69c94b898a9d5bd27461da61fef0da8a8e838e90e303e1b453b2bcb4fff4d1e2

Analysis

max time kernel
133s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0d3dbf5f2e7b627356fd01165352b18_JaffaCakes118.html
Size

24KB
MD5

e0d3dbf5f2e7b627356fd01165352b18
SHA1

acb6ca711b159ef2a681f5aa8c1eef72d09af921
SHA256

69c94b898a9d5bd27461da61fef0da8a8e838e90e303e1b453b2bcb4fff4d1e2
SHA512

dd16a2907d86c947a03bb4cccd06374add5d14e39b0fe30d169d196f39e2c8fd8b8fea7744987d154cfd5b987afcc652dd49e459e0fc14afef172d6732f1b195
SSDEEP

384:rDL2uKua8/5eGQ4bcB1FgD+aJkMwMcXrMlazzOqkPqN/irUsIJ72r7azWWMWfa+I:rDL2uKB4bcB16cXrMPb82D3rTgQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80fc5b3ed806db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46334F31-72CB-11EF-9E5F-7A7F57CBBBB1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432502152"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000099f63da513edfaa9bf8223ff1384968beebe127eae193c389c0156bff1a833fe000000000e8000000002000020000000ff3fab241e2042c85140837dce259e0e47bc69f103790516e83faae970f3fdeb2000000067bc5696b2eebbe9cdd98570959741ca5462abedc40bd2416fc7b2167d71d9f340000000ca6eaa11857e3b2ef6c74821ef8c09cba78a837d68092d72de179dfb42cb6860f75be132be81ab05cb594faa48668b9e96fa39e0aacff7db54e2077ee4cdfc2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000c417e50ae2a590c326f88833b6fbd89be17d67f297df0b5939e000690a5154e0000000000e80000000020000200000002128ec177f5d23df8437c1986d56c08b9210a06a36c9f72eb4b70abf4eda92b39000000057dc5f83bfdccf81237d473fecdc312ede51d5da42d1cff14a885754f0ca0dd09bbbe7d44a11522350e745ded0f9ded72a3d783eb78d027af807d21817e232fb20dcb6b3d9aaee691aec11e7573f6476bc980f237fd107f80095c2ed7c4c97136ffd0e17ae0ab1579d69768dcef7c3f32548811c4758b62dabed563ee093b49895442c99f9a36f0175dc2029669b99c840000000a55918b831d3ec13dcfbc6ad9660ad2aca3a50e15866cfca28502e174c62860291928e75c80a1e73c860d1b9166fa144b046a7a5e73d78cd295c5150cc86dff9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2772	1792	iexplore.exe	30
PID 1792 wrote to memory of 2772	1792	iexplore.exe	30
PID 1792 wrote to memory of 2772	1792	iexplore.exe	30
PID 1792 wrote to memory of 2772	1792	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e0d3dbf5f2e7b627356fd01165352b18_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cafbad8ba8d8af292288940963f93abf

SHA1
8a73a6dd65779fa261f39cdb9357a3b31ec44bc9

SHA256
1116c03260032d287ceb483a720db2b73bb8e1e0e72ac21584eda5e25e09887d

SHA512
54029ad7181d2cbbd0006e8d847fee8810af6be0c7a5cd0036a1d404ab63e2d9b133d0a451c94776448da4142b9c0db312c233e510394658e3ffc692019f7617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
081235cb71cdf1056410161978578ddd

SHA1
9b48f80332416ee884d9dcb35ba1ae24c8cd2e98

SHA256
9b88c801774b2d22ba1ae283ec649999236648c6eff619aaa96dbe89f5427200

SHA512
0c77e08db416b7a8b0d2b96815e136bc1aa24f2d94cc9ad6d6593fc7a98fa8bb569ca7378aadfa099f2806b3c87907fef6d08731891340adb6a07097cc176704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ff344c603bc8a82309c3588f7e6f3fa

SHA1
824617daf4a09dfae42cc3f74dd9ebdb3ca66dd1

SHA256
7d7f49a2f9c6166a375d2b4a1d39c249d3a751096a84d33652810326280c37d1

SHA512
dd5306cfd41a5560d52a5dad7792db5d6bc39d4a7f2a75f802a799914ca1cdb682324970c5b0962a8a23a874efc2df3f4d2e5616c3cf3de692e513df32b04239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a62fd9f0921e166fe98f6f5bd5a36ba9

SHA1
a398074766863f53231f26bc5a330e8a56bc6fcd

SHA256
7384e6cb7b97bb2e7423fd4fe3b78a906b9b290b0493f269d4135ea5b2a987c1

SHA512
2c3f5ef0f620c9bbee4131b907350c5e31bc0daf72c1f742c1e080c84ddf9f5483ec46f88909ec50551b8a432c27380a83dbbd69ddd5d2c738a15009149c479a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a880bb8d0e2d40236929d2a961fd9e6

SHA1
92922920f163dde94730121394430dd1a20d7434

SHA256
30c2b71763b0ed90b65d74c03cecf4aab796a4d89616d17ca495bd18abaea67f

SHA512
ac7c2ce94680772c6cf00e96b94f36d4ff46446fbb4b71c6b5b2862e05c257214d1a8cb0b29e634176d0cb32658e563af5f61d12151f807e786ced7ff9097b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f00b747f24d4393248dd2d684224f9d8

SHA1
3300c0ce5e504ba3f90681b79508b422557def55

SHA256
9d1553e3140806ae6c8b476cd710416b752a2cdc5759529b6bdf93b4fe29ab8f

SHA512
07819c024483949face4746d59f4ed63e944aa5bee6862f46ee637a675de21c5741924fdddf67f35dde9d26090c81d68d6a2fdf6a587370e0c7fa46dd5a5c605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad901404389d67263193c48bae5d8a3d

SHA1
ce62ebadb207e90c048dd732e6c53eae74c5e784

SHA256
43112e163fd3de8c505a28b4eeddf237d0879d809b1d22aeb9cd6834d3c98421

SHA512
76dc1b457fc9aae9b4a608b495d3023780ed79f8d471ebf1c9224c2aed1293df8d8c2a3f32645f4c03571020b3469113a1bf2233a8e5053ff331816fd92f5070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3746a628f7755c8be0a326b4d3d847d3

SHA1
3bd6b31a9c63bf0d6d05c616eb485edbdc398015

SHA256
0e80183a82981bcd6c51455333537b98bcf9cc5ff187962b09691247e928b317

SHA512
fad4f9941461a1b5d84fb64811daaff74106d418857fdf9055a71ed314998be91c5fea2365fc6a9e9bc04b64a200f852eb031f8c8235b608600143b9e964a524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cdc90ad1ca118d2f70a37e223b1943b

SHA1
9356e953882fce0c1c959eea3093f15fe77e7ee1

SHA256
ffcd36dc644ceec6e478aa1072d8ee87439e9459b992d6b9a7bd9a5258c9d589

SHA512
1ebfd9ac1723b768f1b1355a58e829ecd33120152df72a33bb219c32532c561c4883c75dbef74954675aa6134784e6c67edc563ded6b9e81cfc98abd0a56127a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
671a751ec75a01dd4462d707fe7d29f5

SHA1
9dc78f92a7a8b2641828e13e753cd4f03ba31758

SHA256
84800cdf6784fa85b5630164eb346d3c3b68a31c0b908115b58971e6fb3be404

SHA512
fafb5c999037237a4f38777dcd3216fae8373abbfb5b69a7cdb0ca06720eb9c0f0230403cbb2b1bdae811d1aa52eea4a12489e6ad6040f567dcbea3d858f1aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf7848113b9e6c1c727394df158e94a3

SHA1
b9a8c0395b06da9f25e7ad8ad36ce5a7790fb05e

SHA256
8e971d5aad42d24a73186b4349c64da03a44597103a2b28255ec42a072183c14

SHA512
bdb08194cf4888dce972846f2aafa93838beeb7640458f5c1bf530ca55b7f219ef482908d05635e1461b784cc86c334f2a0b0cee4ff0528bef6f82b0d98359bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1b054ed152bb85b9c0fc53f7d8c493c

SHA1
89f724862e7251a72c2d510f7c66a79fc0d2a160

SHA256
28e3c8591dbebaeb47b0643f03cb0c18341376d9249da3bab18edf825023494d

SHA512
dfaef4c6ad3855dc1ffe9d68fba66392baa06a53789e29332a1c2243705a3d4bbaee5c060bb30b5ddb2a249a2683c17a7d2128abf23db6b0882fcc1342d5606a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8164c01d255cbcceaccec0e64504027e

SHA1
a27322bd8092d1e7b9c1a74476ccd44b9e052359

SHA256
22f3c1fddb72e5a1e1f76ffa00759c166136856cf0d7a9caecc8fcc98a67c2a8

SHA512
1e2bb4eff3b7dc751c59dcb47965006546b18c8d5e7d230386f752a488240f0d1da7bdf834632ab0229e932a7d34a584a8aacc5ca6375cbd527b2d4d747d401b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
473e7f7f580daf76589aa7839be00e95

SHA1
43ee4db94dbc0d35b3f0faed8f14a7c428ee675a

SHA256
c620d18f2ae85a30aadbc6576fd627928571b6740c010ce2972c8e24041c0546

SHA512
c542fc37480ef5ea99da8563afe8629f8beae073bb54bcdddadfb61626a0f3638de2957ceaf425fb2ea93cd9a0cc42d89f4ca6992f9f1606be07ec182ca4cb7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b46e68fcb56bdf5f69911ac82c81b5a

SHA1
85b936ac6eb0db9364272b00ba566317e4587900

SHA256
d82d23659af361893ede8ec2a0c9575850be0ad6abade78f3c5dbba8c196a4db

SHA512
c1875a6b96f266545753995923815d6464945983c3995c581533def3809906a4687929ccda2d893e08d01a8ffb903b6de966f33003648b34727822427c30ffb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cdc9c6a3ea7e75a564711eb9f9a0596

SHA1
e8926d381a5713115d6c8453d103a2abce3a4e61

SHA256
0935fecd7c2eae7a96b543a117aefa3e7b693ae74861fd70ecbceafd1fcfae9e

SHA512
0bec795740d10abca66d0214cb20cda014854ccb57ee19ee626b8bf8900addecce25ff21d919f3f30980ba5df85dd7286336085ac3bc6abed9d22b57b3c73b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F92.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4003.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit