7d0fdc402eee895ef37a1538f22da68a834ef73944272812a85d51922afee64b

Analysis

max time kernel
70s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55007e06599a95fe8e8d0eb5913c3aaf_JaffaCakes118.html
Size

17KB
MD5

55007e06599a95fe8e8d0eb5913c3aaf
SHA1

ebd4a630a6791c84ce7f7645f45e6599211fe9a3
SHA256

7d0fdc402eee895ef37a1538f22da68a834ef73944272812a85d51922afee64b
SHA512

36049d1e7804c886922fc9ca225a0a48f8510cf9b7fed4ba6c6eee546441ceee2f7f06e17b623391bc5c409f6e4090011ef34ad115e77e020319932cd61bf263
SSDEEP

384:ZefTYFtwUb3m25zVrzFHBizJz+zxsK26KZj5FMGbzth1Akd6zzR:Ju1qzeoWzM2RmzR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000029be2b0c114a04a2738da0a134bbade792d37b0a716e2d5fb519f683ee275c41000000000e8000000002000020000000bd1e75cb308393fcffb87b031f72d1ed1f8bc9e8ac2c39dc2a1067fb236fcf8a200000005b3a6addfb5469ada142458f71213707d5cfdd51c7bd9e8d1787be026f78c856400000001126c31267b32c2e0a10405213f0c9cae86638493cbd971ef04ce0ea9d27775b0963b5c59059f42289a9c0da9a5987b75da9dcf5003714d686015339e7435bb1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000043b49b7afda680ac2904440e74b25c0ef7c6b78f086b170f7948c7fb13dd6b03000000000e800000000200002000000026c746ab9116b8682ab78da47f6b861250f121465ba0f9cd50d3d15ef77196bf90000000286a810ff428a3dbc0a963da2e63f922e37116ed14573bd3edee9400ad683689551c96edd7987cdce9e7084fd1664751a490c487d49a3fd7338eeb779ee9ea350ce3ff3479803c32a8be01c5fdf6178a7f5f5f88bc442e26f3f6d3fb50a31273353254ed00bcb1d6497f91c6b2c199f38045f139ffaba7e5ff80326cb73947ff06c20d16a5ec6b57ffcdcf346d6cc1574000000017f507eb8268c621dd28bc4a7ab9899dbce7759bc2fcc4465810d9122019780755616ef3c900a408fe611d8b7dbc23bbdd15430f82542e66eca43b12071413a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00c19300621db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435380679"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B96CE91-8CF9-11EF-A429-7A64CBF9805C} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2780	iexplore.exe
2780	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2212	2780	iexplore.exe	30
PID 2780 wrote to memory of 2212	2780	iexplore.exe	30
PID 2780 wrote to memory of 2212	2780	iexplore.exe	30
PID 2780 wrote to memory of 2212	2780	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\55007e06599a95fe8e8d0eb5913c3aaf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53160fc0f62461ee4577abb918383ed2

SHA1
752b735974784475f3aa009a8b0281250f2785d4

SHA256
5126c631cf64bf27b437261914dc5f8c543050bee1fe18843113a7a51cbe60f4

SHA512
e158b56eb1aa30540599fed1a7bfa415ce642ea6f05e9dac699ddc05949096cc69d78570effd06d5248957395a5282a8155e5cb22b6587ef1a666ced0df22bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad3498488fc70ab705846d6973a0c253

SHA1
4d933e6bfa3d32f7c94bf420976b10f8a1fa4aff

SHA256
7b4b224acc87add75fa24abd91f33e6d40a253b651717636e8cd0d974d41338c

SHA512
a00ff9c37736fd3e5b2d28634cd010c89281a9420f56330cb72a6045e444f2717b6bbe8fc8127c68a6c183bce7d36b611e8cd20abb8bdc3ac0517bd1f8a3f3f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49942503b343f1e97115356e2feaf351

SHA1
da303e3b61301e7016ba8e78eb15cc7cee5b0d32

SHA256
341c806b09d5e0b49ba15ce5f2056ad9e64f7226146e2e4223c0fd17c8adc2ff

SHA512
f0c76fc9a9e6ed9a808b00c83068e39f5e820bf3fbc5a390d53353eb860b5484c893a91b19d5f814803c7e5c62bdedafec019f17c08e71ca54a2a973d61cc1f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8195d4e4294a73fc0454791d70b791d0

SHA1
f4fd8f75ba4233975cc31527074de309dc262f3a

SHA256
8b60aeac6ba6089ad2c0d10e412cb7c1421db8921449864198b559c158630722

SHA512
80241a1fc865e5c264d696b765c1fe6b00daa5ebdc177af26e8d2dbce9c8a32cf30f838005794a7d35a110d74ac7341394bdba5a8d53cb1294bb7b12fe54bb28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a6c74c7db820ff3a73fb4976334b3e9

SHA1
27b0f1cba1b0e0d2b85b85d118b16d33ec90f50a

SHA256
8bad680061c84c25f4edacaccccdc65bf8896b271610b4aa541b53138039d1bd

SHA512
aaa23bbade732fc8d00cefe6648cfbd42f9f990d95cee17effcf04cc0b15bbb77e60f31783bc8a974813aa1942e6f26df34e437d1fca2614c5a73eba6905cefe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
827035bba84ec216403c4714c7b57b70

SHA1
47af151e0418182d829c2d36b1e7f105c75ff61e

SHA256
c0d80efe2c0cdbde63bd745c54913e485ca456e0f0d9ddc9d485c7053f4b955f

SHA512
7119abef45e59aab86aaeae209a15ef4e7e7e18bd8e1794d233c8800dd62462628c8bbbf9b6c3c2b905cdbcfdaffb783f551cb6724d74c97888ffa5021359569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5017473096962363d447225ee8aada24

SHA1
615c8c56258bf9a0f0598261d79edf145d51523f

SHA256
7853c9e9a6c729cd61109949a1a876af921888108a66fcdbae3ca932679515e4

SHA512
dc419637bfff07bfff7a1015c4e21312d3d182e18b04687c7864488d39748aa3aa62dcd8868793e9797d6fc49c4c590ff9449af53f59624967f05905ed289d68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7137f9eea7dfe8d6fcac8cab00a73c37

SHA1
de3dcc494479790ca2bd21d91b2b55660c5bfad0

SHA256
b0506ab5e1100aeb9d517a621183c115ee8c72ef410245b8be75d6c5cf6d62fa

SHA512
fa9cc28a804d20e0c9f851822f0db4fddc5696cade1fb7682623b469a932b6de9cc1fac1af849956dd0cb6bd9c8672059eef74c47604bfe90da013aca3af51f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a35957cf59ce6a075beb9c9a1274157c

SHA1
854d963fd5b6621fae7c3222f16ae600cfb88d9f

SHA256
679135849ad389437ec54b13e6bd48faad5320e9570ee3bc8d8512b05024c108

SHA512
08750a9fd891096e3a7bd936159a92e61510eea3975c07ccb4b3ec06fe4934f3328f2336f8b93876eaebadb09b386ec1fdf799a1186dfa34d30ad3a90827c7bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07eaa2a2d1ad2abfcdf78ab9e0fefd44

SHA1
1b0b139265f50d88c88891920ee7b99ddc1dbe36

SHA256
f499feb8a9c5166d84763734bd184aa3bf1d77904d8896a5c93344d0dc372f51

SHA512
2ab530beeeda808ba67c2eac2ad29cbdca07bb4bd8cf26a09de01c3f95ef713742b669e274ee486d74f99fd8726cb151b666926da0983237b41a4f11616a2051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f42e6c0ad1a1ff16bd9ff931c562a43

SHA1
4181e32fd5f25525fd82efa498170e451d8bab5d

SHA256
7688586d02a1bd3f1f35e24548c70972d680a316ef186b7acaf9f8060ff34d06

SHA512
82115c7e87884b61f662e682285a4c2157680ec166e41094be932da19ada89fc561a6ffac2ae6e34b6968e385570e44ebda6b1a187d29fc88d1e27ad41b00757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49f1d8b38fd0a151292349b98aa456a1

SHA1
33859003967f0eca808fe79718a4f07546ad0691

SHA256
a1160643e5493d4af80cc57768b0fda06d0b8d2ad45ebe8568ebdb2e74e23baa

SHA512
aca7015b2d516534bd39e52e76baf8a59bac67e1f81f49e6f0be990e1d29ab6ab8ff3a593a960c5bb5aecf355986dc336bcd17f95bf40bed3ba5d21e5c803738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
372a807e1fdfffe07441d8a40fc62454

SHA1
6b38afd602d4f442065f329b24ef3a2d109b474a

SHA256
f6c997cd1db639cded43e8837293693bb638a7e1551fe6785d081e8ad0c41ae2

SHA512
e86f0308feb3dfc3e402fa9210d0e8f49014b2642c432f535ec1116fdd46b301b0737c7c4b1079fb94efe730e310b86e263cee25c83e53c228fa08b955b39b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1866fabe337e3d64a1eeadb92cdf3b27

SHA1
24fae902ddffe5be84e06f3aba7486b79a0f7dd6

SHA256
bb46a8529cabce5b1f462c120c77814c7c8d81fd4a5b65a2523629e3a7c75472

SHA512
cbd5baee23ce574ee973c234755448923b22dd8f4704848cfab4d26eaa2b58c3adbeb344d9de6142577aed1d078fa32deabebaf44b42fbaa0d88fb336e7dd9a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCB0F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB7F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit