96f08d0f2b0b60815380a4cf9976441516a426ee5ddda1949296eefa376ce79b

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0912d8bb325d35cc33a0441273c36fc_JaffaCakes118.html
Size

54KB
MD5

e0912d8bb325d35cc33a0441273c36fc
SHA1

94ead6e412eacaa6a84de5ccd4a4124acae44f20
SHA256

96f08d0f2b0b60815380a4cf9976441516a426ee5ddda1949296eefa376ce79b
SHA512

6e276c1896e3383ac3d0fe2375f6ccca21a91270bfff4e04dfa4f0f5793485bae250b89b7fde810c02518c82353845a99c4fd12066bd2229eb8a7f9c427478f9
SSDEEP

768:NZFY4ivHr3TOYcfGy456R821CtOcMdkeKexFSG:9Y4i/r3TfcfGZ48WCtFMdke/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A01D0C41-72B5-11EF-9BF0-D60C98DC526F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407dc874c206db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000008e34fc991a1e45cf279e064c33e3b64d22e2847debbb074e36f1d2d8122b7015000000000e8000000002000020000000e12015ce1d64de00475fa97e0231e620838bdce8489841a3fad7c44509664d442000000088685ec71e273dd7a3046f2dfd2ae0505a2dadaf615bed830bd9e4b20504787f400000005e08ca45e5fb90eafa6b26573c778df2f3a82f0ddc1e889e9d2981151801603cb6eaa74dfed4b4137a6898932bbd1ceb00cd31a59c5f42daf8c916a33460093d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432492855"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000006f4d11da744640c36dee47eda4cb7d08d1d6dd7f2403a31b997ba8f448babe67000000000e8000000002000020000000899e544179cf2213e7cbf2462a76caf962d7373358dfde3cbe5ec0bcecab6cd6900000003e94900ba46c85fe35f4a73de2d2f98e802217377be1083cef505c508bb997d377cc59063141a9c1171b2fd0b6e848445892ff3a66ba29073b935de76138a222f5a363bd297522e4bb9fe142f0424de71ea23fc5d66f448c52008ff1e1691a0258cec9e024cbb4d0b7b4cf85c2048c22cd95563df2404883d6be91f552d871f254720eb944ba8eb82ee0cd3fbef3fe7a400000000e035aca6b9a5614d88029a6013c63e29a493a8948c790cb17e6dca6739c9ebd98eb7ed22771412a7dea674bb3e5e002333a2d5806c59d171ffc312e90240104	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1716	iexplore.exe
1716	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2604	1716	iexplore.exe	28
PID 1716 wrote to memory of 2604	1716	iexplore.exe	28
PID 1716 wrote to memory of 2604	1716	iexplore.exe	28
PID 1716 wrote to memory of 2604	1716	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e0912d8bb325d35cc33a0441273c36fc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3856c4b0f3a14107c047bb76411c4c0

SHA1
7b82a5aa6df08e47ad801f3803ee595f431adbfe

SHA256
678e807e43028df2ff4f58ab41f06c7fa239d4f596e4148db2dc665d84072dee

SHA512
536d51bf598fcec72e8b1fec85389bd43c50c1c353648c7303451392b71c048386306f1c2b74ada5bc8cd423e9305c8cbb776b778ac2c3902760cb9a33d24362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a32c50b19c5f8254c41276ee76520f8b

SHA1
edc477e26df774c2594ed4ccfe2a7cf48a14e01e

SHA256
18029717e804d6b93c476436adf2e27ce72a3bd25e1539a32012a720e79ad477

SHA512
7ce254fe554d7542da1ad31366486a659ef458b69aa9d05b7a25f44766e26e95d769a26f0a97d5851da47b4bae61e254aee7274ace8f23ee3e2fa2c189b20f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ff544b168b15ce4d38d9c017a2d8ec2

SHA1
2e31a0ccdd2900f912e4342612692f617c7d261d

SHA256
f7255e2301c1e62bef37075e00052595d6d07f2fa85f527b6432a54b414a920f

SHA512
8e3baa7b89fb0ca251ee24534f4dd5f46ad1d348f6b282cf0cecbd2f99d1d7be7ae1d53f76fe2419fa9b9d8cfbe73d12f8973bc21146942f534b65e965011bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4ac759127fb1aa33778fd3409576d14

SHA1
b499e0993afc6cb6727a5dc6fcdb8903bfcb1a87

SHA256
de81f766fd3dd801deacc1a8f9966fc1dadc7e5aa246ad815958aa846054af0c

SHA512
480bda294912032fe9b19888fa6b7a604511cfdf104ca22650ec4733721996e7b7045d2b93fb6bb85caae7f35810b66af4bcda45a8534f158c4b3da9ef2a1dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0af4e2da176962d96c84e3030a9d711f

SHA1
d301e4ced3b52cce5b1f9dc10abb685acbae716d

SHA256
e1d0f7c33d5245224e96b4e8f60b050fc08564281f9c56cb806d68ede7527a12

SHA512
7d4dc80ff911de9a725ebbcaca4bc5b611b56eff4dabb7b94e8c87eb12b7177f3e91724693a6815293faeaeffaca4f8cf2fc109008a0654017f48a6944af20e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfff68e685291dcd0e291ec48213f62f

SHA1
08befe101d76371002172c6805842adb2e4d42ec

SHA256
36b32ef2f422c6ac28a9f8464e16e86ee8668cc5988b1a34367705bee55a4fdf

SHA512
5af0aca975b0a99b2722c58f7913f11fb7a6c74f1dddb18e28fadabc82695031bb6c7dfc1d1f9fe04317e4a0ebd89aa37e2ca723779cc9a716cb9601acc0fba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7155ecbe59d4b1f3ae54828879324d11

SHA1
da869f5bf07a6af4bd4b2bfc4f322a81641192bb

SHA256
03a6201a81689d787bac20bf2f21ac3b318253f05007bba028484c8c4e770d62

SHA512
d28cd23c16dc77db2f136f790340e7546cede7401bc0ac7620136ddcbeb58589ffad89c619ce146f6c92a782a435f4150b000180999cf7d994fb97ff15252587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a75c3307892e1f2e28e012f159ccd8d

SHA1
fc79e83753e35030acd36bf47d183939ae3dd230

SHA256
485e07858c74bb4e0ddb079e90a03fa1fd543c16bd286dc354821c2180bed03f

SHA512
963fefcf112cfa07effe59194ad14d7f35b305bb6c3982fad7737ee43b6c47e0ce9b0f63d7425ed82475757eb54d0f7da641626ae11ddcfbfccf4a1e8df66eda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbb3af710595ac0174b9e24367ec3f29

SHA1
88b472211f7f4c2481c6df5bf8581ec4d83ca9db

SHA256
3160e2a0a96161a790fc1314453c06c3f305abd75f72a4f721f2a9ae028b7117

SHA512
08072bccd00f6c4510261b37193813e8e47273cd263598a9ce87bdcfa967295b5f4992618854f02ccfb1bdd8db8cbc82ab8c89cd3033d8bbff1ce44829d7f495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
026d25727f171bdbe71a81e233ff3ec1

SHA1
b955234c20e50adea3e843e5986c1e94c2574655

SHA256
da82a6b3397edbb777f395f88110cc24124832fd59e9a3ed7e3acafac4bead3a

SHA512
e30dfb4f6486d72ac7ae2ff6e43c4e68e9450d96ce8856005df388c530217249faa5e85e831a82465aed8148b51f1c59ec6cfaf368327456e95c941a825c2a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cf4db254b7bb07ee8289b78259d13b9

SHA1
270b3d841a584a97d7c24550d455d70f439dac2b

SHA256
570260b10f9114aa3feef1f56cad9f6fab0f9297eae7891978309ed0b7e00f6b

SHA512
50b8719c605107c267c9dd7a01e7dee044e23d231454935094a7d2357215d6997505e8cec5e5687f5d368651a692f0544b7e4202713a25f0476a659a3f866d84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc9f5e730977b4a02c37f8a8fa15472b

SHA1
fb8882c108c8f0e2497c2716ed9120031e0bd639

SHA256
7fdbf6cba733c64b3842a1c970943c3b895f352caf9e925322527697d7f0b8e7

SHA512
dd5328b292c2c1f45e7036b0afb243c077d19ded7c49fbd038e7a87aad7d56aa5983126bd54e18bc20f7e9ec752e625cb81ee82a772e75e950392b008a7f5bcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6143c716fc59bff7f1ccd20569837192

SHA1
fa87e52d5bc7cf457b5816f31a94a159b51b77f6

SHA256
afb62cc158a233fac61be3848cebea8ef13d38a4ea12c8764385d7de00d10ab9

SHA512
d8260361e3d5bed039e18d994853039f2aedb4f7d7f4d66e86f7ef7394273caed15065f77304f2d023911b540445b234de80a30f7e0e9ecc75d529a81394bbbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c5b602e7dd6ef69bb04035805af9eef

SHA1
5cac9a4a9fad9df5d3ef04ccc8d7ef4fd5fe581b

SHA256
cb47eabd5d5adc27b1e3f4cf0225104a4b98578d9f84639b8632b6cb4e9f6003

SHA512
b54b09f2cb5957735a42d151d2ae64c1a6a3a6e57296e90a097af228501a36da057b70e8e9f9634123a1632432a25844f31f31da2412901b871618384b6b2c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d77ad23807b4c9ae9ae124553d8cb8a8

SHA1
2a0a0c5a889fa91ca9c394077d4d885afb3d0c98

SHA256
a2beb4fb87578ef598cb55678240e0036be6500d8ff41a26edb78e028f6091ba

SHA512
2fd888ad8bf5833799a7d9145fe1ff19e653f0a954378b27492266473e17d98553011e70e902eeb52a8dd968cc73ab2959db9101ed176a722e8e1ee5998245d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f4b0e6c8f1477b98b78b4d51f52c1e3

SHA1
20197a6049d69f5fe79d7f4893b8b6d3df5b9d70

SHA256
7c520699106575a4ac14b2d167b9d380f0cab90c892a09b8eaf875a07c355e28

SHA512
ad5ebcba82ad6bf16ccfacf8b8332b20f7480a7aebbdd36a1bd1759a473ca7fc972570aafe077478abb2603da5b30858d856f916e8f6cf04591ec3f66350235e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7034.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar70F2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit