19010d4b5ccc8891c6b21eb9da09791359b7e6ea68e2af60e1e0bb77649177e2

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f5061f1f5ef44301511867b696cc8a_JaffaCakes118.html
Size

14KB
MD5

b4f5061f1f5ef44301511867b696cc8a
SHA1

13e4c5a1e48ef476ec1e6700ed4b2504856382c3
SHA256

19010d4b5ccc8891c6b21eb9da09791359b7e6ea68e2af60e1e0bb77649177e2
SHA512

48b8029497e658e14352e5f71f8615adfe2f49bea37c974e4a2376d736d601c780aa8ab2086cfbaec983d5837f95b8d971977575e1a222eed87b3a41fcdf1554
SSDEEP

192:/MAPTmeLOTciZLiuoFV3uXgVP1Rr//vgPd/Hrjp0/eq00X3Uufb49bxvDc2Ke+Sk:EKm/TJiuoFV3u+d2PrF0/ezWUDoe+Sp2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000000465e83c7c06c1ebd412736a912289bb2ea0763aa455dab9fe04ecbb3b10555c000000000e80000000020000200000003bbdff678226cff1be5adecc49f3ee35143784528df9a05e7efe4a350b444729900000000078c15219c060da759cf33504ce58d722a871217931b1d928e1aa0308c11198615296f1867ae179872257c5da9f65dc8a21ce4d4a7e852e788a8920b4bf1792c61ad8ec09fb25247519efdbd2353b0e05afd1ed1d5be33b51c32555ee38df40b9185a172752b5842838989a5367ee22a838df68594e872ab0874ed343543e7d2adcd6bfd84f98cf22f7b2a93b42306840000000ae273868d20d61958192a3a00647db3bc556f8f7a523c1470f106a2999b57dd8474a8a8d31ccb87df9666c01001de4153c74cf07639d66bcdcb54a403e6b596b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3CD0E91-AEDA-11EF-B4B0-E62D5E492327} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02b2da9e742db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000000eb95540d45d51ee34bf6070a1b6a68f861c96189a362e0c1c855d4920c8e4a3000000000e800000000200002000000090daf3660bff41db639aafd9a4ebff8916c7f405c486f23ba83ef8ddddd95ed3200000001b26c24a79bfab8c485624620340cfbcca92192d7e16ad78012454d1496125fb40000000df1f153bea6b4fbdba7a2e05b0a63be7596f9b1fa584c05bc7485d098aaaa563ddef705afab33aa89c8cee5a1cee1c34aa72299241bf882a31aeaa3803c76a9a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439105875"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2912	2384	iexplore.exe	31
PID 2384 wrote to memory of 2912	2384	iexplore.exe	31
PID 2384 wrote to memory of 2912	2384	iexplore.exe	31
PID 2384 wrote to memory of 2912	2384	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4f5061f1f5ef44301511867b696cc8a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ca8cc137571b5db5daecd9197a28153

SHA1
b689ea191791dc8aca6e96f12584b07063621a39

SHA256
b423fd5f4d626773a2c36621aaaa28405c36e641edc35d5cf0c1c7d11da36c27

SHA512
953310888a403d0bd04a5f9b7c04eb68382e576b91f8c39933b4c6a24275c7e0e2b9ec20deaf33a2513a1056abcc85b7535dc55dac5a9b81e06b06252f721d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e1036c95e2208f2743079df1dc25c01

SHA1
cfe878a1fa5146873a4cbe25dc3fbe87c2e5d64f

SHA256
1931866f99849d34795f5ccfd975b8fdff5acf241117aedfa2657c68e72f36cd

SHA512
ed6e086e7225ead0517348c4dea07eca889840f4556861ae6778df20dcdd00cd5b785659e3694ca9479257b373fdfe1ec95bd51e156e62bfad3d354bdd1d73e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0eb6893921e30a876d7d16eb6ab2308b

SHA1
aa0fb83adafed7ee2459f697925d2df67f568baa

SHA256
be3864610bc1adff27b25ee933d71e7b3df324837c8aa403a2c887a56746ddc5

SHA512
8994f19a12bc510bdfe958b8bc399454eca72a893065d249b74d105913e2c959f8db84f0886a9f51c28fce1cf1a51a435abf1fd5d44a56d1f2c9a655aee4c515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30ad6d095ed71c0e83a792341b09a4bf

SHA1
b55a07a84db6cfdcf8075bd20c5d68bfde60f918

SHA256
3d0fa9ab505d75a78ada450f2c6faeb8969e9a51c4f94cad9315b08109eb29af

SHA512
04a4ec7bd79e3cd2cee2f2a255b0f02cd04f94ab10bec0938cbf7b50647d20d5fe9b545e566ddc2135538dee912a4f9131e94a75f6457de8e3f4bdcad0c5fc8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
864bbca16685e17b583cb5f0362a4f45

SHA1
546d4fdbebc88429a18bef4b93fb113ff3cb1dec

SHA256
6f6e407a780966833a8d46b45ff959758231345619c7d5be10ec00e0d226bfa1

SHA512
131cd272de7a2866134cf9e42bb2cfb4281548e78ac2c5b3cce8d6da673b118df0f7f2597197a8cbf82eda47bf95a5e16f772254f70520cfabdd4490546739db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e53e0c72e8a1592aca0e8b81b3ba0af8

SHA1
c4ce3c46667f7b9871f8156282bc7d2e1123844f

SHA256
436809905114958ab5c9ba9369879e6d557f65b64ea361e08abc1a3e6174ee4d

SHA512
aaa8701d42f241310eef50ee443b5f408d6ad2d6f69d7f1e06d7bacfac2babc2401ce7f8ad080d120b05552c7508f0a7bd784b46e0095652585630afcc459f10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d66075a5ba3b80e67d59205e8a1abcb

SHA1
53e6dbac5504f60f197db07763bbf6189da33929

SHA256
d4aa146df1b8d1857a811ec5a4259bf8dbb05896acfa81a584787a9a07e6e1ce

SHA512
17d63bb8e91d79aa66740ce2dc28a2cd5da25ad25d86680f2dbeb7f220b1c771dd008c72d6b8eda4874354f1edc8b406cf1f31f41788acad58b18b71d56b7981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fa42c5922bc704e9af4514c18219960

SHA1
251f96484e5e4c4f1f5562c18d46571469aad147

SHA256
7daab75255dc47b55e21bbabacb25399a8e61b9cfebe38af6658b33c5dcb4a22

SHA512
54bbbf34c0f7b37c69047c388a853c5df9020555e9147bc3e020f7ef7189031e6c8c5f23361570a25d1a6d27e33e3a16cd6153528883081ce72f97dd9a673e41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6df3a63fd9422c47143b8a40368223f2

SHA1
8173f27bc710f1a92e983ee89dd7bc24be88261a

SHA256
8a4e10f85248f91ab841a877e2b0f168418ae4cd5b9c4a8841122606b711e4ff

SHA512
844342c9ada7e58dcf17cce094231c9fd1a08c8a4c75cefa1d59b29f9783c4c49bf28f534a20a9093f920675f80c1955b385e95e1d83aa5d91825b2799c4fd97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94fa95a403fa22ab1636b3954ee36554

SHA1
b229a6936a981f0a23d9fdd6e26ef0438a809871

SHA256
7e325b1f826fc07999eed996e76dd6715156de0e4f79198d5a0fb23b70166b01

SHA512
505f667743d14ad339de455a4840021cecf52ad279818228edf09b08e1b4a068f611bdd8dc447279f8dca7fd182249c59a89565cd6bdedd705d15735af9c5d33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47d0af73f3d0f2378db3ee5beabdd9db

SHA1
a2cc96aa8d69f68256d49b95a56253dff3d8b453

SHA256
684761501a260e67601a559b0ac46f55ba8204578ba69aab4f4b92943c0d8ebd

SHA512
5fca744f5566bc9d775a0a3a26285e34e5f6eae33e6add5e64737b7a22fda9c58816ab905644bce269991d76b58a14e9b14d9bafc0e45a40a4f5adef7223841c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1265728f99258eb134c7b4f3a59c1bf

SHA1
0c0a71ff84dfa50392e32b3ef3361a23f0af394c

SHA256
853a93166a248cd3de18ea950a52d189681f4b5cde8eb9a337e7b1a10033cee3

SHA512
55d4fec1e8e6ddc3c1cdc4906470b2881eb3ae3d1bdd4a368710d0f8af9ccd3e27fd259e6ce160d07318daad34e3b410d47c2a3a3de60ec50b0e102b655bdc81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cca8fc4f4b0030de32b4e5f2c809ab5

SHA1
a15e5bafbdbe539d41a07b980fc2060a7b549550

SHA256
41db4fe9c29400b198237d682f51ece56149f8d1c0808ecf9a5f343a447673ec

SHA512
53f05cef4dc330e4f14d057707a1455d90bd695437019a9ee9275f24bddbc8d277f0e91096f1f5797ba8ea486904ad217a23b4cf0eb7b67e9dfb694a99131390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d4bf918bfcc91f67d44d98791ad4d10

SHA1
46e99bd9199c6a86616a3771bfb6937eab6a1e4d

SHA256
43bb975c550c33999d3ee69d9957bc2df6eebbf91eb4920ce4ddf3a2fa71e2de

SHA512
f52fe59c0d16eb7091a0d31b3798114596911c5ddd40ec7188ca878053b7fc53372f3f7d7b18b2d16ef363a68e0d5c119d4c65f01e00675b5491a6ae4d704218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed730914cb8bd175fe0c035d4c03be3d

SHA1
714b674a306e5585f51fd31c2034c6144416bfe0

SHA256
161fbc85a841015d0949448fba3c1e06758dda940bd99f39118ee822307b5fee

SHA512
0503386fe0f220cab3e33ae0a9727612854c6183656ad80da9548a7002eb9025d584bf2e453b759ea3b83160f7a5e1e87f40b11918e43721d9064268c40c2165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\prettyPhoto[1].htm

Filesize
175B

MD5
ca1ce3399a1abab6d52988a51f3b4307

SHA1
3ceee27f1294f8d1cc213aa461cad2d2ed706cea

SHA256
5eb0dfd23b6a6bc58ff93d6e8c61b6418d58fec61e55fa70ee2135a23db3f628

SHA512
e5f208e69c164e3ed52521ef9d5d9449507be5b5dc555364d15e479ea805c8ca14e9acee9874fb2b6f319aa9175c145f9ab29a405ea15361f07c1f9b815cccfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DBD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E7B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit