69350df30047b7e13346ca06d403e61b9c2ea0593ed6301ec6ee99c55b3dd2fc

Analysis

max time kernel
0s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

827526b5cff8361f7ea331b82e88e1df_JaffaCakes118.html
Size

53KB
MD5

827526b5cff8361f7ea331b82e88e1df
SHA1

2911293ce2e67357891fe6ebdbeb47af40cfa96a
SHA256

69350df30047b7e13346ca06d403e61b9c2ea0593ed6301ec6ee99c55b3dd2fc
SHA512

5ee95d64e82a0b2539f81026202a4a755709b998025a79a57fc89c943d280709b78623f4cc31e2af5a3189b6c02c0c5a570e38a9bf276df35be5937472b2b914
SSDEEP

1536:CkgUiIakTqGivi+PyU4runlY163Nj+q5VyvR0w2AzTICbbAom/t9M/dNwIUTDmDI:CkgUiIakTqGivi+PyU4runlY163Nj+qF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC7047A1-9763-11EF-BA23-C60424AAF5E1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2356	2528	iexplore.exe	30
PID 2528 wrote to memory of 2356	2528	iexplore.exe	30
PID 2528 wrote to memory of 2356	2528	iexplore.exe	30
PID 2528 wrote to memory of 2356	2528	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\827526b5cff8361f7ea331b82e88e1df_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5fa1c68994aa73f01249eadd7b353d1

SHA1
face7789208de7b3e7c63da7f4283dc5768dcd1f

SHA256
c5c61c35cbda9acf341876b4ee65aaea909036eed6d70ab24c4adbb66e0d9507

SHA512
64268f0360cda45f00c4c988961ee34cd6b39f32aa9f2fe8fd911271e3b5ed2b8a482200714c3c84eb46ee03951b5546e78f53c40d3c121eef124a76f2bb2f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
423f843fe7626d847c11bea79acc68cb

SHA1
fd358e1c57992e77585e4d59bce9dc6e8d5b0dda

SHA256
54b37874decabceb471e5c468b13314c56f8316fd77f67f744c31492e9e928ac

SHA512
21ced2b7085429b79af2888d975b23d93482ca12401148f7696e044806d86dd4e7a7ba1c1f7a1f7c44f1d6231b053cf72061241997d49997f674117965174d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3ff63b1e33c283e48e4ce5c27ce65ae

SHA1
f0c9810b3acdde6837b094bf7156a8597fd58b64

SHA256
3a518da37ea6c1f5f129a6e24bb1a042800edd6cd86a2b6cc8d8a0c9decad2a2

SHA512
9c4e19977ed8f7fcb1db19040bf133cf028f4db4dc8aa4b70b11076ee0070d148ccc2834b5c01b2354107826371806b04a5cea04585e1bd1ea7159c619b998bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3462229c335a10b8139565b219b3ac42

SHA1
dba4140aa9b47dddaa244c653ca748cc2ab17617

SHA256
1f0bfe76f917a22a5b9dde1620a52208cde0dfdd27adb82bf9830ac4599ce5c9

SHA512
ae022bf9b2bab4cb792e114330b647ec468bd676d5308615a781a52ad3adb8da8803b2939c4ea64e6893b088c3c3761dfe00cfad44da3df66ecd825dd05ad73c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ecf7e9e2d92c79fd55dfc400353546e

SHA1
2d4117a43e31f4390456e8201185908be19c6e50

SHA256
0b258d4de0dd0c73b4b20842b6cfd3ace9908be35b913080b647bb3c8cc7d339

SHA512
2b334f2a350cb08be3106df9addad08bbe65b321431c419559de9fcf6e010dfe73946f7df8f4d97a55ce2492ee1b4b40c512b297780d1eb1dcc3fb4586035dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a680b207b0b2f469316cbc87fcc2c9f5

SHA1
20c5232ce63a1c22f6ffec322792c97042ee04bf

SHA256
90a3c933fb8849eb12368cbc444952908614cc83f5d08f0a2dc775b64a7280f4

SHA512
987b638390ca37dbc1631d6201321701e7f0b7e4d0e63e7504244ee00752627cac0016b73b88646792fcea055841dec8c08318d6975c0e22ffe9446b422b32dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c5b03579b49c66e7ef5114819b45b98

SHA1
6e72b9cdeb9f07af2ada2bdf0617e809f4c89c09

SHA256
86fd45470fa40b38cc80ccd54be07a002ae7da87205f6243d2a45ad092f58f78

SHA512
8b2eb3dd1b8183316d46272ebc5aa2599487e7ba62d0929c834dcdc3523a8b68f9901f9a48e4173c2f7bd3c14cbf71c144cc387c14916cb6e9e7ead2c461f9fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
962b5326009a191e147ab0a4c21a0bda

SHA1
f474efb3e682dbc609ead4a757894264b844f3f8

SHA256
e6a86e5e6bb7b5fae7ac24c17bc9edee1a073cc297a272951ff62bb841a490bf

SHA512
86969cf82cb1f77c79bb2e2c3a5c84e584bb57ca31f14c3ea7acf04961b42a3c770a4b86f08cb4e89d5329ffb3664d946d0d9f6a6f120d9947237b1e8e7bc26f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18e5ba1ac2c3b4858801d9260f21c652

SHA1
fbe31eddd4c1664ba59d2f94e592643aa6864d94

SHA256
5e4f484e2f7df576e834f3a4f27886e14254cc97cca541d4cb12c4d76af18c5b

SHA512
e718616c85f516141a0baa28473639c685e836d115e370d07b13e9fe61629667e4bb93455f208fa3b2172529417e8c3c0422467afe62e5790029a971ac818dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e633299bcaf5ec498e2f145e379d320

SHA1
05a8167cedf685b3ba4706f3dcffe6441c468143

SHA256
25222ac1edf5f4d4e3fb92fc9b5149593715a06e0d61714b75656812f98cbb59

SHA512
78e0b9d054fd483c3a8d13bf41b537e8396dd7a8d25017b526a6969d6e72f5a2085fa1c57618e5e6a7f071b5c85d249166a5a66e9382f7d9509134485d0a487c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6b3cf69e0bef5860909ccd3d3efa3e5

SHA1
7dff763d3591268749f0422fb2833a8031ab63eb

SHA256
14051b1e08de97deab70279123c0fe8be5425966c4c916e3d4242ae970da1ba9

SHA512
5ca370fd39b43ab41059dbad5c43544b30fa578d1b8d347a815c337856a8dc1805b7c6aca411ffeeeb43cdcf4fe4c5ca41a045ce58541d15c965e56f906f1810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7d3539c02abf25288d0d61b33652f0c

SHA1
d790b06c77ca57552db85c395d898792f46ab188

SHA256
1313b5b7bba0cde93e85bcabc826f2ef6fdfde6f26167048fc2a3a00e32f950d

SHA512
ab6e14d48aa4a62b816378447c0af63aa4322adbe350b0fa62a58c77dd7a081579629fab883cba24e678212f3eadbdcc43c08a4f0c6eb57ded5dcb812e8f866f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4b8dcce4c1503500457a3a52b34a1a0

SHA1
99959952fbd5ae722e87010f1e4ad3eefd672c84

SHA256
509d0f28afa52c96e4e39da9d1213df2745fa90190af38cce6720a0c9f06d3c2

SHA512
4fa38f19c46a6c2a4be5f133b469b6679040712b06bde7bdb5fe6897e07db9e920a935dde7de45b5eb217287113b3aeeb4df364579dc1deace87a665404318f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
173da9b1907d1feffb7c568a5548558d

SHA1
b67c6097a2b01eda1ef2a2d039296fe70e4eb73e

SHA256
6d8dbd83d70d779811ef80c03f8e02a51eda1dd6e8ec0a423a13d378324a24ac

SHA512
412bb3024e0a586c38339de103d51c396bcd7ee2bfc5d3b06d2f113b9f39f859a7839d4e4c523a41aa260b680d8face82a8a7aee9491fe117e98cb118687f0bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
560305876e137ca4d90a7125cbab7deb

SHA1
9f71644f4d1e112d8f753abbe30cbc7a457a4e01

SHA256
1f36f7b8a6a9d7c26b1c3c258d1d36d10705c902c8e1347bd3001a68dcbb6748

SHA512
17523eb6828afb8b1e50f431867ac61624cebc59d9eab1c5065faa637486b7e192d9f370540df5e65f514ebf8f227f0105f3379e72afd1683499fbf4dd9ed0fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98cfef7dd72535e7a25c9f784de33820

SHA1
19b9997d6e538b88e070850586a337ee53bb4269

SHA256
be128ccd858dd7260de11a2ed3a52ff44e53caf8485ead465fce53d3d98582f5

SHA512
fc634ce8bec86c2258f1a68d176898d6d3813fb14a83d219ab1c5a0064256e1c5df79874470404881ea4f428a4591f3ba0b747e1cf7d63f8bb29f413ab5a3d0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD95F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDA00.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit