73edfddb3af209076c6f6db8a6e5c0586ec56fe587873cd4cc7f91741b54956e

Analysis

max time kernel
147s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

524edc02e31d814990b59e22786072fa_JaffaCakes118.html
Size

53KB
MD5

524edc02e31d814990b59e22786072fa
SHA1

71fd8cc2228b63987c1cbaab434b64448105eade
SHA256

73edfddb3af209076c6f6db8a6e5c0586ec56fe587873cd4cc7f91741b54956e
SHA512

0f45d56005a8f73c30acb89e3aadc4aed1277447ee20c8e72f2105d08e197088edae6201266714eaa4f51f47953a950e06f73ab92aac5918c4d1d222523aeef8
SSDEEP

1536:9kgUiIakTqGivi+PyUNrunlYy63Nj+q5VyvR0w2AzTICbbQov/t9M/dNwIUTDmDi:9kgUiIakTqGivi+PyUNrunlYy63Nj+q4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435335787"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C825EA51-8C90-11EF-A58E-EA7747D117E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000009954ae69fd035b84b04206ddc1871a12077418405441c70c4e005862f55d6b2b000000000e8000000002000020000000c81b0967d0ecaaa134025e8f4e3e124e7d2533988041d11bf54985d988a60a8e20000000ae8d7725c16c4aa0b81fe7d87d981ded32bf692053bb668cb338ca628ad0778f400000001d3943aa80f3d6f25a948fe722f8bbb71c177043260a345e33eab783d06b160d53bf8d4b61ff70d140e3faab4c53948a014a07a2eb203660ebabcd711025db06	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ab5ce29d20db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000008a5bb22fbf1c272171fb16302ad18ca46cc333cf4cd1b15621b63d68c7cfed26000000000e8000000002000020000000aeff31a05f089cf2fe2a7580f6d48fd43d067fa111ef8c2205b099cab8457ffd900000007f6c54593fd892fe0aee3308f053f41c4b684260dddce787215bb87c7bc463bb5670c0490c8a3417c907e2b0e7f5b95d5292a726c04e218d1fdf2c7e93b381d673f3335ee8369ff809e7672717838162b1202cb44c5b81f48e9f8f6d3f0e110ea9a8fab652a786e189b0cbf1dd75ff88206bc4557613f51ac9c2cc8e830518ae5c5739f5890eb2211d25a75b0a154f77400000008f24d9d2db3775d7f9b486b0b463f3dbeb711ccf88e1536429f7499b2460f1079af392144d361f5b9ce2354f61a30f7ad31f9ac5f6ddb1b0eb04fde10303aa59	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1768	2072	iexplore.exe	30
PID 2072 wrote to memory of 1768	2072	iexplore.exe	30
PID 2072 wrote to memory of 1768	2072	iexplore.exe	30
PID 2072 wrote to memory of 1768	2072	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\524edc02e31d814990b59e22786072fa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54c531c7e7c8248627e2a98f69d0db24

SHA1
c752a286cc691119a9e212929faa13b7fe917969

SHA256
a870cb8a2bdd8792329155c4bb7fb212d4b698d2932d54569abe8ce216e08bc8

SHA512
b3cb563ad9a5358da32ab70094259ef4f42d9af35a349f11b91fe90f78562ff1e3b3e4042e06541899c620f0f4fbcf97458704a4f667a17121a0a9ecf0e9c561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8aee03d5e62e2079f2f2960465819c1d

SHA1
510c14238fd1f9093d086e2092d94a51afed4726

SHA256
9f269db7f4c02bce801a14914f671055356e0620b912a9a767d24264d09f6281

SHA512
40ac948515e80c486251b62a3dc2cce2587ac9b618b82a083a627c65fdb1de3da35c679b49c74910a5f05afa387244c7184b465bdd38e932d23892ef80ca9ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92a815f45c862ae87be0a9b9e2193f9a

SHA1
f39ed14bc120454b80cb958b31de4de79f03fbe0

SHA256
e986c0b602fbee947bf5b342bfc40c0ccd7bd7c80e811ef784faf1149dbe0e3d

SHA512
143636c6e56b375e5a3cd4ce85d666f4124d2529ce18c553138e6797f98a882fcb3bddb5ff9c7f0651dee6fc6a7b22c0d7cd1ca64ffcf5092cdcb5519211e965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b69a1c9c686fb01e471002bf0b827242

SHA1
936d5d436c863b0cb795d56ca053e3c38ffe151e

SHA256
44cccf06b5b245d8b5481e28ab8f8769cd92e81656b17fa2345f17c92bea44b6

SHA512
f83652f41d7e91ce4946b0864ef1c782e07616c94da7e3e681082682a9a59f9d9dcf96c3a4522c56362a9960ddaa35da924e48fc21aa3752951883e75bc4f896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eda0b9a1c192662d76593d46392222d3

SHA1
8c0a1a11da4321e2d0dab9f90167b02e3247a13b

SHA256
3fd72012b71be0961ee1f26284dca215374eab2774669e9b3a1f14629560a8bb

SHA512
1e8adb2a9394c2af8f341e8e73b1bcc178fc9d6fddd8fcfa454919419ea2ef234ddf164cad6b038db9610374a2a31e2418a0313625d8e21818849818d063063f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c6174bdd067ae289b88066b171703f2

SHA1
609ecd7e1d0f74cf3dcbe072905bd13b12d714cd

SHA256
6c2b0064175572f21fd3cb6347fcddd533e59329ba3575446e89d2f39daca556

SHA512
9baa54f8ac20a5137c435d14c5b4c16418dc0c3dcb006c40636fd09abf76c22c5f48a1fbff92a968ebfb819d04be074426748f2041d877eea11efd15ac4ef0e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fd616c1f56d6950ab2ccaadb3368c9d

SHA1
b4adc25989ccc62557072d65de3fdbca063963c1

SHA256
98296560138ec5930c591478a11210f4eca6acd1fc90b691632901339c03dde4

SHA512
479d15949f83eae1ca271ea9e6acdf58d661f91e73b7c9d2aa194d5a3389a54b2602d54ac75633fb253b0680b354e726811c0605ad691c75542a539f5be35690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c4665de0e07c3d3fa6cb7524b30d5ca

SHA1
46e7e5a15617ad49f50c903c610e043c92ecf72f

SHA256
069c1e8cf6558bd9e408f63d7d979ce6bfab0d57595228300786a03e9fd4845f

SHA512
3d35b60c04c6635f7e79291e1b2edef6756f0e7a7e5393c568a57310f5c6c2ee6cc511cc8c68899338cac3aacd5df6ccc27910adcfe32bad43f2c9c10f078e70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EB0KZ1Y4\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC3ED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC400.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit