03b085e2822d585b85053ca369afdc659dde517dc61a70cf1877a943f8a3fb2b

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53cac015dbca04739f522fe5fb18cf3a_JaffaCakes118.html
Size

139KB
MD5

53cac015dbca04739f522fe5fb18cf3a
SHA1

30d38d6cec8090782e60c7530bcab768a8d080bd
SHA256

03b085e2822d585b85053ca369afdc659dde517dc61a70cf1877a943f8a3fb2b
SHA512

b9444648fdbbaa30bd4a3b40503b9929a11f3c3d853d334e873b3ddc5861e7df3d8036a70a1189c5b61482b23c18ab3f69e717c8012ed3fed3ad768cd675dd01
SSDEEP

1536:SEN9d905ktYraMdlxSTyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:SEWoTyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c75cc6da20db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435361921"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043903f7f4ee6a44fad5d225fce77c013000000000200000000001066000000010000200000004fc3836a5669024a043a838f0d820f6d90ea446094c26bd0de521eb432c68db8000000000e80000000020000200000008bce24d91d12188cd9c0a1b172992abc86c939a0a2f4e6c935503e9c6b8415b920000000ad4cf4bd1bfd77cf5c104dd2e19d2ba33df4eda5df2adfbe98af07c2fed320b3400000006ca4007056be1ad19800d3b80f55260c7001618d6d28550cdb96d18e6731ea6016111ac3c22b36233def1b924f65000956c6ffc3272936fb12f77f2d4db006ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B02834C1-8CCD-11EF-A2BE-5E235017FF15} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043903f7f4ee6a44fad5d225fce77c01300000000020000000000106600000001000020000000378ecc51ace4a4930f643be5db6ca64e52acda542169369ff7b772c22c3e448b000000000e8000000002000020000000818ba7dde2c823703af557366146c48e2f526edcbba6d837764ed03749b69d089000000021df098274e46511e5e113b2be331bb81ff7f0b56776ad553ef41ec0c643a053c1cac807bbd6fe9d02ced61875fa9f3e12e3787bb8b5428a4b29634d4e60b30c6f8aceb867b6676c7bf16ecd3bd28e74c7c7d6dcd407295eaa5bbea39ed8908fcb75c9bd38265d8a7cd7a28b3d3995ff254166d1171a225633bd009fd8ae51b39f90941616e1c911fd2ae6aa95d0f44c40000000c3b899f036e738dd870538c5983b2ba4fe75ac39affd9c0ad136413a10b9e5d72c4e3f01dc373b995d20afed6e3dca88ec72d47fa74774ddb66304019053ded6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE
2548	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2548	2908	iexplore.exe	30
PID 2908 wrote to memory of 2548	2908	iexplore.exe	30
PID 2908 wrote to memory of 2548	2908	iexplore.exe	30
PID 2908 wrote to memory of 2548	2908	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\53cac015dbca04739f522fe5fb18cf3a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5220a98ba19faa6f653a7d1988567a9

SHA1
dce21f0b8e8e061724048fc6b64a653c8a304539

SHA256
713294a2eb5fdb467c4bdd246c401fd7133d386dcef6c57bf08c5e13c20a3472

SHA512
23c6030f72e2cd62bbce55ee683a26eae9c8a948150f09841a00aded36ea5eb4f7a8004ac898cb6fba90d5b6def90a622695bf2f5c495e711fa87e578c46cbce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3563a5e9821e98650bdd6571c4e2e75d

SHA1
ef62a92e6128a9b79b37888f60b558bacc135a6c

SHA256
4f416de376a952f04608c367f4752750bfb46f8e7781f9d7f7277720a9e4056f

SHA512
ebe9960a3d87d3d345eddb2317430b6ce8143b46d55d7913dd1f05fc9a951d5e14473634ed1d9d5f37430cfc8f4d296dcbc0a12af64d8e885a3d4f8495529d6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f7ccacf01403e1771d7aab16b303e82

SHA1
369ffac3a6b4cb3fe57a4422691cdb7a03bdd814

SHA256
b66f084b266c16e6c0fd3f75f86779b2e7ae795abae0ef5f4d2df845a0f69149

SHA512
b12234d6393ff10e939c4e4f39d0a5d4a0ab75bfcef2aaa196bc1cad440570b616900f2369bf09015535f44a0beee9cfcfc120b51e57fbfe2d11810cc823c952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c27559d241b9ec97b2964b173cb7a44e

SHA1
2b5833d1967698bb195e3afa30953394216e0fb6

SHA256
5e1cbc3dac58209c18d5b7df321c08a2788e879ff46c68b40d0d40fda55a7543

SHA512
539a806919bd9e4ae37d6e021d49786b4e106e933a73caee29b4a99f961b138e0355bf28c9c450acd2d4aa259a65241b2170782276c6ad01b52b49db95c1e461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c67dd7d3eaa5f7ba4bafcc2712978155

SHA1
b42912bf458ee15ab33f86338f827d1d3a6cd3cf

SHA256
7b63d2a0b742f4a9e263215b97370dd5e4fbb77b8c59cc897642a7d92d706fee

SHA512
8ec95addf4bf17464637ade58b7f1e8512196a2bfbecca1d8bb5e617c46a30037642c9db4bbc0944cfbd85c843c5e687eab6e153b81fb1ba461ad5f9248cceb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6df460affd7a1145ab39fdb4c25df35e

SHA1
599661963a68c5adee6b9dc13455880a273fc59e

SHA256
67537a5ad88dc6cd185115eb93d5cf8a74b5d69e10e5d3b69e8061dee95a6bb9

SHA512
12d775c50adccdce95444422a9fb7a77bddd4b8b7e20a86051da497f58a9d2f74886c812cc0576f88185b0b4f795ad47f87e15b70b94cff62084643f3ff4b159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69ed3a8971c4774ee2e0610972e115da

SHA1
32cb1fe9c809ecdc8776a459a22af3d498fe4a52

SHA256
1520dce5a70d62f7883359c5745c31610578670d6ed9ddeed7d74cd46f95bee5

SHA512
e2529349287d0bad4d20ae356ad53754f27ee30a6997b1816f5a49a877ea21c9979bff2ebc14c272ca6e8ebbcce2b13a4042109b517a36fa1e774a399b7e83dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2401a87a314603f46ab46911beedfdab

SHA1
051762ef6b7739b59d83e378d1635809ca62291f

SHA256
3002856d6f7e6227c9ceaa3e10e0019b385afde7af1b7977549802e84aa74c1d

SHA512
1acbbaeda653bb8a510af631797adc33d2455422c51792b5a5906de6f6469df4d812bb7dbc62c24a2e4e8d27ef6951ac3f85e0857c12e114b7131efe181f6320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2a61938c617df8ee016fc760f1a9dae

SHA1
648e5ba10dd2ee2219bb25f57a8bc9c93b6e9242

SHA256
abb1b88afddda300a62d2212a5722c27d733794c79ab47940effcb0b846acde8

SHA512
7966848e58121696ee894919a347d17a8c5e81d25596080484159f33ab4e7c19aefc01e0f9f2ba801869cf7b177249af784192aa32d21f0bed0954c0c189f7bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
512dd708a63196bd2471615695b419ff

SHA1
6a324df21add37e30a2e1dd974db0d589611d4a4

SHA256
8e27c623480cc0187d98fb62a57e24711e4e11ac1a9a4f557d47ae8fff26aa5e

SHA512
6c4bff72ad283833c3e24295e53dd19bb07a411fc893c22f959a4c02c6d71a5d09cb09c0675cd9ce62383c7f8c1b7d553d7b898c8c6616e29677732ec823d2a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f50223ddb8a895dc5d5341394df3ae9

SHA1
fa29b9553019e3d6f614aea83e5699ad619979d1

SHA256
b828305280390277dccadd175bfa24d8b93085d2d5c955b591d1200a03fd0abe

SHA512
bea8634c8c0ee20ebb2082f19cc5d7473d4a14eaca12ce3b590eef74253ad89388daa9b533550325378f26c99341278b80a4aeb9edc2b9cb62b0ee6fbfa9e9ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA1BD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA26C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit