e98d57826c250af3cc524e08505ff0862bae82364ca08a8611d3a0dcbda02e94

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

826f98e50d43ae931e6680e05a8fc286_JaffaCakes118.html
Size

228KB
MD5

826f98e50d43ae931e6680e05a8fc286
SHA1

96b5fcd1de5a5585a64884093a8a9ed4273ce34a
SHA256

e98d57826c250af3cc524e08505ff0862bae82364ca08a8611d3a0dcbda02e94
SHA512

ea46b25f6faf8a2b89cbf9a8c65697e279d9177f00dbf430310c46147adf3a49d47b73e4302dbd7f484ee4c4c77b62ee179ebec5eb891bd7b6e62ece060f5218
SSDEEP

3072:myfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:jsMYod+X3oI+YLsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000002e2be37bd301a471a6dcd8f0bc505303dd58eb77e16405f92d855b9d11311ba2000000000e80000000020000200000002117efdf0007ed78692b02a910764c8d06831bb1130f834df7d27a0c269ed2a520000000ce8683cd6c3c65725e1bca7cb0699d7a56d0d05a3202a8c4cd4dceebdad2d2f440000000e1601b27296fe6d7f8b4d1fd069e61f86fcacf7b529d52ab138e55130122d15eb0a4b74a024236b82c489eb65e748bf71dad01db526b75a782057a290b6eddab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC9D8C81-9762-11EF-B984-5A85C185DB3E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202545c16f2bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436525528"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000432144c7d34b7a49d6cde7aab6893799ce8702ccde256d1e9da549b7fe9a3b5b000000000e80000000020000200000003667c8a5384634f35e298df68ca060e2bcae2370a27df0471a6dfdc871d123fd9000000039dc4483baa57ad6ce4587bb874522732b020908ef3ee8d1a3b87a653663a21b1dfd66acae91f384264c5e6851a630cb197985d7a3870195d60abbd58bc8a820ce80ca28db9ec99124e93b39ae3b86b5aa93827d90b428008479c8a918fc74deb0d62e9b019cbe7776a3f2a1cfe4743bcfcb5840133c99b078e19d0c86644e3bee921f8afc136d2236a2a75dca96c7fb40000000772e0c39b0bf24d3ade03d531e2ea70c7d63e0b9d9f868bda00b3e0955e269ea8966a0868c6a7ac1c494dd717019baf6d8c9923d4d022b02fcad8da0045818d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
536	IEXPLORE.EXE
536	IEXPLORE.EXE
536	IEXPLORE.EXE
536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 536	2092	iexplore.exe	30
PID 2092 wrote to memory of 536	2092	iexplore.exe	30
PID 2092 wrote to memory of 536	2092	iexplore.exe	30
PID 2092 wrote to memory of 536	2092	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\826f98e50d43ae931e6680e05a8fc286_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3aa14e74b0b6eba4ccbc3673943496d9

SHA1
e09e26f310905b6d0b454c3d8adf5bae7d562765

SHA256
cdf226f1d941de4051b20f9624deac4bb2a8808777aa7a13ac76fd15c4980984

SHA512
d943653bc118cd5044ae87cfef55826ad2ad0ec2e4cc0f2ef6f277607889d5c99ef25c0c930a896366bc14c6ff37abe3a7b9bdc93a8944068c7091d20bea9458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ee5142ddddb70ab3e994a415a6d386c

SHA1
0301fc3c14841afc03fa49bf38f65a8f0f2aed01

SHA256
cd73521a71a4c78f4ee02c0f77be94cee4d87b38b180869ac1fd5af421ebc5f0

SHA512
ee1f17eab2d5888997c03860e65b0237505c23d0478870fd85f4836812fedf23858b3bfe09d671d8acefe96ec19b6a0428dc84f91ac92484a9c0bbfab4fc15a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
967a82039d88f43eddbfb7ec670c8a77

SHA1
5a573a53eec4cd3c29d731a3e838100c37ace84d

SHA256
eb3f6455b567c8b102ecce65c4507da860185714ea0104a3d59376e9ef70351e

SHA512
97e8cabd7c3abd4425def263ffffd80c8a4ce5f29aaea6db3dc653e56e3a37c85a6ab6a224811dd5cbdf06e04e40600e3b25427a5c002b6cece2a0d90cf8d400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1a25f7c67bd2342077cf846aa9b929c

SHA1
a092e2902b74f983a34961423ef5d2c42bbbd9f4

SHA256
ffa356901d1206454e4aa26a8c232c16eed67945796b6fe00fd9e04f63deeec9

SHA512
fbb135a5bc1268e447ce9512858ae9414afcb505076b8b288a0e15df4dad9f4151d44c142b6c6d5bc862f94383bc0e48cba5f7524b8c0c56debccf85083d34b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff9a4e9ee40a86dda958f8db11a9ba80

SHA1
16b3253c1abb807f42f8006fde6e42046cb5d215

SHA256
4cfe44d94f4a25d2cddc4d8f3749f1eb3b15512568400b5e5572770a2d84213b

SHA512
44c1ffccd0c625dba2528b507c0227d8bce4b789625da3c2a6e856221cce0c78aed0e5a2fee5994af452787e7cf523b78f499c3038addad3651033fcdfe5b554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8ea2cbca2823cd1cf30cabfc890a15d

SHA1
d84d3bb42b4e3de5588facc21db1acc93a90a7c7

SHA256
17baa3e331071862b702bd715303d98d4276fdf4a5b86e5e9075b1093076b90c

SHA512
c4dee09961378d032afd32c32dfc30b541a86d5acb242f8db86a887b7ce6a91c3ff12550eb394cb69f28ff3fa6853eb77a304635fd79862055885636155514c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50c76d510d274868012d2774a34047f6

SHA1
453e7c1a5ce0812255d5eb6d9b0c5c3f150da914

SHA256
7186101ecf4fb2e79df1e21c91fa4576ba3846e800c37148ee690f69252a562a

SHA512
65b2e2ec7d3b0c7b41a65606d866d1535188482f2441899adcb6e4a9c9b8e5f272721e78e6833d1a4cfc76e6c24beeee05fb8ccc504c6a2acde7d27fde98269e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
986dd1542fb5fb034660d10e7ff66ee4

SHA1
3eaac092ffacff46b7fcabaf214fd46bceffa56d

SHA256
c65e3e1a440f43fcca5bbcee73888668dca378189c38371ad002086e5f673add

SHA512
885c105def5de005c4e7cc434dc2080c06409a7e23db148c92d9b8984313a7014e7192223d31276eddbe140e3e2556d3abe1debec3dbaf3a0e0cf4dcbbdaf1c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a92f2622dcabb90c9d8e24dd6fcf8440

SHA1
3172aed45e985686cf22b2a5e0587de4b8a6c617

SHA256
c508d00b0273a3e2ab8d5daea6ded07fd17a78df0608f773c44067c42ecfaf2e

SHA512
c66a0c3989269fc4a9bf2b40147e28bce3d78374e4ddef92e6a184a207a295e8240485ccca475b4aa2093396496444a78fd4332cb8e27c7052159a8341515073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a207d83b5d312956c51e9c125b1d666

SHA1
6df2e21341183a1ee9b95450ab763c8936230f7f

SHA256
f0fcbbac734c484212e4b5ba02fa7c5bd919e3a95bcfb54055e176dce9c4b0f6

SHA512
385a4c45440cd1936ba635a51b8e5d46178042da1feac8081b1b37c49fd4c48062451e54b626313add439ab449ccd910e42e284a1adb70e863566cede893019a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20ee79bee26bf1f381e335dc4cce4ad6

SHA1
f69d7d982c4c064726c835137ec3a78976cf3f46

SHA256
fdab2e8891aae340a0e448d7914391e99d0c2194e9b61612cc4fd285ef94fa1d

SHA512
f10666fb08c9e002df060f87f590a96e870c8911b2b85a073b1db33b590697b726597fde8a52606f8c41438a245572d48f1940e2b67bad30821ddd306449f6fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8db09375b44498329b37fb65ae87730c

SHA1
83d58056485205b1c28764eab89503e5a5675011

SHA256
4eac2d3fd9904367d61ae2b9f2a309b2fb57c890548c0dd3d037105928356098

SHA512
6a66f96fda7c5f6d0c17420d7f3f0c36035fa778cf5744c8a8636044c9ec8f7cf87bd9e3ad35bede2d4859aeaebb55c854cf10395e73a42d29811287b71b5c94

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabECF1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEDCE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit