fcc561f3d591c561395467aafcbcd6cefd3f2888027184216e8e55b60622cb2c

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b811c368b10d107d4dd53458435b7fc6_JaffaCakes118.html
Size

754B
MD5

b811c368b10d107d4dd53458435b7fc6
SHA1

f53719da46a5f9cfa2f9717a5621e9fd7cadc7d1
SHA256

fcc561f3d591c561395467aafcbcd6cefd3f2888027184216e8e55b60622cb2c
SHA512

9b7e8859dbbc38d687b7fbb6a7617c60dadf7b2c130a49b5a0d08638f7ac2c2622b9190178185c4774ad7ccffdd2ab16d4dc64b3322889173e2155b617e99130

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52DFF2C1-6096-11EF-AD51-4E66A3E0FBF8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e7901e50292a149a7fd52254f82c94b19120c6668e9ce18b7bc58226691c23c9000000000e8000000002000020000000c28b680a5bb3492139e858dd10f5396f661b250814498539708d3bbc56a9b4b690000000c9083284d7490caf68ab5ac90b3041bc7367cc38f07f7785c02c5ce0af90768985f2299097728f874ca57f574440aff0f60367d798617faf0e8275dbfefdfeb0c8006208450b7833c268b273162854a154b9d4bcc759c0f2614989d05a34c0f574a2f53e599315a4dac6f3e88c83d9408390f72c0ebf7ce2989d1714bdf884b18f61eecb9a2221a462444cce2367ca0440000000bf28dc304759a3f67414e3f579feb7bf581cf2a9505fd1e591aafbd737ad5b73c8cb1a80de291fa910f1797c7c68c647f592f3d3d5d9b5a455e831bb279858b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430500290"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000484c1f148bb02115fa9e0b20573b1e6ac7684c9a5e83615fa4ed87eafc24c6fe000000000e80000000020000200000000110884ba6035f032433c91f73bc9697196fe409d9b8e6fb9dd08c8798eace8220000000a8ec5ad80a505dd4d7c7ba68ed6ddb637ba129e2f41c7bec8b3382b3b3356bce40000000f426cffc3034c021e446bc18fcc71be41d0010033a2116e83f5d34d8fa6509d9fe1c6361d92a5dc244d6262f7fe5dc06d97b2578e1c53dec9107f58064a62b38	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bac72aa3f4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2056	2528	iexplore.exe	29
PID 2528 wrote to memory of 2056	2528	iexplore.exe	29
PID 2528 wrote to memory of 2056	2528	iexplore.exe	29
PID 2528 wrote to memory of 2056	2528	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b811c368b10d107d4dd53458435b7fc6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ded0cadc089647fce0c8a60ee7c0cca4

SHA1
4679e5b9f5fcddc21dcfb43d712187e74ec04d16

SHA256
886c5193300d7987c69bb48baaf8359495c37b242e7dedd99a4d82b2a3d6e74a

SHA512
f5bc515283ab2aaba7506c0d071cda037cb12c91ca7ea871dd044ad26ec13f032634af59e48779051a511b36578291cd00a676af64b308d8526b54040c923a97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e83ea98728606aff0aac5d33f381740

SHA1
4d2522d5db97e37869d9add99f4cda4566a27aad

SHA256
e2fa410102a7b27c23b400a63c6302dfa0696dbf635b1700fdc8e837ca30b456

SHA512
3ac637ae2b19981ead44363ae3e37e94fb544269781575b8e348ba464dae37b66c7ada1d7b3e0a9e8fc9073a0763a3ef9e80cbcb240e58b5009af9029d84d86f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71bbd09f88f9f5e1823f608a123e236a

SHA1
164ae348fa4f042b908d9fcc4b31f802a472df7e

SHA256
275e962c60642d7dace5010bd9263bec91046ba4f50ddb718ebcdf59be40e145

SHA512
0e29e9eeed0e08f215124dd914292d169c2efed294e5e0cccc84a44166c8808c25614dcc197e86b3ddb28172272686dab35cff89e6e5e5df1bf18cb263fdfb6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d9cf4e61a821579846cd0605a7f9057

SHA1
a296e15837a9b447d38ae04f0203614a1cb8ba55

SHA256
2bace8a4e367eec7e14774d6e918a7e3411f97524450b70b26139a705a7dd92b

SHA512
fa00006f1b92fc253c79018caa18e31ce9bcb0533329df33a15df959ba153d0dc50a82a09768ea1683788b905706fa7fa66253b710918120df5145aa6b2b182c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2afb37b8c242c83b616eb2e9939bde32

SHA1
0f9ad592eae1a72c7589be4460a1cde7f7aa594a

SHA256
b82e25bd3739c36bb8cdff9dc13369f93b18f412b9246d39a7db1deb0ab1c376

SHA512
752e0a2f03ea6b48c7540bdddba028688d5bba0d3b4a0bb859bcad61700af130a7d11766321f71058ec3b80450e1c7bc4cba6b5048cde4419dd4e50232bec3d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a8193e8e1d11637b1c5cf4dbda1d494

SHA1
bb0ec74958899073c3ff005812fbe6ab7cb564e1

SHA256
0a494db7c5cebfbd86ed07b4e7c59654ab8ec56b9f6a3aae2d7e1c5c4fe007c9

SHA512
5415c6b40e52708938376259a467549ace77f867b0c9628842721f830c08724b3cfcab65b917279687011826bfde15d0b02dcf3d0b61cb8b47132d6f94f8967e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21b3ca4250b2c29762a5a1feba58cb6c

SHA1
44abf582ba31aa7aa92cbce18a60952f757290ec

SHA256
6b5bdaa9c9eea01096eb869cf5936a6f5702056cf680e302eb081e16fe62d313

SHA512
3853252d741c942b7f27fb08727ed1b6e450ca12f87719958e88eddf490b81187a7f43bafd62c722db1273efd9e70287dc3d0ae2a963a2b86726ee33ae2c21e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38fa52c74101245844002419a73c68c4

SHA1
3dbe282994406cf9e80badea7157cd8975d36145

SHA256
7f30c9c501d49f6070bb5eb5b6408366cce8887d060471602886168390b6e38a

SHA512
be5c184c254e0ecf6d793b0b8219e4bbb70234b7f7aeedea1ce17a0383cfa019d64f65a159fcb07f5c499d951b5a97c94a3c3caa3f0bb2579e285f201c46d75c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19fcba02f314de0b4ee94b34a586e5c3

SHA1
a53b2d25b9dadc1341c36f706ba47e51ea490bd1

SHA256
d9637b2954faa0bcdf65863c9daaf19b0c4930372ac5eef1585402188ced940c

SHA512
cfacd45fb80d7051672499250339b01314debe66f2ee6d0a061d262c5bffeda318d3f793bac1fe154ea5833aac270112c29ff51b2d299c2d6eca4ed33e071f16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e214a08c1c630ec6809af3c9aa74f74

SHA1
bb032366427722d0d5b56357bb29c0af3a3e8d0c

SHA256
e27b378229afbcd20577d478ed134a259aca6f237c7ff477d831713dd60aacaf

SHA512
9b282b1d53aea7869e3b6cb3118801f4b497482bf3e0e9db30ef4ec8fcae640ab3725270cf6eebb6ea70c32a2784edfe287b0e3d5135ba4fd42230d06a3947a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35b0b8a38088799ccf4f6bdb23711c4b

SHA1
0f509908309752f1d3895a4cf5e2a87745858125

SHA256
a6aa44564d6aa6ab516426348cd4ddd1974f4223a9e69b7d6a1cbe611ea4c1b9

SHA512
6bb8a6c6e522c697b08a24708c58033a6fad054224c5b2c21fb41a866c75afceb6e546f2991c45df917e66ed87503e5a6178081c2c5552d4f9fe2c52cdc82281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2b5755ca67f88d9c798daa76ecd2d35

SHA1
89a7150c5a74c88723d684b525b723143a283157

SHA256
7c4926ef34d520fe9431cc9b6c644dce59786af34485f75cd33c0c44e4f0ef34

SHA512
facee381223193d1c4bde54139743d7b307db0d362f46c092a6153a6f674b2fae96e11e59a78290294461d66aed45af10cae72329c803e707fc57b7b3be505a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77e6554224c0d57da57d784aed379c1f

SHA1
1d68c9f975d5fc1ca65430cfdb3f7b833a4c9760

SHA256
01330551d0f6b50fab89690f6e21784e22972fecdd0422172b2188eac5db5b44

SHA512
c684d4c17c44bff5dd9a0f1b462390a0d7a292e9a7eb241085b86b4ae5d8ef9f06f3e0042b550b5cc49abc8ace0b0e12fdda92d0ac9d2624f0102a8b4427a899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a0e67be3719384e5ca2fd27f153205f

SHA1
9ce774f99bf2228cec4a8e9c0cad5a8d2cf439c8

SHA256
f922628cf832a7bf2dcad8f1cc95693502612f8f8a60f5981b5b2a0b0aa7ff38

SHA512
f31abd6600776d7d30ef2287d0353e7caee5293e6e95239c05b1edf9bcf2ea3d33046d87c8831afbf675f6f7dd377dd9f9e3cf4a882b240bb7912c0b7933fcb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
094bb2000e7ec7174125e974f3cf8cb1

SHA1
4980b3f05a018ba7ffe828282e9aa90aadfe1fb5

SHA256
273e2151718499c66b3e985c5234f839ff4890eff9461c8060b8c977ccc0223c

SHA512
24c86ed6f0762d016d33e601deaa93090d98e78ab772bf0b5c5ae5f068ce5da632579d2bfb985f18729334078cbe37b3e0c8cca47094c1b48fee4ae8addd3b98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f013a49968498adbbfb1fbc625e861b

SHA1
b23a5b2c9949412378c220e67743aeae7c76fb24

SHA256
c768ba100eef6a4a7d1e23ea9bbbad9330b1ebb8d5d38ac7cc8b2493500554bf

SHA512
2e267cc7bbf2050ccb0f83d39c502d77010f8f2d439eae796cb8e94bb3e84d2dfc68d70d55f0bd2f592a83b4d5905779ce8a906bd9a0fe6595818421fd8315cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E3E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6EFF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit