8bb5440e2bf6fc04549a7fed442ce78b6766396c5133181b71c03728788fec75

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e124177913e575c492bee83d109f185c_JaffaCakes118.html
Size

5KB
MD5

e124177913e575c492bee83d109f185c
SHA1

0d3423477dc7fae9aaed2abbd0be9353c564fb70
SHA256

8bb5440e2bf6fc04549a7fed442ce78b6766396c5133181b71c03728788fec75
SHA512

28c646426ed0b73ee3de281f02ff5ae3b950df58c9d22e3c85b371930bf3db93f9a36e029cc49a891f320dc2b3cc47f1ba4641104ae294ee0e8ece89af084ffb
SSDEEP

96:eAeE/s3Y+cqfqcWllalhmR3UllokczMGhUc2bg0f0U2mii91YN+zpFg+Ojc:eAeE03Y3E0llalhmR3UllezrhUcUXfNx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000a673df9cb2b0b29816344c2ad277f4afd5b9e4919896ffb80dfc0abe42ff130f000000000e80000000020000200000002792075ee87c2ca4c661d6ef7287dd05db17ed468cf5b9b8b69661fc5c0092ac200000000998e95a909cd516f632764d7267fe2a22df7ffa95615de8bb252966dd90329a40000000a9b25f803d205be6ccfbd7a0a6eece366f1dce4780621977cbc65efd7055bae67e141da403a4840d0d4c45db570daee0e098568d6fbbbf7a406a8cf909a5c454	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000cdf7657a5ee49ff3c717b0eebc52b97640e8417c9ad62ae45222c32ac35748d7000000000e80000000020000200000004a0331d5b034dd232e52be44dff6d52e8d8dede9a03a3dc7f2a9f0284bdb9fab9000000091676ff1ca37d5c62c4072eb197b29581217df8cc25a8d363624095ee2049bb8876542412781f59290a71a293d685e0164705b2c1a379ab1787f38ab61ebddd3b715b712bff9c053a80b9473c14d9fc554126654d5a6a96a930ee0864bd33187492dec57a59d601e566c7ba72327195235632b8f2566e1f645f04cb270a5c294f394f8ffa4545d63c5e700f8eaa08ae940000000d37be8bb54b903ee452833bda26fff729d98d57f8cc0e77d258e6f97b2fa76702160764f48a9f296a41ac9e29b7e04c2a0ab0bd79a7787a910ecae441d3bd172	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432513884"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96FB12C1-72E6-11EF-926E-C6DA928D33CD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205f6b6bf306db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1536	3028	iexplore.exe	30
PID 3028 wrote to memory of 1536	3028	iexplore.exe	30
PID 3028 wrote to memory of 1536	3028	iexplore.exe	30
PID 3028 wrote to memory of 1536	3028	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e124177913e575c492bee83d109f185c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eed3f709b488a414740f7a009b019ee

SHA1
952b08601027618becceb6939255cd456070be0b

SHA256
5292bc1068a4bafd49459131dfb1c6ab819d77bb00989abb94d7f7dcf9018e49

SHA512
9b8c8d0e983ca3001faab92dedf09035205476f2033150f2bc8f79d9299939d10e2d80d933620918a884e6c3042e709ed6a3c3b16bb46d7cc92425d37e2e914e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ece53218d24b9dfbf595e9f48bc0f0b

SHA1
6fb7c6970e74899c11eec4cf590ddeaa95fd54bd

SHA256
f2f32202adac67965382a44ccdaa1efdfa782cca85407cbc65b2fda30b9d4b36

SHA512
b2bb7266734282074236e8c21b3d0328dfd84e3925d3594b94ec254ec6ca343bdd13d22ed950376c14b3defb3fc6d732e56eac3d9e191e451aa4c595a47468fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdff504108edb539e5dff9842ec375d7

SHA1
67b740ed4f996c70bae1d23e5f75db3f4a199acb

SHA256
09291e69c1d9d4b4b4be925aeb216c37d65419816502cad791c664374bcf2eb6

SHA512
0546a42505d0d12de1e79ffcfe5075c2a12c49785cb92736abe4e4b98d05b8fa0e4c075fe2f49c00e5f9e15b201e1af550083b1e3331c1511f9edba8a3ee3b84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a8653a7a2362fb30aff2e0f33f060bb

SHA1
e9a0b158491da4d314707b906c22d0d692cd0cb3

SHA256
84b9199b99624efa642d2ec0f4c2063b0e8de08291b0214f11ffcb0789e97d33

SHA512
62622199342605ff97d177a012c326185ea530ee1389ce0639e600ffb8d5400d53a257a9724943b04163d8bf272d23c666a43a990ad846f40c278815d64e355e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2143b778603b2ea3852115e969f4749

SHA1
b49e072ecb0199219c8d3729d824a1ce3f93c7aa

SHA256
437b8cc423092df2f572a6eac6571e579b4e276a5b4851eb12678e2db02b39b4

SHA512
558789670f9362563ee352184545c49802e481aad09902365748dbe1b9017225df6de9591df08724f0ff167afd2c55bcf4bff96224c12362ea7811849c8b6c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e61348bbf0d46e0b2c6a6aa0a6b61d78

SHA1
5b4d22236018f840a179acbcde292edd51715259

SHA256
43f0ae68c92df32a28591e43ed73ff1ac4d2d5608589a1b0549bfce27ddca100

SHA512
1e591dfa1a204625266ccd8546ce63abe9f930cc50d976d5dfcabe70f90108102bd594a72072aad299517aac8b385f6e8412491423dca3fbef2516917e301e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e23a8340ee696ced0305bd65f903554c

SHA1
b7ce021184671c85882bd2cdb7d1e3bd12a070ee

SHA256
f19741741893beb6cda0f9a8db835d39ab33d4a7771bc2697d413e5256c98e5b

SHA512
d22ba09778d585c3bcce8cab1e91669d2c2fdc4f6281e226b3dfd99fe1353d78d4d6dac375e99ffe66e3ae64eec92c34033587da495258f45812c8268b9b2e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb2a43c31581de70b497102e3909c717

SHA1
5a0bb9aee2600a2c2b218452e7209b602b8a565d

SHA256
fca80d25004f4f9a9d411d36db86625b99ebe6a28947b70c2b787409ace90416

SHA512
5d4f92563e13e203428c7b57407eaf067895e5d8c2246b71a25730bd6f8df3fdc86aff4160c7e456a8a6307aace96836ebc81eab02413976887814cca46b9741

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1d8f4de5c93b78132e688c8d6d2d64f

SHA1
3a06c3d9dec379e34446d820e58e751408b93d7d

SHA256
b1c56cda60910fba0fd4e888b70b5a8765cc190319cbc1fe450daea9fb1c5774

SHA512
5a939d9c782c43d6e7b71de1e2899d9eaf7bc2ced07b8ba3b899ce27e18da97fe59b40c421bd0cc60811fa00ae7754024845816ac644ea029ab6f20b2a3a58bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
229b9cc151eac5adc8b680adfcc85b0e

SHA1
326b32ea821e0793a82543162a1cac716340dc67

SHA256
f3cbef6094587c831b02c7de8c6d714bc3ffa8b1cf3166c895509d77472bfb96

SHA512
52d5d83ade2b888a5c585c7283ee2651445a30df223e85790c031776cc491955d123e816e68fbe300f9d01650c8e23176324dd9bd22c4d2f9c5954673d7e5ab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b9f6b296ff3a1ea0bee14ca4b4e3f5c

SHA1
380ec41146d31465ed82b6ed729fd7c2ac6c6bc9

SHA256
8fee9e0493cfcddb6926c7f904f99d98ccae1f82a1680a1a1b9cc2f47fc33aae

SHA512
0ae34cce9253d87a62d2c6630031d3a8bb2575e1fb281f5b76c70dc9e0d4abba965152fcb61ae18bb6d44775d018234aaf7fafe83d7bb0df468b2138e964d909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c79a71c633e8bb82f2ddb4af7388b94b

SHA1
5e83e78dd9e37b55a10370d845b28d67662f61d4

SHA256
7b9d20e2e342c5f916b6ff739b1fed7bcb3b0feb03254cda4e9f413523de84f0

SHA512
b66e49fa5d219646973236ba07a747e898066f3ea25a6d111f5558ff568b30c995b5d0548d19540c4ed75ae56e641e1d92130f8a27f1dca82faefd2c70724cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb0e9d2a7b7e1b5d600cdfc7cd35b479

SHA1
321748a8b86a6b96904e10def211d0d6863b6512

SHA256
cc898990497d02d602f568a1a19892febda9c6a6a2e80dd7bfa262175b86a112

SHA512
bfe881fbe9382e5d3501374f8e04eef59fcde62b47e470e60ee169687c8ac5d7d0c19f2694e781631f9b438453d55ed4a3190823ba5090d049c390063e38bcf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
443f8c60b37ed5552076fe849a43f88d

SHA1
504e3ad6051e964762be7d18405ff2358006c47d

SHA256
cf0a5278e28518e7cfa60d099fbb9e373610a371c5ea96aa12a50cc45703f3a0

SHA512
0631c8d4f2a1def33ee44185fb436a4a4fa42773954a8eafe825c2b04fce19b62ab00fd00875ea62d74e8aa75368009addbd67d4426bcb1e6be7cc7c8455f393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6873b3bf6958b1943094f4fb5cd609a8

SHA1
717044874646e8a21876f12fb7e66a84ffdc66cc

SHA256
41ddb4066535931feb81b2633954e6c94276e420bd5bfdc110de81d852cdda99

SHA512
d75b0c74db403642e0d111340e22e2e018ab2df3f9e79a236ceee31fd5a57e6a87be4e825df8fcf7312e8171c867d487b607255b5e5c432f158ce50795a20e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab94B2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9524.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit