f3c2a58edf1df35ed6bb444dcb926bf51cc675bc9b4636831b9b731558272d4a

Analysis

max time kernel
133s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e166037cf297e48eeea71a1962f63f97_JaffaCakes118.html
Size

84KB
MD5

e166037cf297e48eeea71a1962f63f97
SHA1

6756055bc8a4857d65119d42ffe5e053848f7501
SHA256

f3c2a58edf1df35ed6bb444dcb926bf51cc675bc9b4636831b9b731558272d4a
SHA512

e677e4fdd227106e4aeaac971a25f72b165b2f13123c845e6d30e23bcd431937520f5cae966b57fabef5190770ba68e3998d9d156753b8362081e8bb74e28e55
SSDEEP

1536:QsAvAOnSOB1fowsVKa2yunUib+EOloY+QKI2wvGjZJXqVZskoeRlq8gUWH0V8:QdA/Mfoma2jUNEOiY+QKI7GXqrAtTUFS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f072c0880b07db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000073b285fdef4b0dcc52d1628a024da8d364c7980fff53bc2ec202f4c742b4511c000000000e8000000002000020000000d5a9f09bc5fd8da2e15bd6fe62c3540fcd53e6376672ecc134d5a1296171bb0f90000000ccd2a1d62dce599e39644591303a1e1df02dcb791fc2b63c59fa2a3845f327f5fed5cd376f49751cf35184456b07f0c073982e9aa14b68e93e95298f90692e7982e1bdef35abc09d352400070823b2d9e4d2274625347dfbb11041d00e92c2493185a460f92839b2b2aa8e86759155f86a58d717bb7c8726c7f4117fba71bf04d88c930b00a480fc8c95ae23dc433828400000000d93708df6360be8c30efaa8aab0dce5a79a9726069e57a26592b2c321574d2d3ae2f065961990f5dd05c067c4a1d1249b79456dfdff7768998768842b733fd4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4458001-72FE-11EF-A51B-E61828AB23DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000027ea36c670659ef090926447e390c7c21a8289a51011c1aee86fc66b1c8b9b3a000000000e800000000200002000000050afca696eb6823a7a4e03ec82e2b0f83809bc8f3b2720d553bfd52fb4e08dfc20000000c64593f17b10ed3b63dd5570e57cf6f4f91f834ed150289f14af15f2d2043c5240000000d2e90d04cd050893a4bfda2fef46d51c52c99e932aa67e70d97df3389189a520cf91d008d92dc1eebfa58885a1455493ac4edf0a86805c58c9c0b79d8f6c20b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432524242"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2684	iexplore.exe
2684	iexplore.exe
988	IEXPLORE.EXE
988	IEXPLORE.EXE
988	IEXPLORE.EXE
988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 988	2684	iexplore.exe	31
PID 2684 wrote to memory of 988	2684	iexplore.exe	31
PID 2684 wrote to memory of 988	2684	iexplore.exe	31
PID 2684 wrote to memory of 988	2684	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e166037cf297e48eeea71a1962f63f97_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d600f79e038de12eafed8924be99e404

SHA1
6fadaefffbc8ad766f63ddf79920f05d2a2e27c9

SHA256
4c580a3fcbb0f92824387693d261fafdda577b94a3ba3c3a6c1dd875cf69807a

SHA512
f3ac1bce7c2bf9167f35fe6f06ea696e7722ef3a2a0b739ed140cc900ddc26342d10d05def63dde33fa60f574f7f61b70dcdc964aee6029b3dc3e15535435276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1778dc187d430a89526590afaae2eac

SHA1
c81060a1e9f98575683fc80a45116088ff6fa232

SHA256
3a2a85f50b64b6e35da912fc7d09302c0a1863ab424cefb47112d1d98e62f907

SHA512
bbc175653929f5a1ab888ccc0ae4d7499a1d32ea7bfe519850bc7720a313c454e0c3efbd8a87aab7ad3a9897f7ea67a768f8deac990a7ecd475de5009dbbfa00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23c5eff30043c81e95f85fc07c3639a4

SHA1
744a49d74b9b1b60eaf98085c130855463418acf

SHA256
76994dbcfddac1beb6674838bd08a9b08204523080e2b8e9d88e6c63bb9d1790

SHA512
77abddde6ba6f375de1ec68cddbd9fd63d738f667dd879e4f1c02e71e51ba34c3edd4e2b08cf96564f1c04ba16f27ecce083c4f491fbf9b1a698ed912ea1978d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af36a0cd33f7a3ab2b03de5d413cfb4a

SHA1
9b6a87cf0a188737b9bc1073c70ae81d94633055

SHA256
8fabe4bbefb39f7205403600b5ab8eb54c1bf9a206f47791eefee6f96c846015

SHA512
468f43810196fc5c1f629cf07938a9b375b5eb0582f991d73c62d120f40e7a4cff8bba049cc2a13e7ac6986e89b890dfc272ce64dc7e5200be820694479a3d3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fefc51f91070bf2d994683854dc414a8

SHA1
f534c4b65d721025f704c2a504c650ba7ed3196a

SHA256
a355fe412b62ddecd817e8b93df5cf16775658bf43efdc533ab66a49c469211f

SHA512
1c0c7a4449840db95363b017b5221bbf6311d826421a03248c6be80259e29ec436397cca756272b39a4624eeceadeac5dfe5043c0b4cdf4dc61a73007ef092d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c29ad7712e6aa4838e86c306c9f7271

SHA1
a17cfa7df5998f39b907c501c1627ed4e4388a7f

SHA256
740f8018d818d687d62ea1c1d0b3e7333563f6577f83e3143a06de4aec24ac2d

SHA512
457177e87d407d9cc80debdd10dc5b4dc24063914ac5fbdd94953a38635f28ebaa8316324330d2ba6a2aebb9d0bdc86fdc29970ba72e9a57f94381724e07aeeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76ae5306e82476b39c9d23d27bca2b5d

SHA1
eb5131018c1216fdbc6d717089eefeaa19fa6db3

SHA256
e78cd6f7113a1db16fa45fffe4a7196cda9b893b0ba2d2190ffca36a69139741

SHA512
49aab2fcb12afa0f581634a4f63c568539e3bc153233c339e19a9098aa16d190655fa9f174ed50e108255b9b07d6be5c05b9c79a4c3193006bf23e0fafffb538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73cf2884fa3d1eee1748ed6687a9e8fe

SHA1
4b842d3dd6b99aec89cd58ad8d975be9dfc9863e

SHA256
ead9b4a423d746bdfd74d3dd567e25e34ee301ce00d451f41eba33df7fa4132c

SHA512
9d8e9a55fce11ab82cc82124f889e41309fcd619e2a7f1707fa8bec917778be0314ef531fdd6109ab01c094fc834ce4c5db6b30f1502fa35bc6502565c5e56ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1d08c43793ecb10beaa9bb779643c08

SHA1
f11ac680481092367517cbd2382c605ea2267b84

SHA256
166394c9d586f6230a2620548c28ca9d28dc58f6edd446c71aca8353dc8bae15

SHA512
29c069377edb2bb049fecf99af1943bbdf7d2fc53ac070f14091ffb33911dd6c19040fd2085c706eb68715c10e6ceaebab1e18a3e6631d5bc6130c9d5535619f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c8d9776161a071f20ceb31bbe96ece9

SHA1
b83d822b59a2986349a2591d8b12f54c0f668d52

SHA256
c64be3f7950eaeddaa2e5fd0dde1039101814f0f4f84a1ff6d73c62277142607

SHA512
c968cccd1c85f79ebf14635ebd192e22cac4f4e0f863f75dafbab0f2fc5ccf4ff90930193ca06d8765027e0539df834ae3750484b5971fa1101bf9912290289f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6229577795cab4868f973b957c2bb05e

SHA1
61bb77ee87088bb6e10ee7e7880c05e0e411ec37

SHA256
a15a6921223a99c5b034cbb32e54db2abe2d9819f227faa029e4a3ad5c4a8574

SHA512
b7e59884b15f3beab78fe9628bd1be8ecd116c3b007502fb2799039826eef238dd4eeefc448a3ca17e83987fa35e7c4d338e9c0d4a06e74a42c251f91a512e3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a472db1a4eabbd9f1a998eda9bb77cfd

SHA1
f1d682c8df1dd99ea14ac309d7fdd7b15c499783

SHA256
ad1ab945cc75cd8617acfa581f8302ede375c8feeb75d8f9540d8fc689412314

SHA512
ca6859e4a33be97d10a7a927c91452d2afb7ca4851021a97fe6dcd8c61434b0b0970f217cceee56f21f104333974fff9fb823696b230c42bd9a44d1efbc2996a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b77f8ee12f93ed63687e31c02ed0bf3e

SHA1
a8d4c0637391fc653bd61d2869df7ebe59599c46

SHA256
e86e41e9d10ff3c0349e44d1ccf8c1de820e373be8b58649273b50b4a718c3cf

SHA512
313f8afc3b508cdd1dffdcc65c9393cbc4defbe45332084eb4b9dc0782140aefbdb53f5a0cd28991ed44d0be7baac666a60e713ab1132613bf7d1e790c35a3c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab293.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar303.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit