb38b82cbd1635506e81a9e9083933f97321dc45

SHA256
effc0ce2444ab6b1e09af226d8e26644d84a0fecfa59742b309d7daddcf33f1d

SHA512
741170e9ab28e9585d46dced55947f9e555453f94cb6f778bdce3ec93d57eaf6af2826e5d94009eafb79fa0cce4701f70435705bb155c3e0bcd1cf8e93e71f29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ec6a9ed4f83d57721b37659f318eaae

SHA1
353114718b524e2648bcfdaea4d0950678162abb

SHA256
1b9a40b1d4aa823d6ffabfc12254a74356683ba238b4544047564da6343cab78

SHA512
28b1bcf985dd5419fe791d1120e6909205a7b5e6d1080741f9e8fc9c372069ab6f2c85d4279fa80e1ba4480302f03293e5a06628b2b6c4befc4ea8e2ce9030ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a556a0e724e3dc477e0b6e9633421911

SHA1
bea2f30d2a82ab2dd290aceeeb57f3db59b713da

SHA256
231f747b049fdd648a3de4a358a018a532f54b1a343a6c367bb79b91cdc87f85

SHA512
6f7a8c2c21bf58930a283039c867d1cb20d2863f9316919346d1454637a2115581e978fe8f8e39a513c6c1cce94f4940865c1ddba86223c5a9fde80a25205758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f42705c8aad546e39b885d7b3c54192

SHA1
5b7be9040c993753b2d751446d547c858f175560

SHA256
caf5fbb09575f8306973c7ca649de6fd3ddb12c17d98d6d07a0ad6e44782ce59

SHA512
04309be4fde258565fda2c0cca9988840c5f18d830b0714dcb93fad5f18e140bbaef42c03bc44115144be0e57f2de383274a63819c61c3707114927bab310f37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a96d26daf063ec36453af805b0b0d85f

SHA1
2c3e18eb9670555c8be8293ab7118e8a28ec439f

SHA256
70e2f7811adf1caeba6ccccb8bc13823e44b5e0c84cda6f7a35cc3b6030c8adf

SHA512
8dff9152e8a7da6f6917934c3c93d284f12eee577313087a5eb7127b855beec8c343fe9864777d6ddd2e1452799672fe484c1e7eaed6b5cb3a9209c07ea2314a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c864742b145dfacc2b071a0726e532fc

SHA1
6c4cf12a93f56e11de6b2a7d7da522a9ec07e785

SHA256
15bcee5ab07c3aa6369f0d5498ccb5ac77c39b816257874ce0ab41848c9539a6

SHA512
ea9f54131a82412573b4c6aabdac01a556516ed60353e5529b353b19b79917df3fe339c391c6da6b08fdeaeebf2a71f6182f5254fd1ca1d7dc1b356f71f79e0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
237f7bd677c684dc5065dbbc9277e0d6

SHA1
381dce7ce35e609226786ac4f3f2a7aef06886d1

SHA256
bae7b05ba29ed9b5fcbc0f6f2e9f6af1be966f186ebee2975518ab54ac65b352

SHA512
d1b21a508ee8c32a1c7a29911752c86357f74f7ec07e65fadfe36d461c293b697ec10ee478d8e56f300c6b35b12e459d12e6b32fedc6c643be481b328b77baa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20c26c1a59d6c88e51766c180fe365fa

SHA1
6bdaac35fb3f24014dde0f5f62e5b5f56cd3e47f

SHA256
b0db2da0fa2e33880b36f70dcbc47024f61892a0373e2dadbe3292ccec13d6fb

SHA512
697749889706a042615a2ae86fd73f03999aaec05eb992dfd055cf22e25a2bb80ba9ee67d57762051d8f2e20aefd9f0b63a5dcfaf25288f9b3176dc0da6209a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
eda065dedea97da2cc9c0af5751edeca

SHA1
3832a6535280b7082ae33e9933183445a21aca98

SHA256
8a94a9363d3ffafd72eee98770e45ef07d17e44c5a407798cc85522488f3b364

SHA512
5be49e56b257b17d97ce381130ebccd1963af9c6f4e0c64243c77f593a46e7b90613e5660c516fa83af9069e69809d9a303f3e1c3ab23a8e2df23d5d5139ef9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a0824e40c4229a8036e448b83bccb81e

SHA1
234f856dd9950af67b1d9c264fd2f10d67a24baf

SHA256
36bd5d0e3572b33e44209ebb736c06285a42f2b68f20b3bdbe0091635510bc3b

SHA512
2831d5246e4ad8956df5e9903426e259dff556aa666ca7c8073b7e053f50d8ba0c9d8d31595e636523524c9c4920c0fb1c3a2422fbdfbce43ad4cd3f9e784121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PLSLTMYI\style[1].htm

Filesize
175B

MD5
5318d48c90480e1d011b82ca47da2578

SHA1
d8333d23ec8cddd90e653b90ae8768c442ba1e6f

SHA256
4b2d81461cfd94a68ccc9f325153169b4305db351351dec8e40559260499176f

SHA512
2884e5c006e4aed8347be527a1c91ba0102ece31b36e1c868cfc66abe72ab0113d754c2ef3c19d54e245b1b1efe96a4cd29e9998349483152e6d8256d756cbef

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA54.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA67.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit