65e50ddf844b1fe676a5d329c2ff1240309589d112ad232d3b7516a123a0e8fe

Analysis

max time kernel
133s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57780778e336c0ed74603b20d21a3df0_JaffaCakes118.html
Size

26KB
MD5

57780778e336c0ed74603b20d21a3df0
SHA1

e0d0e17e57863810f8da6643f55142a923624006
SHA256

65e50ddf844b1fe676a5d329c2ff1240309589d112ad232d3b7516a123a0e8fe
SHA512

fc0e6c07ee9a3b7ae6dd73d610706b9d8bf2f8cb73633e94c69b9b0970cdce65586f0b645d9b99f2db02c9d8dc91388ee7569be84252787da1e10e631d0c75d6
SSDEEP

768:S2utjq8tnQzkDneq4+nbb6rA0JcPlOLm4oPw8Zb:S2utjq8tnQzqneq4+nberA0JcPlOLm4o

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000009cfef19bc72499c85e4341e683ea1455b096197fc0ef8777418defa3d5ee2475000000000e8000000002000020000000920e67e901fd1b6c54c88223af47c7fd5658b81c8130999af6d28ce17f5e6037200000005865302c919ecf7ac4cfaa4fe2a73c4d858df602e2a0aed03ecf1164cd843d1d40000000d7b2e72f26cea909cf156c86be6a7f69119a2634c593062f583d9a5f2b900bbe5a4c8e3c885d7bf09dda72c2023128fe11f0e7fd845c76714b1c65156985c49e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a9c55d5a21db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000000eb52bbac5ecd61bcc16dd6df5be21655d453170ae880d66ea1530532437908c000000000e8000000002000020000000bc00ada0a19153e939386dbf93b149e3559ad38127e608a41f1b58022c92584e900000000ca1452f4507e8f6dba001163e650a7832a3b76cff3b55d313261913e4998cd69e30cdcfdb393253b8f838260e32c9fa191054d3db70841f047c7d2417c9e2984358e131da165a9d2d92206f5201b1fc8575d6f3f18463c901dabb8f037f64ee2ed219fff3e71a700e1c4b75ea94b658f3ae92ac8aa6955f7cf6811b86d9f22446ace283f89486a588c0af04abd17317400000004a495d2738a434fa0c16647d08cb99643ce7b1a386515c2d97ced61ed809c5127f5e4b68bc2c12053a573a35c9b703e73cb886952224d08af59dbf53c0fae697	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435416823"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83ABA871-8D4D-11EF-B2CD-FE6EB537C9A6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2560	iexplore.exe
2560	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2428	2560	iexplore.exe	30
PID 2560 wrote to memory of 2428	2560	iexplore.exe	30
PID 2560 wrote to memory of 2428	2560	iexplore.exe	30
PID 2560 wrote to memory of 2428	2560	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\57780778e336c0ed74603b20d21a3df0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0289caff5c599fa7f97ca9351915d5ae

SHA1
ebc4e20693d76894d559f14189ea154ef5dc318e

SHA256
0e15d846bba1db52a3ab5bdb527b40ff42bdd312de8a5d13f1e41fb914c2c7f4

SHA512
23ce661a015663660dc66ced9dc0c69a0b6becb6b3be8131652676c9e723214d54398919ec1d6d63fad2aec836ff30ce283a45a0b47607e75047f1917a33bcdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
468e021ac909652cc9cbbbca67c28bed

SHA1
2e9d81f02207cba16f014618be33ac3050f195a7

SHA256
67297c1d6ce47674c572e8790022bd9bba26a79f657dd20cf2908260d463b436

SHA512
884c0e9dcde788900027ef0d5f070fe913b1d08cb83b52b35e620452757166a87c87b054ee78e321aaf022375da60846ae2daa325318770406549d2ff1c3a078

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
933d0d2837295ccecbc7c54135c156d4

SHA1
9c10bb8b65e8217888bf061d247e2473388d820b

SHA256
577a53f3f50307158d0795598d6375f577cac14a3b49fb3b12980d33f492582d

SHA512
fab5111929d808663af99ea5bcaf2ef1867e0ee11cf10ffcf94ed2eafd14a60a5bfbae50d9fb683b72f92336c1a7ed824c3826096b2c7b5432c481a6233e94b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77a9ddf7582ad337085990d7dbeb373a

SHA1
36a68340bb38eab7b3684b57c8cef3bd9046d0e9

SHA256
cb114258d3942f5cb95507e070e06353d0eb1ff3066ba11d27ab71fb33fc2524

SHA512
30646b2862e26f97d0d4f267211c435704dd68e2e98da40a4cc9276e4f6824aff993df847da39a61c928def7f4736b03ceb7674430258fb522da9cb789cf7e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
597e3720e21e28906477b485cb4cc075

SHA1
63c557a7aac7ca2c180bf8489d7f5faa97b8edc4

SHA256
97f5d716d01d96f7e9111dfa28c2d25cf257900fb4eb2a826ad464761eb4152c

SHA512
b07f2f611a4a775386fa2f09407b01a6b7e79b568e21c5e809f45258a3f42b9d72018af7b33ae1332c8a85f76009896959a892be8a1ff5c3b7fce263b848d3c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10c2b93ebbea74f7309a7fe9fadb03a9

SHA1
0ccd017998c2adad52c29a3d57453ad6ebd104ed

SHA256
edf210184fb864469e8101bc0bfa60670939210a218d2d50aaeb084c31cd602a

SHA512
4adf2f7629a7c26737f4e6b4396856f0c98d73d2a813e1a73dfaacc6a5c8b25cd4abd5697d1ad4d5a63a8e1dc4d530a714eca0950ca7876e0cd0f846c02ec855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
158443a3904344686209297cce1574ea

SHA1
9e9020f7c1a4caa55ba3f1eb70e78ace86897364

SHA256
c1296ea574c74735f900d81c52dc5bc8a677630cb224fad19fcdb4034788c13b

SHA512
111c2d26a401119cca27948653622f6ada01c17a88d45338692c6d09fe18bce9f8d788111a372b7e6169ad01b0c86b7a2d8ab05cd298b3772d0e55befce378e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77ad371ddedeb9dee18723a3ad99ef33

SHA1
d982615c71aac44488147105c22eb3028e91e548

SHA256
8cddc04c9ac0570c263788cd9b87c7308a761f1202ceb2ba9187cc2a8899ff84

SHA512
99b44ad24f83ea456b04a912d13ecff1032f19a7121b2d6bff78f041555641e97e472ad55d1971f275f47b892efcc36b5151b919c413ee4a0440d4d72619225f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7297716a3b07e800ad7c0b012add04f

SHA1
e404cd2fa0f49ae3244871fbcda20740a45a7fd4

SHA256
24bce94dc7b69784f634c7d4b408d035fa000a6ddfa6bec6afcce22839c59dc3

SHA512
676043f287bd2e774830c6419ede67fc58e55ca5004732b4ce33455c4aa7355be1d3d687f29ad4f4ab184a152a528c8b37ce7914fd20c54e8b8b1b1e132b6298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72ffed80d2f99ad390aa1d5e4098be86

SHA1
ed04c6ad8c6961ffbf14ee11f9c5c23ed2ebdd74

SHA256
174b5af27a45d38218809c0290a7b96b687a422b38294abffcc991be2a0c529d

SHA512
cddc159240106daf34997cc9bf4e87e14b39e722388742ac3bdf695c82d05a80c821b79b8c574373344cbe191dd10ac33472586dd6ee072ce2f4814fe8e3f1ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da2b91c63e5513a1002b7a215f4e5bef

SHA1
212ea32146ba081b0f91b1b92c4e9fb582fac5f9

SHA256
74d00a76d9e686da52ba6687b8aff4d01190707f18e4d60e8898a98be6e75369

SHA512
345918bc076c6b1e3b27bfe1f812d17dea1a13815770d11775a60e3c18eb6c1b07c04b34ea3233c46f183ba7b915ea22ffed4d2055be265ab5eb4bc0abcd8531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
937008b024c68d4ebba74b4bc7bda4aa

SHA1
fec53aa3e7299ca6027086a812a69ce5a398e6f2

SHA256
d6f98510e2aeae707618355e6a04369b340890e8e5bcb16c31796a6b8bcdf394

SHA512
24e814590f7181fc54c6cd945e74f25d2339f8d2ad209ab4e44d7cc07b6a23024651d5b2b59668b1bacdffc1db545a6e4c495903cbf9e29ad9b8a34e2ec806cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e28de7dc77fd011398918ed7b83d2c0f

SHA1
20ef35d6bbaf419a3dc955753b1086bceae05e0c

SHA256
4ae1808aae19ce93479889f24586dc14497583f37e8b617fa90c10ffe4d10f06

SHA512
49c89f57169814d933d5c8f2cc1ac587a577ac27b36716bc84644392c85a013076ef9a3027425cb8b38c1878425266cda19e1cd374a652e1c2174f75809a25aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE38F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE390.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit