70148fc21452b381ff889975215f766e2771604632f054e43732c2f0ee1e8f04

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54c5919f68bea2c7358479b70cb7ed42_JaffaCakes118.html
Size

120KB
MD5

54c5919f68bea2c7358479b70cb7ed42
SHA1

15dd090f0c03b417fbb67f90fb5d3c633889df83
SHA256

70148fc21452b381ff889975215f766e2771604632f054e43732c2f0ee1e8f04
SHA512

d9c4d3b2b0ce1a65f38eb3d45e6ee14f1a551ebb1973347a944c0b1297f502a50376f3f3ccaa6fd765af4a552178e98a97c8b91ba94fde4cf5833835d6357792
SSDEEP

1536:y8ELt+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:9EJ+yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435377440"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000000650c7ab8c72caa32147e41b46fbc9475afe845d6fea76c0d7a11d68caac7982000000000e8000000002000020000000ef11fe5f66ed4d3c3fdef2f6beeb2a2104b652bd5a7f08ac80a9f83d8446d9a99000000064eabbefd2ea33bc29eafa9412c6cadfdd3bfe1c4e1b968af269cc7b0f4af7a0ea898a8588c2da511409293800c08dfeaa10d1f3b119464a28f850e7dc033cf4dea0c1649659395d725ebe26ae1c2c2518de348f4a7849a84a957531c0b085ea41b5e1580b6a9e9290c5961f30e38e8561988768d04ac7eb707e192c953fcbfc5ee5c2f3081ecbaec7f0c196fd9540364000000065133598b9638e34f209135e491997bd871455b47f963d43be41260693a339f7cada1b11d195fc430e9f84c910b6f932caa9290f49f4d9b3537e30fad1c3444d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90c54ca7fe20db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2C40F31-8CF1-11EF-88C1-C26A93CEF43F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000242f0cfb5f7d435ce6007024ea4e7c469d3614f68486ae67cbb2f0cb31351ca9000000000e8000000002000020000000d2abdb6a8a6bebc1a355a23b5bbcacd705f5200024e8151c991097114b4eed8520000000a2b034cd7985082d0f9793cbec9a5e018eac2bb80ed2937578868db86b20ed72400000002f66807d6c544634ab2eed53b529ebeeb946dce097e65f35cbb8af3dfee0d3e912b4c7645eaed30d0e251845059a7eff35c0fafeecaa53b44180ae4f96df53b5	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2492	2284	iexplore.exe	30
PID 2284 wrote to memory of 2492	2284	iexplore.exe	30
PID 2284 wrote to memory of 2492	2284	iexplore.exe	30
PID 2284 wrote to memory of 2492	2284	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\54c5919f68bea2c7358479b70cb7ed42_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f836c54bd34f9b9d37ae296af3e56912

SHA1
7844005ded1d06cb5d2bcc7b66fc556965901c21

SHA256
a85e30a9f779bad4ed4316b485262d19b34e6775e2f4027831e93f6d89b506a5

SHA512
35869626879c78f0d708b9671d08dd84f5e8875458898852f6d88919de61dc0411d77a35a2f971172238588db8f60bfbb4451e4221e32141e4724658639e9ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddf0dc6ba6b4f0206790296a13f3d5f5

SHA1
57656ca4bdf6d2ce7ed39d4b7ab2c6f67f787a4f

SHA256
9437a7816f1097bcf4176297708e1de78993f82fb28caf8f8ce6e39330b7e203

SHA512
0f2232be0028c611ca862326b4b501713e531a56671a0339b014019ed3c1af4ed84095b6899028d5aad3e1fde7fd73810c95c51e914d3529c114d5f50d3c8449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c81f1d90c11d20fd7e22c5351c7237fa

SHA1
817196217c4507edde5b17aec0b6d880a9741068

SHA256
f080e57a7cb6d1d3df77343afa028b28055937c65ef30b540f622ff19e590b78

SHA512
9bed484418bed25a284af97da95b2d61703b32169e5827adca94e6c2c67a17526cdeeb010d9020775c40beaf08758790f07b688fb7c9933014005495f5c327c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7eaac37a9eb383978e54eba3ff535fb

SHA1
685d7d8157c7ca397c26182e8a712037fd73ccaf

SHA256
549dd603d0e31519c589c5aae510bcbf656b28a951b19224be33544f4a610878

SHA512
5f1dd994a223659ede4ad5e561686fe0c574ca83447878ab009ca2fc86d6649c1b74630030682d3499affce8c099a7b80c04030ebeddb873484b2fd9f8d04bae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
711a26cb790057e951cd12876988e59b

SHA1
b005f39e4010e577371c9996c5240c1c01fd5a13

SHA256
3ef8316f37c0f9f5d5b6731f239d6910357c22b1aafa50f288286d96bef376cf

SHA512
65e8c548e4dd18fb80b7bc0c57a64b3982d158953b001f7ea8299a872dedde2f12517a843c96b1209159998608d2624f8be420b239d8a607e2f6fcca28bc30d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16022762a9316b1b7dbd086f18a4edfd

SHA1
26f674f034251b2a65e987a88d220a303df8504b

SHA256
39b0fe118fb334966c63b2205e1446a1715a864278d5bd18fdc01762945ca3a2

SHA512
befcb6b3ad92ca4ce673f9fa6b277a4804226627574078ffb8dfc8a04f8fa553ba22fdbe59da4c776df595288a51a5e84433252b787265e3f28a0d5150368c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ca84f785531d93569b02edd0bf90d51

SHA1
f859afbe63c4282b29c6f33715dbb05eba0e50ce

SHA256
0ecd250d305dd49fa546f2c1fb9f8accfa65c088b95a7059ccbdb26360fd7af2

SHA512
7e0d6d4737df93b54b7a36f52978a9051b4aa934c271c37e6d116ca272df420fed319bdc0501c73a4950ff4d37875abe840b5626e6a978d902fda7d88601bedc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9434f5ececefa06754d909e1d34d4bdf

SHA1
cf0cb4d4f390a950f168633e2564c5213baeebe9

SHA256
1195c88f8618231effed7513d8f4e5a14041762c76a6d4781b22fdbcd6e5aec4

SHA512
15086731218388762efc07bf441d5523519b145900c2ae625ce48c4867466319181093ea9e9cc5ef94b6cc6209673403126366e28d15a8f2ae380721f1f9a914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13ac7419c27098280c2e578ba7a557fb

SHA1
762599e51c0ec5e15993222b2682aaa12f5abdb0

SHA256
66e9160ac780ada0703c93c10bbcda5e25de3b879766c4e0fc51a08bc6e81b1e

SHA512
559c0d542ae7713effbaa2eb34182f3a8da91b4ebcce2c8daf83a3781ebd5df6abbea592bcb3af330f0dd90b283573fb5d10c1dae2d6025cddce4bb469196cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5db7e3dc12f221f39bbe60a6c1d43e2

SHA1
70763284ec0b9e3e4c845c10904ee32cf2e21627

SHA256
65a26853e092afb3bebdf73016782796bc6f68cae14ea982b2fba659cb28b92b

SHA512
48f3a2a4127250b5e303fcda5def39509c108806c30f866de0d71aca31c297845ca9ff89c1b087d030f33f04d262cd692b8b215c174a0abc660204f9db4b0015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b42f33fd457ecfeefaf4cf433e5f5dd6

SHA1
c56d57a0a93643d4397a7392d6df1743327914d4

SHA256
3612ab2c054be07648b573c8ee4cbb5968d54ddd97014fef517c564afd903001

SHA512
1b7b74a18b08b417e8fba354f6383d3b26d64a7cd63b00dc1e40d64c1161a472398be7df011d79c90b241bd7abda547747cec42830f792e0020cc0ce6ee18c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccf9fa09d515a8b17f7a3cd7174f3edb

SHA1
d436be69262c6c8a00689aece9a1d3e2b50eb083

SHA256
671a0dd84a277254860bc31f4ff0c5dae45785d8ddd127d656383620aa189eac

SHA512
35820b4529bd287a0e9f9a31e18f7ef00de199a629ff890ccd216a1172b568047bed8972e6eaa8786589f9d2c503d6fb59eb22d7e827efa7d46d0249455a636a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08e5afefb9dbabd637f0da92f7e2adae

SHA1
6fba3f81c5cb1b39d840ec50633e8738d9b96112

SHA256
f7dabe3356668e1c687201f216cf9e292fb9672aa948174d79168692cddf3214

SHA512
038bec65b2a1e24567bfb8a9122d4e2925cb7dfa6f44b94f7621584055cb86969c004de08bb03f757553efe359f963e34457c193b0496a4f9ef0cf88d87993fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4ada5dc3bbe602e1d77432f67c48eb9

SHA1
5e1c94f3bea998a79f7dd4330b0dcad6de3d30da

SHA256
f3d7eaa9645c6f52a27fb3eb8f4213a3f03924ae8ad38d2910da7253fb04b13b

SHA512
67a26e4fe956adeda10c9ffa5703954c181a1d72a1e677d1e118a8175de860eef432f1f5288e7ee3bbf9f3d86f8943b6d111fd8f44729dc275d7c3f52822e5bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF05A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0BB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit