29e0ab5deeeeb665ecc1fcadc0224d3e011bdece7f23d06047fc9c746a3f1fb2

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e0785a63a3c22513d7eb7fc41413a8d9_JaffaCakes118.html
Size

9KB
MD5

e0785a63a3c22513d7eb7fc41413a8d9
SHA1

b0dcb0b8c052c572ae410c72a7c94ee4813e080a
SHA256

29e0ab5deeeeb665ecc1fcadc0224d3e011bdece7f23d06047fc9c746a3f1fb2
SHA512

193a1f9f5004b192e8c58433d6dfea0912f512b07292e27a96d208d46e9abf757a083d7c71c3dc36d0abdeee2b31060b725bae4532333c47d6afe7678a1f2329
SSDEEP

96:tYrkAg2guGkQVt9xZWvAdaZLtX9+Psbsc5NLcFnw4FVH89fDfFBFdE182ZXEWMIW:YkAgEkafRwyjc182hWzJQqagWCp/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432489332"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603ab75bba06db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000fc63b9f4b696d42e0052f38ac7594853e195d35bce22e0b5e757b26d7f7e65da000000000e800000000200002000000097ea165c6feeb2d6c993fd59aa74d2c07d44e7856fe3b97272b58b564ae199db20000000c70d80f5f9da20db32a59f55179a8f21972a8f92ff9f7b66030219408df7a91740000000a4d202630db56bff966a546b1bbc68b22e8768144d3712d65933f0bca3e7f7c22acaab487a1adbab537f8339f614261dcaa25d70b060781bd49984413673efd6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000716d8665fe622a6ef33d33886e5bfd512f98f290e9fda2f32d42bfdd6b823733000000000e800000000200002000000057f841519349b9ac73d33bce8266fba26ea0dab79936800f5fab8684ee14632890000000e73fc05506be2e4aaa91c5fa910478f8af7eb072a61cafb498434ba1a9e4cb30eeaf2a5bee46b40bbb372f73292830e3036da0246d0c03f1a615167ca0cc0ab786ceeed73418818e528701e36a57797c3583d3739e7e04121fdd58ec069094bbc4af1f9fd2683c2f991213075d519a67c6eba6a11c61f0db69ba2527fceb62dfbd53b8d01e1d41ef6a35427b128fc05740000000c163a75f18e66332e716b61c43326c7d98a79cc693371951ce8b4a09835fdc1ca89f69bc8a9c8d0b862c234370f1310d15810d96ba07c7e9de08741bd7ed5543	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C413C51-72AD-11EF-A7C1-EA7747D117E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	iexplore.exe
2520	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2540	2520	iexplore.exe	30
PID 2520 wrote to memory of 2540	2520	iexplore.exe	30
PID 2520 wrote to memory of 2540	2520	iexplore.exe	30
PID 2520 wrote to memory of 2540	2520	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e0785a63a3c22513d7eb7fc41413a8d9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c40adf072e8eaec6ff9576e0331f5c7f

SHA1
7e1ae99d85fa53ea4b8042ad59cca00350e39e21

SHA256
e83cf0004299b8d6f6fffa8f42d766a1baa1e1f4472764f2ca211b64289e35bc

SHA512
0cb1409a881e37ed8c91af92f2fd24d949e6271b9afeb239f0facbaf083f645440a67e929b69d2b6b9857feb26dcb57a34466aa4bd3557d058821eb9e038d674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bfcc9d52ccc8eec79ff0d58317de0cb

SHA1
9e74525087662644e216d4f1df7e23c54441ca91

SHA256
f070c4686add962568e0e24bb2aed8bfb53952ad5ba40b0e466f225c98846986

SHA512
4b2cac50427c7378c3b1f3568b543ad8ee9600532ad31c5ae5ec05927a8ea91b30e0484248377f59f1b1fab142d7b61300903c96d8cabc5168e201898d7b04ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97115995563cf907b10a02d79d2fed3c

SHA1
6c53c09356aee6813e617a4ac50cf55797905a6b

SHA256
0a07e8634ce27848a45950526bdb618220d62bcc44b50047dcaa42ec2afd6df0

SHA512
ad49832bfda33983b5368ef1837fb8207f531c9a1d2f9234f2e987f505bc90822e09f0edbd6a5b06ef09b2ddb289b44c98d723d9f2a76071e5aeb93c06cc3b0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ede643e7ca2952706327a75186f23dfe

SHA1
e1750723a7aeb494f325836f144f7a663f0a9a22

SHA256
e8c150f6c40345d60a47d587b00f825a63f87cd14c1243bbb792b0050fedbb6f

SHA512
872b1cda7f32970c98a61527d0b24a1254cf91f3f9051bc04e1b190020ef173e09671d795d704c2bd6d3cc09ad568ed88b1ad3e0c0ebd160ab9a679929356222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49c15c2685710af30890a7c61a1c9efa

SHA1
e4e420a61f6f4cb622d589370d839cf3faeec536

SHA256
cae392467b5bbcc40ff7fe2312016e549e042083a6f98308dfb931e30fd3ef57

SHA512
a87428f080260b6af4b5de97fdbebf099a84a067a5d285059052de80d3d34c234ab9a4f2e50d25c41247a38d2054531cb238fcf1a076476cc4b47818265c6765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
592c1fc44f4019aae03d7bacbfd2ad7b

SHA1
dc3f0f9d91620ab6227e045bfffc935162b43720

SHA256
49bb47901b357849c9328d5c8c2ef13ad3a9323f37ffa1265fcfc31329c7e8f7

SHA512
7dc7fe4831133fbeb51ee7ab9618a9890f0951823c6dff979ead5868a1fb9ccdf36bdcdf0ed0bc69dc44620de16323750bf2c8c20e98399f9bd0055e046fd27f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65fdf63227c191fdafd07cd5f5a684aa

SHA1
57d9049273a96961999487946b0bfe39155a24ea

SHA256
2db733e883f92aa20d689a11908fe4641bb73c149d487b9e3f2c78f0096840d3

SHA512
fc2daf3c1d65aa27194d8e08edb36fe4a09179d059b437a82e90a4449e34625f72e8a4f33519b97e30c5d5889ee6571e12b6b211deb025c8fd7832aff67bd6ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f215368f07a54edb54fc64ce435d4851

SHA1
9843044d469b81c508cfc1720fee125ebe8a29b0

SHA256
f784369f91404d64f1afc6558cceec6c50d6d3ca8bd1aafd532a3dd326f68fdb

SHA512
e00c291d4f9d37a7018070e8ecbd3e63980ea46c020e85a57c222e01507db52e45d6dda62bd108f561730586bb702a9199475bb94e1ae24464f22b46176c5676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f79a5c980a92d3a48de8e5433094604d

SHA1
2da66133641f11cadb60fd0c099c3f804ec7b1db

SHA256
5a3ee8af3cd39bc26dcd01926bf66824f07dcb668de1a68dae9dfd65c5936115

SHA512
d7060907f01a7f9420f286666694af3dfb98135c4b932afecac410a3a04a860244e6cd64fca758f67b9ecbd810e4505d4357897e45942df7b53fc08bc4a06120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d531a3363d1a6199e0db4592bf930b6

SHA1
be47c2d307305b185eb79e4599b93ee4b5eefe83

SHA256
54021c7333a0e4cd374832a7b7927f979861c3e7d293447318674a6d8f1d300d

SHA512
5b2724615e612b5238fba3486936bdea3e3dc5652e97de4195fddd01e0f588b0c7c3881a079bfc1f66d7c70e864590292a1b6c3f5fc77b81815f5e52bb9a224a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
387d3dafef187de066d2e297caa0b361

SHA1
934cec5ec0c427af71af5e8224ac665c1b843441

SHA256
a96dee2c56f25051dc4df90a121e1d2ff07b92769a1299bf400b20a654ee5a4b

SHA512
ca9eb8067b013a45af300d34072c2a469792be41d1463c1218278260582bfdc53f649219ddbe7e84e4242df91a842e72bfeeefe8b2b9ded33f53f30809858ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
792f82c202900064ccd2470a0a440aa1

SHA1
87e255a352678a9fb098ad46f48a1824ccbc67a9

SHA256
ed15571856d881939baa9969f3c75de37063a8fcde999b0abe57171213b1aeab

SHA512
26af618dcfbe396aaf534b1cba0bce9829f4b8f0801192caa3c53c7e123bf0f8e10194183d15910067cbe628d61f42df02c89d1465db6635f172600a2d5853a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E52.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4FFA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit