b3e2fba737a58d5fca2405a062e3579ad2ff05a6b0cbcf8b55e12a4fe66de28b

Analysis

max time kernel
68s
max time network
134s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

564e7b7010ee84b5fa52c7d282dca652_JaffaCakes118.html
Size

7KB
MD5

564e7b7010ee84b5fa52c7d282dca652
SHA1

ea9e4178d3a8f2ed73f54fe055b2862edbeb2042
SHA256

b3e2fba737a58d5fca2405a062e3579ad2ff05a6b0cbcf8b55e12a4fe66de28b
SHA512

1002cb360661d7d4a7fbe8f6be8fc2c40e5d961f610b5b672be01f9b308f395a7ea9e05db954a51ee758c3d02a0541324fe2881ce31b276cd92c4704df1dd025
SSDEEP

96:uzVs+ux7U/LLY1k9o84d12ef7CSTUAzf+Ch92UccEZ7ru7f:csz7U/AYS/qjb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b1319000000000200000000001066000000010000200000004d64daca82620ae53058ecc74ee138b4d2f16fd21db66ce6770d3629fdb72d68000000000e8000000002000020000000ffa303623bc2bf70fafad44e0a4ebaff08b53d8eea5c4688dbb9dde994bba3bf20000000f82cf0656dcc206c67a7b3b6772e1817203ab228ee79a83ad2e11e794b76b46b40000000181f96e70cf20367b23e9d1d91c4bdf810936e273ed53ac1d8260cb9b394644ffce5bc1365114cbd29408bd506b338813d9be8399da8120e99c3d23e17263423	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 901943093421db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33B8C211-8D27-11EF-96DD-F2BD923EC178} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435400367"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b13190000000002000000000010660000000100002000000085d9315763cf8b7dea949d9456936b974996653796f1446e61da9bfbc3d50f0c000000000e80000000020000200000007ba39028c333bf43742ccfbe5416372470c7331f61dcafd88ff1283a6550ccb390000000a9dd3d5f631bfeca0f2db1301dfe957a47cdae2f10e6d3869d3b63f1169c170275ef3a23140ed93d5e01d4f0351252275718a31385085b2d794f576b7f337fc883051a309b974f4d7207947526c17e58415c9ddcb1ac83a4b18fdecfff979e575727817c095f9b2ffdf155673083819c722feeb0b2d45e53a8c6588c70be0283aee2ba263559c909da1f50593e35b7644000000096f54157d502027d935843eea3d616db876135de46c58950dab76de4f9484556fc100494896a5f9dd8aa4c79b40dd79e8edaea352b761b7e73cacefcca8126fa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2880	3016	iexplore.exe	29
PID 3016 wrote to memory of 2880	3016	iexplore.exe	29
PID 3016 wrote to memory of 2880	3016	iexplore.exe	29
PID 3016 wrote to memory of 2880	3016	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\564e7b7010ee84b5fa52c7d282dca652_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c48fcd330c5a0846a1684679293fd5b8

SHA1
86e88c9c1a3ec0db5537f46d57991ea8249153fe

SHA256
e94385db73a6c5b60f44a903cac1d5d26ec0765a2bf6167452b521582add08de

SHA512
0522dff06e62f043e6898d861ac188541ef93510998d62a0192812a389a541f035546e49294e61dda188a8aef6485b3fac5f5230c42902a38298332b43cb4104

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a4e4a39344ae09415440256c8cefab9

SHA1
6aedbd181e86f31d7c25101061fc051df792a388

SHA256
147515da03397ebd39855a1df51d74f3a2cd07431c6c8fc63ff9f9a15b441143

SHA512
d5bd8f33c64ecc60d341dad45419168b86a64c48dbd35b246e7191348165d49426a6c65254b3d91df2b224b27401ce8b77dc05c9ab2b3bf84358d7582402a75d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a92747148a7cfa7dfeb3e91870d4f4d9

SHA1
607434a8d01a3c0aabf04c821778b04a77ec1f61

SHA256
4c13182b2ee24236397e03972cac56c887d26e533b8d1713a9e3680e3ebfc17d

SHA512
59a8553d418e61d20fe34dcb60cde0ad2de0205d2c50f98697c8510b6d1c867c5aa1856bfdef7ec5932652f209f035709f2564a360a227044dd74099cdba4aa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c93383c7f5c96e00c59e8bccfa2414ac

SHA1
11e716fd6025dd54843b4f5f8d21968a2ce4e52a

SHA256
cbc7a0d191fa70fda13bdc70d7ffeb12d17fe663628705678c79e2c7646dfb24

SHA512
9ccaa109fdd8d1f05febd67d8c02ec7b6e7a8399550b5b7238818e47fba1191ae9b257d63919cb48630590eb5473163dc144ce8939ddea5258cab55fde4ffb07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dca6d98f4e7cec841cc222f2959c675d

SHA1
4e17c64ba2172e5bcdc9bc73e245ac76ec35c68b

SHA256
5fe30806eb49d6064d634ddccf5b0e2c698c0300f45022dd2a348a50d8bc5ada

SHA512
91c7e8081d10c6a068ceb85e85431f3223de1778cd6f46d9eefeed80dba709d0d79284bac733eff8047db85508a86b71718f1f844e52fbefff0868f3ba8e7344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00ebfaac6b87b5d743f33b330d18e089

SHA1
3daf9c370da473bb5aa7c2f5f571998e318493a1

SHA256
432774a1463290576256b6d5742764213d0804ee63c10eb3ab1bcd442565dfdb

SHA512
e53b6b6fbc4cb4f3858e7444e033dd7cd8c54404b12017136b97d4d2373a55617814722d3a65c14ed587caef67998a2d9536322dfdf07c0bb8fba99e7fd63eea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bdef6c61fa4b36f7d13a62d579a3dc4

SHA1
f7c621a678b0f3c5efeec8c16b78207064facb0c

SHA256
a2bd2e7ade0d4cde1154e2e6cce47a19b146d33f849593c72362ee15fed46764

SHA512
81a56e2e6352df23446fc81fefaaa2763e9b157fdf77b9ed45ff0033e76c5f4a279a7a812ece8f4c79bb2f700a687605f6b37c16b1012380eac19a74e90e656e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccec5f892751b2453304bf37187e571c

SHA1
d2f5b9b47aa806d61edeb8c4adefd1d1b469850b

SHA256
60c2ce5515d8cb1c212346c19e9a40d568d8953a96e6eaa2bdbe0aab7d1c2dec

SHA512
7ebb2a9400c49aa5518782c892ad8b9fda699de2119806dbfd30bf830614d7de69f903d34adb4f184b28c65c38ef4eb8e000991a1a74a1af30cb6f6eb4ab2e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df96497c5ef54c9db7fd2e556d65be9d

SHA1
43ab2e046177adaf10f6c65d98ab710a78a6e410

SHA256
0f109daeef9237d6e58735c1d95fd5e950efd36f69bd1aedcd818b3ae90cd298

SHA512
279d140173af46efa68ccc5ef00392f230691dfc3e35c60f5cfc8298947c6a1016178522f94c404ea61aa7c9988f304b0c94979845f33764ea549574a9d465d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f31361b6b8e25ec8103c04e815ea3266

SHA1
20ca74e2ffe4459c74fbb37c398c13e089bc15c8

SHA256
5520f0a787bddc66fc31d9d6e31c8bf9f9d7b07383c5911e602d6d13f1598ff1

SHA512
388f5993ab1d70bca1d121604014432db38a88e57218ea42476fb9d21182547c32b81d6f96032851644408a6bc0d4153ac8e61512a5a8cb74aa6d98d7c811926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80335bfbf98c734f86cdd17cae5d28c8

SHA1
437d9263c5e942115b318de13fc3037e5c8a43e7

SHA256
777a2d97676c6d793e9ddd4cd17cba5e44ed202c00389d57d92c7e2e6c3b6540

SHA512
2a5fed3e10dcb38a34992533acfab29dc9f9d287202cecfcd5f6043cfc46c391aa81c4eee6025ee1a9f83f9128a0e7150b946eb65d0c69aa3660ae9883a3c89d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit