1b187470a065bfaa5b4080edcc57da816912f5ea01fd2fc659509b0075d42891

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e2624a7badcd528be705e88cfdc25e10_JaffaCakes118.html
Size

63KB
MD5

e2624a7badcd528be705e88cfdc25e10
SHA1

5cfd27c3527fd7d1134fee30733ef67c3b2b814a
SHA256

1b187470a065bfaa5b4080edcc57da816912f5ea01fd2fc659509b0075d42891
SHA512

f7a9f33316bf29f4c428d1658ef3b0ceccfadada3806a999242438a334239ee9a81ea9b401c550fda528562a1d51c7340c257e27a7440c93ca474e70b8a66863
SSDEEP

768:JiugcMd1gst4BRMkz9SoT2SCZkoTyMdtbBnfBgN8/ofgcRWQFVGys//Ijkk5nnar:J4bGDxbT+en0tbrgafcbNnpQJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d5e50b6307db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000e0cb9fc36219cbe10608ee516ef7195d7437b1759263241b361f3099d0eab67d000000000e8000000002000020000000a077431c272e917268a7747463b70ad36991564ca50b8c825386f87930689d7920000000389809a0e7af1d2f0b65b9c30c14046b468dee9b9ef013143dea2697aa84fa5740000000ef96106b14856fd2e9572ffa4e67f12300a9e9c21fa03503ceb104068bdf3dae9b60bccecf053f308cb7d4a27be0f5e39c9131485cd38147fe17dcfd6e109797	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432561828"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{373BDB11-7356-11EF-ADF1-527E38F5B48B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000002e09914bbb6bf30fd99634c402bdd79581b29bf04757257366b1b11fd3d70419000000000e80000000020000200000005bdf07af9c86587442e5f3a4997f46c09d8e749e659a4b085559cf4b915cfd11900000000094bad8526a814e795ee6983cad22063594016f63b5c51b392212f776a91a3892dbcf690f2d1ed1e1acecbfb7bb913fc21000449eea31b4d51c3451d2906bfea00af3ef5367b3c86d1d948c8e985f6535cc0378f90e6f0ac0e8d29755cb4b9aa779cecaddcf6559d16ad2e37338640a742d15e1a811ca41911cea292bbb5e4b3bcb00a2b7638d013d4e9996d569e31140000000efa4f3f2ca9fde3425e78ef13878ea3b4f2888914b023c37c6e98e256bd390eaee4b0871fd4322916d178c5b32da6a70f9451e3c062cf46a35fad9860a928611	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2692	2664	iexplore.exe	31
PID 2664 wrote to memory of 2692	2664	iexplore.exe	31
PID 2664 wrote to memory of 2692	2664	iexplore.exe	31
PID 2664 wrote to memory of 2692	2664	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e2624a7badcd528be705e88cfdc25e10_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36dae9ba975bb791f55fb250a99281cc

SHA1
e13a9ea9171a483827332a6ba98ad2c333d2286d

SHA256
1c7d3198bc436dc4f96990950edf4db3d4269b639a0905308566edf3a03fdc62

SHA512
7a21209ae4d9de635c7ed92f453cb39150d075333757aec1298dc782fe99119edc78d04ad5fcfbf36b062bde00191781978394fa16572b4d5db54a13ff8dcf41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d9b3a4eda6096398a1747fe4c3059cf

SHA1
f5e78e7c3cd7dfb307ae0cfdf59f829480bf757e

SHA256
dd9151d8742e99e5014369f062641c8a7e17222ab480aca8646229fd95dc34ce

SHA512
762ae6be729bb2da82ad131cf2776d42d8e8391704f240a243c782286915a4a8a331b16075143271f2e9bbe94cfea2d1be50defd50571d8938af1597391f6996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a940c1b597164f1b87e3b466b450aac0

SHA1
6b4d4cedf0280d8b94587b7d55970ac01eb1b4d4

SHA256
f0daefee491f223d7b3032a2e5be23d4547886b21798d40719748ad9763d5ac2

SHA512
2989150230534fc40a01d6b0e5d349eace9bd512a08c24a84e2747769d84f75d1d5c690d74082aa6d3bcc84aca0c9a2297c56f6966a9bdc625cf05c30695770d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51900256e95e978ef6147539acf63a0a

SHA1
64676e26d3010c91f81023ef0a75b03e55da1dc7

SHA256
f930ed3ac8565f2f00a42ef9ef77c5b16350c624c5980bc954b7ec2452cbd5f2

SHA512
0bbf0fba1d55b37a1903d001e972b0c6d856576b819dc62fca8053a43b9c23c099170b1bbbb6623ed21171a9090358f78ed42e371ea69b2de9ff8c79d55c6fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e98ba096c5ef5861a67a6d68a3c19403

SHA1
2f45882fe3f9412ef483a1b17f1ec9993b14ed9c

SHA256
541f530c7d09cc2f59796cff4ac10f7743b59a716ee5e02b64920691d4228ab2

SHA512
a127a26345e65fe9236776a59ab65e46841bde7f13d710674478dd47ded1fc2db193d8cd1ef41804ee68f787d4221ba09eab0397e799b7d229bf6df1c093888a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f30b856be0004ef36f4f1edf425e750

SHA1
cc2212a46f4cccb62221edd69c849f50fd5a7bca

SHA256
4bdfc06bbd319d051fb40fd5612ba1584d757c8b6ba7cf22c84b0ae5ac1a04ce

SHA512
086f8e46d2eb6072c4c9f3d31ddd936e6c4bc2dea7b161c3d184dbb5e76c07e4ab3aca3fc36258d09933c0792e862f098b1ee4e228cf95186a0d2acd470f3974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f9e7ec417742f54c676a94703328c37

SHA1
ee2d83756fe14697bcab96be7d862bdc0c2be65f

SHA256
46c611cab156b4139c1935917c30b74d14c0ee1999314873e850e06f10efd658

SHA512
a803e82017be13065dd33e1d02b2240fa34b339fb8f5c38671f6947ec00c52664245f5be18d2209b535ac89723d21292d3a6e26132322570c91f461ac447cd3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef6b8e7b7c733349cc5a868eb845eefc

SHA1
e56eb5cf5f0c22066bea9015ad71ff6620449faa

SHA256
91a7c15d1a5c8ed057979575d628a2e7c1593d5e36d1b98c4df791c16ab98121

SHA512
5e622702d90b958bf177f57153f29d1de011fe82011b5511c06d6526ee2cca913b789fce1b81bf82f1491668d9a0bbcec824419ed0f9e122801a893b0bd0258a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
921dfa5b40f57e1dad978f1bc1ca1749

SHA1
90d97fb6eb8825af222dd60c9f530a774c018792

SHA256
19eff43ed9865fa758ad19e28793a86b601e537d2844944bcb6e503dd11b9751

SHA512
e471927fc5ff78f7129ebe44bd6b56ee09340432133bde13c542f59058277e49ea071356a2c58c4ab168b850dd1574dae7256f0a721028a14c4e1ee89c3836a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a379e5df4da4ece007ff484141c4339

SHA1
bfa475160a821bb35d1ecdd05d3994051822fa84

SHA256
d2c2c54a90a42ec97a74d0968f1ae7a6d5b21cae63206442d92122b0ea027b10

SHA512
be8ebe6c5f8793bcfbaaa327497b00d7af5faa8c2c01fc7057637124343927a0f7549f2151152246c5354c3b109454215274576aab01d811d887b18f8121a761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bedac4bb57bdbf99c564d2e6ae3180f

SHA1
6d09dcc1d863a9d57320a713554fc845444c49ba

SHA256
f59394f9fe797708db1612f288b7d98e97ad6dab821bc9cac6448c92e0d98ab6

SHA512
a0338a65192dadc0bd1bc2d645e9b382c52b55f5697d72d86e83234cbbe170320115ee9e9403c0a1c5498ac3f4abdaaac47f51c43ddae55165666d93fbea86b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be4643c339305fa73cb6e4d4efc15bbf

SHA1
91ca369d2405d75ba6f769782fe74ebf36fef1c4

SHA256
fd577da13448e0357a594adf1063fec6a1116e1f0fc782242a8d088130150175

SHA512
0533f808a5488716a0f87a0e08d77e087879060f6e1b95ee0f5538ce4ab355e65c0d7a531d77bf8749bcf986a543741403b9e08e14fda8ca66e73535d90cfff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03d26acfa8dd74a19f5b8609956c6072

SHA1
42f70b65c02b4944031d3e67dcb9274e2b3f2957

SHA256
9bef034cab53bb53352447e00cae359ef349a0f3594ab8ddbd92c9da832585d2

SHA512
35d48ecc9b28cb3e55fe1a893e545b4fb270bd493fb4e960f68b2ba07759cd3eceafe9f567947c6c058709a89e07f4157a873a3b3f7fab2adc1e4a9fe645d632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e37651ed88322525aa3fcc78d2a7e62

SHA1
6624ee88347feaa58f9ce0db0b9bb235ec9eff5c

SHA256
14c0794e507f117c3f0985055b0e4ba6a036830ec29b229d50d273b86ef174b8

SHA512
f44b4126b8412943592513b3907a31d317638664fac953f61d94dac7bc6df3af852208cbf41493ab412baa92059e74bb4e345c4a79f357b22ab3e27dcde6ece7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e01a3515f79cd45663b3dbd479d648a

SHA1
0e812b40eeec08119f7c8c64165df1065276aeeb

SHA256
c95b7a6cae4c8dc8445b4142d9740d56a95adca4a19be04577741c713c952d52

SHA512
b6648648ef3a20965ae95be0b69ce47d7c0585260f39b286872bb11eeea94bdcc13b6f5c0fd8b02722e9019156375f432fdad42623585d6fdf82545e69945def

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f447e4d5f9f2bd886d62f1281c8f541e

SHA1
79ad086110b44bbac585643666203aa91eac547a

SHA256
87006f070e3f4d1db915a6020d3ed6d43362e07bedd1c75f030c9549a8db1f45

SHA512
1da8f2315d004f95fea3d6047528b2a0025aa1717b2d2a7f79f9bb3a406bf452ede497ab429b36cfb279e2928c610d4490f70b4bce408a39bccfd898a4add1ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b32d8f998e77907f015ef2a28ddd6277

SHA1
422586416fd6d9ad5f40a08273761d64311549bd

SHA256
973af2c5de5cc8e84534279b5f4eb9841a1df858fb88895dc5550757042aefcc

SHA512
b431b1c6d88293eeb8badef497156504e479f2b86a80fd05dfe16ee1a55f7c5e4e25d78a302ba7f08b7fefa1926e31abd27085342ee201fafe6819bbd7bceb2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFE20.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFECF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit