d393e4ff787052d30e5f20cb42d4072f12073b8b86b8c2df3a7c2061cac5e9d2

Analysis

max time kernel
135s
max time network
149s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9591e04e374e4564459ce400742196f_JaffaCakes118.html
Size

16KB
MD5

c9591e04e374e4564459ce400742196f
SHA1

c4b8c6d8dae0ebea98a803861e6a0a9157c44e96
SHA256

d393e4ff787052d30e5f20cb42d4072f12073b8b86b8c2df3a7c2061cac5e9d2
SHA512

8ef9063f578351791bbcdd7c6f22ec1ccf6074db954594e9922125297b51355beebd427590edf5cbd6433e7b7f1fcb2427f6d661bb6c5ab6c2cc203b44306658
SSDEEP

192:87l7vFZ7vn6+yCYyJz/hfeZIkeZHbsrsE6mu4C+6m2+8Q4Q/AN6mArXr6mFPxa6J:8VfPMMirtP7z7jChMMU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431116926"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000dab882ad378bb05e369c19f7193bd20993bf85538ba872f5763a89cd61e46be4000000000e800000000200002000000056736b07bd16975d5ff6b6dad1c57c3081ce0236a13fad2ed2f7247721c050d5200000000a834ccd28d347139fcb90ea71f3cc306b11a83b70f155d3c9c1f9e3873e4e3b40000000b1ae0fa8dcc0a6d3224206f27c76470d9e2ec575672a7bd3eadb95d2cb8d6364fd2ecacb329d1a53be3a4bbe1ff33a4c63d6db43842f95d89f6544b16c31a43c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7073d2063ffada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE050051-6631-11EF-88E0-C2CBA339777F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000a31cd123bff13d4b9a2b969276213c78a496497c18471e50ca0cc98e53ddf0db000000000e8000000002000020000000de0d187b580a27ae3d0bb1af60ae08fe30a7e468ac0fee45ce8ba93d3902b40890000000d63f2ad0eeedb0caf2f310afb343914f38182fc7f672c987267ede0c75f13413a1cf6a87c9a663d056c8e05bf3f6193fae41ba72071a7663f256b76c573968ad391976dba3cd960030424c508c5159b829b3e41b6ccc5807a41e6c0abf508b7fd8cc8dc9e0bc73185b0060c9e61a03e16247da09d2ff6ac4e19584326dcd3893a31b57da928029a461446a8446840bc040000000d0192f58adce0eb1d9c39e0819914166a3b2aea040baa51fce0d58833a8e5fe2f59db21f76ce8fe5e941d0b313553e9fc1dea46369e2ce59154f311b666688d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 3044	2284	iexplore.exe	30
PID 2284 wrote to memory of 3044	2284	iexplore.exe	30
PID 2284 wrote to memory of 3044	2284	iexplore.exe	30
PID 2284 wrote to memory of 3044	2284	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c9591e04e374e4564459ce400742196f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa366ead2b24ec3e3d421433050865b

SHA1
57b322bd1100a00f77255a661621865575e587ba

SHA256
ac7cecdafe370e30cbb25c1ad8da20fba31bc5c05ae602d7fad5f514ed68afb7

SHA512
fcded645cb1292e6c77407adebd41be87e8dd1818e6cd6775cbd31f25c39c3a092e1832020d5649c8e67f69c59ad876c2249186bd1be21068fede9699aeb233c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96b1340c526f26305d8045c9ee6ef1a1

SHA1
4db16a08ba3261ac6368ef07c6d643e8053dc57c

SHA256
a5558b9ab262a3ab8a5692476cb1a48d8638135662b99a309b2d6e38faff02da

SHA512
ae520d5e3cc5038779dbe0330a75b48a8b07fa548197fb8763f471e42d254fe9b2eb9d2db6c48a8a4e98710b3cdf1037c756b63192c9f48f889f35288f9a34db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21f56664e6440a5e7606ba11cbecca2b

SHA1
04d26f3e5aabc0fe883c7e89c2b833ef1e62e541

SHA256
cc9c499feba3a782fd223bd6f4c622f6a3bacd40f70f52535c701710f121a40b

SHA512
ce10ddea10a15476b27e94818754424258f380de0fd364276de286b53c34f1dc34f57ba34c6d3e16ae763df7e9faf5f743f6f2f52e99afbe121796daab17c45f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62dcd7cf2560b564d2f5012b74b23779

SHA1
12ed9b019b3fc040b1dc26b0102c635c1330b985

SHA256
8a1083b0556cb08ea45d4e320d47f2f28eb72f663bef2c32f8979f57a81116bc

SHA512
e52db2300c558c6f6a28f323b441d1b2893efeea78acaa854d3a667ad6f125ec8d6f75e7d0551fec00e4983ad28292e4001c7dfce3324f3fa98d22e33ee8aa76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af07613ab0c4304332c9fd4a8cf67d6c

SHA1
4ede86b1b7e9ed79a1883f985ad565ee092d36df

SHA256
fe1edacb3e9ba8fba0cc4a42e7b9d344ab9ba734dfeef5eeec8d1c2965899530

SHA512
808a6dce3a73d79c575e2a230f9c704177e52a82438415ca42b38fd0d190bd03c01b380f8c6c3d82d96ae6036f29c89bc85c3604af31d7a03c54f796813559f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bea4a828c2e0d379fd4224e25c0aa56e

SHA1
95eb467514e87c0e00e3475d25bf7bcc3c007cb3

SHA256
bf823aae187601af151be73494f12b86bf7b3e3eab670f19ed4466ee834b5b7a

SHA512
726cce84a73d8588dd23e0bbee7a6496157e0ddc4648cd673e6b87c12bf6aff11be66b404e569032887d50ee90732101200cfa8ae6a221a8db038aecc6deab56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70846b33caf9e21a338b5a8bf2237cd5

SHA1
c639f1c6dd7c60cdccdd7be607bc525463b6b9d9

SHA256
d1b447b8e20d1fde4415ab77bd7c694d7926d28dfc23c9febe7e5ce773f52790

SHA512
9552c04a538b6c4f1f82df2eb0b7e06d9faaf5b26234899ab7f21b3e1bff9e86c8a694b989e1c7655661dc66ed43195ddc6a880baa28ec87bbf0ae6acf28f475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c78a23fdcd0d240bda33b1fb3b7030a

SHA1
40af37a1c8d8de6bc8e956580078b584fb470a32

SHA256
8c5b1ed56a49b440896b41adf1f9cda1d9cce5cf11e4216fde8158bb0ed301c2

SHA512
2d4b2bcf20595884514789d64cc59163158bf133b2bbccc320512da8f7f30082820087ff8f4599753eed1a8b415ece5a55f5134115db105ed1111c6d5c01b155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8f6e9c4760d420a0adfd0362efcd9b0

SHA1
53d9fe31e6899e6c246bac28af202a34798aa0fd

SHA256
a662a7821e819405ba80077e0312423e2b4eeadde65685a7da252ba0c4f62847

SHA512
9c6d7fb2d8b625dbb41acdbd99ce4b5a168208587d4d2c1456d78eea2bebeebc438ab4f3a64220ac61ff0fba759b15cd16e339dc5401e3e2cbb90e59ebc0bf19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f69743602ed04480f65dc8ac3544b76a

SHA1
d29170066855c70c19fca3e3cce62813054538b2

SHA256
b10aa5716913a72405cc343f2982d3f2612b524a6fdcc8cf21f89f68ea5e1679

SHA512
c9b04f322d7ec41258eb2c7dc7dcc13cce14973457cf3e318d3a4826342c175373f62d2e1acadeb41fa2fbf92c7dc52c7df4d232e7f55af271f0ec616d553728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8076e0b695f5d61d4594ff55071ee687

SHA1
958fd311a813c753160f373f673ece9265bcf9c3

SHA256
1a947da2f4d02b133c7333930b387a9d8800326308c04fe54c85b231c682e010

SHA512
1be4ddbfe7efe520dfa02e44efd5fc3d158e7ed54c8d7e69f2fcd96721b3cf9deb90f43f54f9b1912356ebf41246d93524d5fd01611ded0d2a7884a8ea86a6a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d62e73dde8513aee31d55ecbc1c42a5c

SHA1
2900d8580c11c4730960f50249170a7cb66a241c

SHA256
b40d8885eccce13288d08d37317a98428bfc971b2533c895caa2ed6c69f2ef5f

SHA512
c085f8f2046b16de1140c7a6edf8ef3e2c572e9e454730e7f446aece019581ddae5918493f61bb856bda2757f15dd57ff90592af2f70129ac74fb30cfdeed96f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01d3c9e6d978b2f8b7d94c681975c747

SHA1
ab03549db3c334a3e2428937b242cb199cf58d4e

SHA256
06afa0efa906b77e190e8dea02062e6f604caae0e58466e4ef6f6250cc979b25

SHA512
bd7e7e037be349f7bee25f485a605d962f814a81bafc5615ea80d3cc590653fcfbb8673831a9a6bde754b766b178ab6e4b5a56c42e0e7b5a8332fa9037f3faf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6a0a9cf4f1e055948eb2b3408b0be00

SHA1
e48f85427f26c02daf4de15d8803ac7e2b173c2b

SHA256
4a8b47e711b3230fa198f446575a937ea8eca58b6b07a59c046aeaffae80b7b9

SHA512
6a5a2f7f09043aca5206a42dce3a187837fc03a7495b9640ec5b640c17f342e9fde6dde3506bfd33f0d3aceb0514cf597196ab283bdf01921839fe965e603d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE522.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE5A3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit