728d6ff2c90e26cbd46fbf91ef52736a9493aa41944f74d79d4380618c0a7326

Analysis

max time kernel
121s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55e270a0e70c4bfee4ab02ad440e420a_JaffaCakes118.html
Size

57KB
MD5

55e270a0e70c4bfee4ab02ad440e420a
SHA1

7472d4436ae8e703456f8fc26a85591f5e7b6e7d
SHA256

728d6ff2c90e26cbd46fbf91ef52736a9493aa41944f74d79d4380618c0a7326
SHA512

57ebbb1f390df0f2e49af25ca2fa8dd3c182b490351d6d1afa2d6740c55dec8ce41f567deeb4b5fc321e8ef648e0dea0788d129ce164a506d570c6ba2a374459
SSDEEP

1536:ijEQvK8OPHdsA1o2vgyHJv0owbd6zKD6CDK2RVroTjwpDK2RVy:ijnOPHdsR2vgyHJutDK2RVroTjwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000bb7b48c0450f222ba8bcf8085726badc2d38109d2c7f7fdfcfea4f3a25831d2a000000000e8000000002000020000000e08adc93c472987be6766bbe9d886eb9f4dca45ef4e346ebbd2293ecaf6e9e8820000000b491a973a29c873885c6677b0fb230677ac03c5ae96144f816c8af51f700a0f64000000077a4459ca41f56faf4bdf10801a2202c00885f16580ff47b523167f8a41543fad2625aa6a650568e50b9b39c05ce8dcf39c5020e296491d75595d4e52edaa355	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000003673426a9f396542dd0cc651f01efa3912191d9442519a83c005b47d2ca2541f000000000e80000000020000200000004f0e7e52bb909267a070b6b96aa33d6a116944479a3abaf56d91f1f8ae81ed0f90000000083948c5633d38655e713ecf7c016ad6693e928ce2285076610ad5ad4906b4ed3783391da3bcdab1594955ab04717e0d704b7b9dec444e42913ff4f0724762413436fc443f9ce0b9d3a34dd983bbe444aac802ed86bdeda7d795d1be48ac7ea85f2fec7433c0a51e486d79043c73c14c7de2faa0804b1beaf1cc5a47257828bfde27e550539e105357b997194b9d89dc40000000e0d4c27af1b81d07ea1d90aa176cf884b9ea14652aa1653479b21dc5b726b0ce9d829b86d4d6c99cf153674c9199aac99f214fec0dce01b5da7cd1735b1b645f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE131501-8D17-11EF-8B05-6E295C7D81A3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435393774"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201683bf2421db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2872	iexplore.exe
2872	iexplore.exe
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE
1228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1228	2872	iexplore.exe	28
PID 2872 wrote to memory of 1228	2872	iexplore.exe	28
PID 2872 wrote to memory of 1228	2872	iexplore.exe	28
PID 2872 wrote to memory of 1228	2872	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\55e270a0e70c4bfee4ab02ad440e420a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
75a3d59c86c494d6322a070440c6f345

SHA1
4220193387df0993854088a8db05d4359dea7c9b

SHA256
c42a8dfcf8b12821af7f4b4e47a505ecd6b2832eb3fe1e2af8edc5a470c082e6

SHA512
56a99a8f6653fbb11017fb3c423a604305268ba32f8cf6bc32ea206b646ebd49bcf85c9b71832a9d772c9eb99d7583ab185947e87b48dd70e0dee3c0e63c82b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a162c001028d84f7116e9add6c842573

SHA1
3ea579bfd587dbc4231070cff37810137062dc86

SHA256
3d12d18ba2150b8d72c3b0754963b9c2e3dbf2fe2063b2058437ee1dfb69e877

SHA512
b8ebc81b0d84b64e0ea92d7726c9b6f0699d691820359ff97ded13bec6f884ab07801e62188979d35ad25eed4b0bb8301f5af1f36087abc868c7dbcf7028e980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74ab996a0102246f9076ff5e9be748c5

SHA1
324f7a2aeba401285091a01afb3437839f3f4adf

SHA256
18b42883c87dbf0df6e8847b237f20f12b3e559326787d26be5d634c0e37846b

SHA512
af14745c73624464c61027f185e5c41cbedb3ca13b5ad71a2a88b920c408189dbaa4392bb3d4f4c60b4bcad6c6b0da39755ec100ed822bfde95a00aec83e4dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e1c8edba088367c1434796034e45502

SHA1
8c637fe0d52daa7264741c1fde2921b1f28c79c0

SHA256
7bd5d19bfd0c3604315106bb8b2bf2f2fd10af8e551e5765d1e0902d2f968317

SHA512
f9ff04479fbf46713188a1a0958eea93779e1f4b6703ee731e4c925eb808bda2614c65535329b2f847dced10dc0934bba3da1ba40d88bd5ebd7523edc0839dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbfa1e1a0e180ed393e8ec141918f25f

SHA1
9ca87289383bec1e8fa77b78a01a84326e259b96

SHA256
0bf68e40621081a48f254b6feb57eb525f8e2a05065d7788c8b1f185df3bbeb1

SHA512
2d9fc2763219e5eabf786400dd6bd69d75d448c8289c6739dfa0850432a09a2b483f93c3660a2fe78e9996e1c27836b984fefa049a03262f715f564ce89bdefe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
41433ba822ffe390d6321b9071fa7541

SHA1
ccb9e89346248072f7d2fb6f129dcb5015ec52ee

SHA256
bbdaa30844c2bbdee8c09d1c95077614d090367ca74a40b527462d3f8f3b0157

SHA512
9f5c12793bd3e1098bf0ca9cbca49caf37613aed3e8692c30a84cce01393d3699dc4f0be2c791be8de93d742996a126d98b2ac22f98af96514b1fa908d7dd4bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
66f295e9bf8411352d3791ad20d734d0

SHA1
35671354d6aa2fcccd410fc4207fb003cbfefb64

SHA256
36c8f6ed7dd0f6ec5f40bb3cb841c6cef84ace1613b0610d14dc8d424ec771ad

SHA512
4764abdf0fc880175b13d12ccde24925cfd04ef7b98b9875ec368c34068d6fff0b0c2c4205724bb6e3204a3010a2227d3fb1d1f591908a671b35cc77fafbfbc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\f[1].txt

Filesize
40KB

MD5
47527cecbf223e82c62aa7b9fceebd35

SHA1
73fdd1d8a0b7889ed00b1123e3e6d446ea5fe9cd

SHA256
827dba66dbaecd86771b7bbff53e04d43afcb02db2ef59b87e620b633ac6eb4b

SHA512
41e268551b0651c3d87104e2d1e1b5afa6ded96c93ee270adcdc0ff61ca3d5489696d0c49f18194e3a57427aa551fb914336b8ed4d25785b60861055e0aa6506

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB82.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC81.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit