9bc93a27547485d573f367096bd804194cb1e70ae1d1c7eb54184aedf6b2d319

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0bb656185aacf7558f101f4cfd0e432_JaffaCakes118.html
Size

4KB
MD5

e0bb656185aacf7558f101f4cfd0e432
SHA1

9dbf056fb60e07b80d6573ef4d8798ce828bd738
SHA256

9bc93a27547485d573f367096bd804194cb1e70ae1d1c7eb54184aedf6b2d319
SHA512

2a7aaaeaec0b3283a0958817674f45bd829ba9e2d0f8709ed05af71384e20810654ce8ca36a3fe08aad16983760686822a604f158479f8088bbb304ef23f342e
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oOABd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432498815"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50253155d006db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{809BFB71-72C3-11EF-A322-62CAC36041A9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000055ab0bd18b8155b84c749ef8db9d9d6cd04789929c0ab5e6ac745d3d9fda813000000000e8000000002000020000000f525b647824cd4a410934f45bfca8ebfba0c5e132cd96760d3eb4ecec47e7c1b90000000f2d34881e0df55fc1d0b51dce15098cdaecf5ce8d58c14d1b3e154a1de7007b233e6d76df17ce0db36e9e3d7b4f9a5c2259553f96f06933bf6bb9a414af977b0f4f6c9077fe99e14b4b1214c226c91ef47cced6fd68fbc45c49cd9ec2119c05e44a438c9c52d4dadb3017ce4fb74f2c715ea6b15d70bb8cb34a36492e42fd6acb0d96ce924b6d89ae9abef6b6176fb23400000009d8543559955b83eda5a3dae5c463022f238cce795e3576c281419d6e5b0ba60ea7de7873c4cc301b3de33fd2586fbca28f565d02c8114ffc1803a651265fa74	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000d6ff451547a143586b11338a97847b67ea4d0355e2aeec9dfc1ca0356d6ccf18000000000e8000000002000020000000632335fca7e3ad2c06b2897e2c331b242ba836d99d088c2cff96540a70e6866720000000b1825ade9d85ac9c9d418bf184c083ad7c0039b5847af4b1bc4f0e340ce43c9c40000000de4753be467f2d0b2a6fde75f4af5c26c74d0af6a2e152b61d553062f81676a580fadec1044eba58ed6931003609057b3236dbb344d346b2c8cd7afedbab7ff8	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1968	iexplore.exe
1968	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2292	1968	iexplore.exe	31
PID 1968 wrote to memory of 2292	1968	iexplore.exe	31
PID 1968 wrote to memory of 2292	1968	iexplore.exe	31
PID 1968 wrote to memory of 2292	1968	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e0bb656185aacf7558f101f4cfd0e432_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1968 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b62ea4819ceabb2d65415c09221ddb2b

SHA1
77c4846a756b2d7df4d4ca5a87456335399c901d

SHA256
e97e51cbb604e18a1762851ba21d83faf541169c1e1bee0a8f3bc1e5fcbd3d74

SHA512
817018a51cc20b94c160a832f77795934cd58456269ab11d3e92c6f10047781b05ffde368826ee4000002003be39b8f4b1b628f275bb7051e64934ee430c1f64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbcc8fd2f12834e944f7ca59078eb5bb

SHA1
ee3f5f0ddf4e2cd42dd98d08d13d7c308dad2709

SHA256
ec1a224255bb8e5eb1815de69d4c2cf8ce04d69940f6c90f9f4783ed902e91cf

SHA512
855a7ef510a1966fd536e6c05c2463b6bc7b2e8b7d621e62382a2b4e5335cb40525c2ea942266bc7722e090bb3a0768ecd66d152f2a82c15293cb327fd98affa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f140f43f2b3e706a8d517e6c0a2f3e1

SHA1
7f75640ca79110f9a3626862d4c82133629af8e3

SHA256
10a48f269c010ffaba82952318685eece480dc1f895cec9758a964b02fc455b7

SHA512
625acc2dfb5b88c4e039c5763a0e723c80adde21c6e4e10103a5aa1f079b59bd1a4e3e9174026c3be282b02bc7e503179cc2cb01007b47fe71bff96e86e7fb0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd99ba1726ac8ce2dc90c2ca77bfd5ef

SHA1
b5c41d1aac5c8515fcbe2a31ce3dd611fe852daf

SHA256
a3f4ef2dae35146d9055a40c1fe75a08a901744780b90b12b4c93457483ba4e2

SHA512
a5f8d2bf4697642135913f19c81eeed9c1bebd8bdf4cb865ced4ffc51bdaa523ad772076188fa7413b7a9a8c3943a26c6b02e1a6ed06531c79b09ec71236d635

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c4c8e8075f712e9433c17de373817c2

SHA1
45381ae25fcbf8674e9e6161e797bfc31e0a14c5

SHA256
dc5da6f7716132d567e5ad1d0c79bbbf0082d68422f41df6b03216d212522217

SHA512
e802419971fdc3654edc11926143df7a1bb6a45d1767a1f0793ba51dcff1afd303ee33f8747b47d10b796171804bb758d2deef0c5bfe0d8891d870c7525ad63c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dc71acdae2ebb512bc51be4096aa7f5

SHA1
bbdd7553764438ad99e700e22a7b794aef7cf547

SHA256
5edf2ede939e691847fa30b3168f36a7a89929d6d05918a48b99aa0be6411e34

SHA512
02017b675506ddf8a216e3cbe5ee408acbad027573d6a543e395b571e3a421cc0c6b7d7db02b9c356c1ea6bf74e1fdda5a446a373980fd6284e231dc020e86bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee0736b1a9737abbd4babb49b7cb6326

SHA1
919223ead8a732f5392c3dda8171f829c29de58c

SHA256
2cede2001d92a5daef2afa57ecafaae9c279bc41af0217d75c0aae0233379a19

SHA512
6f29322337b47af549b1e583dd39faa0a1829ecbc24d07849750605e66e738a5ed5d1bf078d77dcf2b947c68738af42dfe4b1275306edbf1e10fb27a653743de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5c2064473c6a7502c23818c0ec7dd03

SHA1
8c258fc985b377e251e6088e413fb2669e06c7bc

SHA256
3510c50ea1dabe9ed6d83da39de3b6558295258f27eb034c14d4c1116e1dc78a

SHA512
a980e6f3d9caee5d820f6c1b2624b9dc3f923a103f7466775ec0112a2a4649ba2fa625ad89dc67894751ab40c05c92b64d41dfd70f0cf859a24c2a01ea7b9ec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea4b12db6769f2454a7e1d2aa487d2af

SHA1
23aa4b99766705bfdb8083b04f1c4b152789d2b6

SHA256
ccc62cef9e454d10241c12a7fc2b684ac2eddd8f3b260af3f064d6dc7d307cc9

SHA512
ddba08296124e87dba30de6aa970217988f0c30f52bfd8574785ccee208516283ef5c4c5177fed8377ccd6487789554b1f1d6ee21455341d92932fd5853f88ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
161668767ff64135ba988748e4d81f54

SHA1
931b3a1ba851c69c9d8288d6054cc5a52a02b158

SHA256
84242051454896c3df6376894435aa1efd1fcd18696c94064f8b4755621fdc48

SHA512
7c9c61148b417cc1f92c20f88407bd8af6ce99b958f7d14940f3787466e0c215ee7a89a8ad1d6970669a5bdaa20bb9c98cfdb54de5679ffc26e188d3ee272432

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
832058f24fba7ae6e769b181e7d90f57

SHA1
0c0c8248d32eb8c508d4e9e1ceafb99c3da8d0a3

SHA256
b1016a5168fb29e6d7c8dd1ace465c2f02cba7f7e705b1e71265ed93481fe55e

SHA512
3ff7a92fc76dd17e07ce007b52c029f70ef41fe68489f3eeb83ea4019a5140f50f404d13e2980e1f0ac8a3f60ad26ee672134173a5b8b2aafd549aed53e6bbb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
088e138c176dbc02db956bd3e53a75ca

SHA1
8ef5719cb80e84a26d8136c3dda754160ea5c818

SHA256
adb5eaec4a124b1687769f924f3269a909957a210be2e446c7fbc3e36bc7fed6

SHA512
e78ea8ee1b21cab53c8beb69b700c7e8e2a2d22284edabeff5659a3ce465707da0204514a06cfe4c7d6731a76ee07e74caf6d52bcc3d217d6e33dd846626b0c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c71aa6bc7c429f7a1435b4fb19c9a1aa

SHA1
c8e28bb28af3c7f8c64bb8758bc07b26e7379bfe

SHA256
68a51d3fbc0e756929ea754bf127242140402ea8fba9a8c55c78ff65a24e9a8a

SHA512
d3fd0195e2c43f8a0548cecd852fb6b85a362848b64eea7e5e6949eb3d7b78a9e459fdd22f575006bb930a5da02ccbbf2b5116c5ab389fa65c33965351877ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC0C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFC7E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit