0f6a862c2b6a8eba4349c3c4d12ddc1f6755076b5336c761529a4a3fd8b4695c

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 07:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfb925dc17bb3af60191419867c5811a_JaffaCakes118.html
Size

68KB
MD5

dfb925dc17bb3af60191419867c5811a
SHA1

be1242fb39e911befc5df4629d3be3b99abe9467
SHA256

0f6a862c2b6a8eba4349c3c4d12ddc1f6755076b5336c761529a4a3fd8b4695c
SHA512

6319002990c32b21d1bff0027555d777076fcc307a0b8cf1931ed9a946d2ee3af3c87da8069540dea0ae4d7a7a2bd20d551c2e3cba171c23b9e03d6cfbf97f79
SSDEEP

768:JipgcMiR3sI2PDDnX0g6iPx9wwtRoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVh:JzLzwwtmTcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63CB1991-7269-11EF-8202-7A9F8CACAEA3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000006c618a4ccd60961873a3577ae8d5c00ff812b4df29941d220aea7e12119cd47f000000000e800000000200002000000092b6af3f72486a5a65097a532c3a35f73cbb0250f6ec100a161dad4428544f3220000000e994a64a86ac7527411c6bdb7ab61bca429142cedee8a1e708d5692f54d6ae4940000000ee076fb3c7e5b548d0cf3e962910e998539fd4bb5c125cb55b0b7275cfb55056b57232fe9f82733bffd21b49f332b4e7ec1bb8eb1cb252db2e16bc917359f524	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000007171427178ae33f90688a12024410c62db6b9157e97c6069a03ca149e876bb8000000000e8000000002000020000000ac407c87db523c6e42b9b33691b816f870b221e022758b90cc8c44dc79de7586900000008bd9e9b3b6aee7aab0c74b8801c8cc3345c26e35a76de333b1627af86c0446d218e69ded5ca28b2333bfcc08a1c1da1a00fe98a3eb0fee9719853e87fd5b39f2002fa930e1e49610d113472ec12a9c4490783d7b7fff57830f433a3b3f6a52ae846efb8741c0ddd4e956144fb5a25c5a41d4cb99ace0f101fe0ea18a2273421897c6401aa11421314f09c82bb6a00df740000000871cc59437d18639cf6368c1a377bf4cf0abe0735af602d78bc23b1aa91f543b73bf324f820bd3a884ec594b9e7095ddeb9f38e1e2f0e3731b95bf365158374d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40fa223a7606db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432460112"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2544	2120	iexplore.exe	31
PID 2120 wrote to memory of 2544	2120	iexplore.exe	31
PID 2120 wrote to memory of 2544	2120	iexplore.exe	31
PID 2120 wrote to memory of 2544	2120	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dfb925dc17bb3af60191419867c5811a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51c87fb65caf650ad7a6bf441ee4c320

SHA1
6197de3fb4fd35172009bcb29cd3cd247d801509

SHA256
3abe1b05167e3bf44ca9fb78a3a66b649277482a1548e70276f1bd0f0595441d

SHA512
424e2036ff102fe8fb6d1976301781d1da51ee4c44543e2f9309d8eb4c4d12f425cb969b83fc14df981dce8dd7470ffbeaa81b39e02607900bd382efb664a304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecae0ac2e167d9196fa7dbd77e48785f

SHA1
f57366cee1edafbc8288a5294b4e87f818930eff

SHA256
a7b470070d3e16f53970e0e09a2d4b46f4ab5fe4a32388d3c5eb7f88e8bece3c

SHA512
c6503cb314f5c6c80ad572fc778ac754282de9efa422dee414126dbb416e387da7bb469b23066b259149cb27dfb21458c2beec57429695f0dd509937bee5d069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f44adcf66933bfe18df38860a6a09e13

SHA1
4109206ebcbec1f77bc6189574fd3c7c06331bc1

SHA256
8c2671d5bdcd91ed785d17eb6550ed3bba5f7d272d855b6fa711fab01c57aeb7

SHA512
9ca657779ec21a5969f03fe3e1695dfc64e92133517b14d887a99cd668361ba48545c1c3f24f6eef5ba46b90272848b502e86b95d6e6616bcff5eb3b6dbbb549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9cb85e31f6f00edab581b9e80da88ec

SHA1
6d78e1f8883c973d31c724c148faf3a99f78ccd9

SHA256
1d45bf96477b874902816d3549ce0892fc19c80eb4880d36c23f0d7ca9251204

SHA512
9b865fd43f84cd9c81bd2d90787617a185f8cc353986bd424c17f42292acbb4a5a000ca85dbe11a0ebd29da220a27b4e872b9cf7487847c5c65fe10dbb7124ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b94d7bea061d69aab0de8e8ca5e2210

SHA1
734aacff487a9e293f64b1bc6b551b8a7b0f6ab6

SHA256
1b3a081107a0e442ca15fd3552e8ec983a81f183a5cd7747a4a2e648c9c68dec

SHA512
57e7803f18e2a8733cb5f2b7103567e978b83ce6ddfcfdd3e1da1510d5bf64677336ab1b6b9fa5a5cb5ec688ce08008c1dfd7aa27e55b87984cb8baa9427a479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f478656a63930cedaa0b1db595317a3e

SHA1
a18a6cf61b040d0232a92cd42ea8139311e0c502

SHA256
cbbdd6788a1199277fc3d8c78276e423507dd77a60901ea4c7ade68ae691c6a7

SHA512
eed13cb5d1d194e22b582b472478027fd82feab6c590e6dfcb612f554e74384ed7fa14a81a51b13ed6052cf9892c423de635835277a057e17a42428ed7272570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c0ec97a0485f6fd4ca4e06b188f31bf

SHA1
7d45c7a25471bf5b53653de6d3a00923c5deb12e

SHA256
1b54fd20893baf123f1690fd993ec9e44bd3fcbf69de343db02d5efd58a2f701

SHA512
f12c66c9cd52e57959ee979281d8d58700f05565fd8a47659bf7a9b4b5338aa4ea08b84e91298c32de98ee383c35aafd49d08caa922797288e9f6fc67a576625

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
407449a4b91e44de23911b5de208dc0e

SHA1
8e473008d51da5e84246705a1e49873f67ff8807

SHA256
ad8ae0ee7c4495712a1931e3d9ad29815511f5ca616b2983ec88a9de942cbb11

SHA512
5211eec7e1897149feb1c814723780d787d6cceeb63f7ace0e99719783d52902c02246cf34b4719249fd163ac169a188b2d895d5de057b21ac6d647bb889f153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eb2cd4f5248c2baa94a9dae7051ba27

SHA1
e1902659ba4d91cc13b2ecdacfdd8149fb5cab8c

SHA256
b30f2bf7b81caf1d62f91463c745b63c52d71a9d3622162e3ad9724dcfacd974

SHA512
3e0260367e8746413794d405dcadc5fdede5928938aa812d7c1668d45acf07419414b797207cddadec39f0d8d5bae62937e59d1c03ce40beab0a561dd31cfe52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfa30b5be27fed6230b386a0f8cd113e

SHA1
a983896d625c2c61a320ce7d4a613fbb820c6137

SHA256
cab8945310ab4e8664b1306f04f50ac6234f364dbe21109ae3540b1ff93e3c1e

SHA512
637d8777a940dea1567e7a9abc591e37db6582d99ef042cdc9f9c0047261efae83f7d864f47c3e0610ac16486967340d919cd15b7106d28d99ed384839337fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a3328d463eda84ae0875b8a53ad68f0

SHA1
954cae77b72f1325202bbc01f3ceeab8186199d0

SHA256
6558ec9a8b662fdd37bc2013b19b3e4a5acbbe9a58324658923f50de7791b6e3

SHA512
af62976c2cf96fe9dbb464899271b623d54a884da5304aafe2fcc9067fd56b8fd79bfb76f223010049b3db3e7fcdfdea843e2a15500be19ee41b8b28949965e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39058f21097dac7dcfa4117d82602170

SHA1
10637feae160b65fc4fe908f6a787897d887eaa9

SHA256
1d2912312f69e983468344e996025c707498d050524b0f352e8aa1474bd40883

SHA512
e5f44a4031996b51fe4f82420e0a9352d0aff9c8cd0aa41a36b322d039a7c2779b87399d85a2ed4b194217f9357504874d00b3a310c43d705167101469d1657b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6436c5910e7a0ab5c46c7ae28ac8cb36

SHA1
f017704980c6cd55f50440038f5722a106480587

SHA256
23cad5037ec66b150cea192aea0e116d2589d5183a570cc6996ffa4f7278ead2

SHA512
24e920164c60f4f0a4eb9cd8d9cec35dfb93529d22c6932add3d934514790847f90218c818bfaa6f4337d6b2410ee893e306598954888c1cd974dcae14e49ba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7560f7b19d5e07125ef846ddc543e330

SHA1
2d525e7ef6704ed51a76a1e48a5e1702c5f9e78c

SHA256
aa956e990de7761d82acd70cd8d7d9ce2f24d1f987e9e8ff29dfc6e891a1a38d

SHA512
a9a10b3fc689a86d1ac0bc49bb6f72b32c63ce9b2a8dfbc0fc64d6bc37c215a7ece3ec99f4ffbf451d48f365a544e971c26c5b9d6eec3ee4efbb333fbbc0baf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66fc73c224ddc69e4bef0312c6279d60

SHA1
f563bf06e77c41e7c5af9ab98c53f957610487d1

SHA256
1ee5b5003c983272f7b675f255a66a9f9d8d48a6b31d4224a809b4bbb505ef31

SHA512
679b07671fc3e05d5802ea7b1d4a3391cfc81371f31fe377d3a89ea8e8fbe9d1ec1628226fbb433abd08ad1ce85d3ba4e14a9fbf614a9667ab939e5b8ac12de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0b0a0fbc3c0151bf9a00149f503a00f

SHA1
5ccb08f2aa1c53dc9197032a53d4f23bcee6ba5a

SHA256
3375da9e87b813014805f3857309cb7c7c4d0dcaea3dad49c797a63e015e3499

SHA512
e746766df90f635d24600b7bef62c481fc27fbe0b5f35680c8c18584bf086cfa6313b499b1cad7e08de298dc45fc1e13c663c7ebdf07f524946a8f0f6af3ef6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF61.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEFC2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit