2247bfb3bb4756b57ede06e7ae3b07f1dc58cb469d8eeadc83f8967193ba5ef1

Analysis

max time kernel
139s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e27ae4d1a700e12cc1f1923eb2ffc823_JaffaCakes118.html
Size

7KB
MD5

e27ae4d1a700e12cc1f1923eb2ffc823
SHA1

9bd38ebbca468daacd6c49c126b6c901d748f64b
SHA256

2247bfb3bb4756b57ede06e7ae3b07f1dc58cb469d8eeadc83f8967193ba5ef1
SHA512

6d03f896cb00196b74779bc7cd13cdbdb3fd24b10c32607fa0e76f2ab3ebabb31097eac8c509967caabb6703cfbf557bfc2629ee96742378d8cf2aab700b7733
SSDEEP

192:4ulZGEu4jt+5xEO7juZOV2I4hmIkUmAwjGxqBPf2i:4ulZGEu4jg537zVcVkUtwjGxqBPf/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD744901-735D-11EF-A7A5-465533733A50} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432565173"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f002a8d46a07db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000bc962e14aae20cbb9a3025777834f502dfadf6f4f31375263ae96006c781e2f2000000000e80000000020000200000002af99960b03a90523ea6d0db34ad3b48867681fa665c42e6acd5beeb2aab8ebb20000000dae379bca84f6f4e7ffa4ea5042cdf4d0372016de7be560ab64d0e68ef4221dc400000000dc70d23cd3778617081480666ce064cdd589685dad7bb02b5418128e6c059aa9347894ad43c8a6749ce3de9ee39ec4bff431bc1e205cb3ec3c1559512f3a8d6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000014fb9ad22dd07a773a60fd385856be4b87bb736a33b7463a0bb2275a9dffebb2000000000e80000000020000200000008b8eb091f32da3a9a0b9e5d585f709c6faaff1a933ab52b821203be16b5b61759000000064735269e8a8b891bb9ce67c65f26e6860ec8bd443039a8b3bf479ac670c411103133d6569dde1627e6a8ef9811849bb7c4e253a2cfdbbcac246af0a056915ec773f7ca887238dd86bf604d16134d41c8918b1b0d5c6afd197474dff5525a1eb879b37b85ccc96444f290f8c01fc00b86e9f58a71f0359bce9d35c958c3ab9145f037a84d66018bfc897fda66f8cb0c240000000e28a9b99c8da613eabf677a4e9858a96b8eae85938044e77402c4c996e5d7127f609af58766843ea597f8d8d80ae81cb723fbf304242b6890026cdd81360329b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE
1848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1848	2160	iexplore.exe	30
PID 2160 wrote to memory of 1848	2160	iexplore.exe	30
PID 2160 wrote to memory of 1848	2160	iexplore.exe	30
PID 2160 wrote to memory of 1848	2160	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e27ae4d1a700e12cc1f1923eb2ffc823_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f3890d8dcadcf8c6489fef448ed8a6a

SHA1
48633a49037826293226cb2f12a6dc0a1989c867

SHA256
05de921f7c2b8660c829c7ad6207756a3884d4bb14edab8fc079fa833a71f5dc

SHA512
e77b3b78ed6fbfeafe000cc6286dbf7c69b2ba56f1b7206ffaf854a490fac25f02c68092ef824a5e26202aaf1d1fbfd716dfb7a8c2b48ac0b83c75fd21302d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bbfed23e133fe659c2329806adae8bc

SHA1
5ca688aa40b818262d2f4b705a4ed39d38d6c188

SHA256
7f9f7368454c82af659d354a789bd69be56ca90f11dc21f676563dd34477c402

SHA512
9bd69f2ad99787c1c0ab62a43bb2f579ecf71a18d624e9aad83993d3cdb04a3b0a35d27e065a628e1e1c7ef3bf242ba76df046557cbef61b6e28aacd280a6706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b464e1fc7c8bdca40bbaffba1dbe015

SHA1
a284620b355176189d4bbbe854b4a0836b22c676

SHA256
38576237e9a72fb3423dae46027b12e8faeaf975b77e8d5cdee4a32546af683b

SHA512
dc07fc0e15c1e609a951202b0c53e3d4d6433c32f03b517c2e7db09c6f77cf7e78482222e86e25337b95daadc4356bca0e8fc486ad19e05420088b3fc27d1c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8627472f6a9a4777f85537d97a679e27

SHA1
dfd1ca304807a3dd0c6a990da87031f7b2c8a8dc

SHA256
d65b321929bf6ff805f7e6ddcb69c6bea1cdf0b01bc6c121e7ad502d0e258091

SHA512
a22e3c24281b13069fd675ed66c90a9cceb22538173001f7fbc25801f47bc700cecdd507d58fc086478eac3dde6740b25bd2ee487d5ee5fa2b7fc40e5ad891f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15afca5732a4a77a3eb02c9936b739ba

SHA1
a3503794f43942bad90d6e0534f3baa0707f9b90

SHA256
730bfaba6f9de9b0df17aa9e933826c9b9ae197f6249d9471b176602b3b22797

SHA512
aae850f99474391992ef51d137a8a711e6b1117c48132df1b15d3f320bf2085305f6337840218467f7b47dc6b747825b6aa5df1cb3a4e18f992f5391368e2048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
366cf683d50b953da0c383962e16d3fc

SHA1
4a6fa60cebae6bbfaef669fae2acd296274506ee

SHA256
84f5c0497b6a723d11fb3e0c4514ab274311fa817da5686d666ac00c32079762

SHA512
9f5e7e546a65fe51c180717e955dda7106ff0e2905832586b5056e9616e348ab30b29cca750d77d5a215fcca202210fe7179b12d94535449ec8b37b16614137d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e772603b2d369fd91078454d2080ac9

SHA1
d066bbf507f481546367770344cdff6517366b6e

SHA256
9b9c860733709c36889e704451317054cfc0544aa28a516cd215b11e26ffbf92

SHA512
3b531d179bae75d62632b53557452f3b69bb2e6e5bf09c05d051afd2e75882cf50e8f39d679cfc38a58c0c7b6e8648932b441001aa9a7f7e2d8d9299eb55bf22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed4cf75d23065aff1c265282111a7adb

SHA1
64ae1885235341bba17ecb5ea6e173fb4f092272

SHA256
9f0cd0adbfd9f5d2eca99fb6b62d44cb4b667b7c73f5383d0fa784331d769ba9

SHA512
11c5759b7ffd3765cb9feca5d9d082dcc97abd6f42b8b18b54654fc8582b7497934385697778d6fadafe00a0bf3e01fa251d5ea1870f940839f989db2d3b1f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cd6b7e92eb21eac878834834ea88629

SHA1
298fc2ad4528b893117d32cf044393872bd0212b

SHA256
cbb9a3f7e91deb75ba59552d2c718c7594a7fd9e444d26707fb88f28fa242e8c

SHA512
c1590920ed96f78d5920b155171a4cf256d8beefa3e9090cdcdaca6629c2fb10840eb6125db9000bafe1b21f7b7a1e246619d5cfb6d3aad9b3d2d1862779fc08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c180b67f5c0bbce30b3253ff6f526f6a

SHA1
361ca13c75c479487eb98d77a48de67f1e14bc2e

SHA256
27b4de2698999e4e13d750addef5c43d9ccd9eb31ed2dd3a2f48944e7ef07587

SHA512
baaeccba3101b85b5b38156352a9dacfb784bf46ef7d1d71ca6bee7573b9dcdc06104d3bb0ff845ea914e11dd937122c340f3a2b3eea8962f5399bd253d2176e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac014779ac42c94cc140a85f5512df02

SHA1
e8eda4e0e46b8bdcf6f13a337ae030cab1e67960

SHA256
ca0462cd5c566db23eb6fe188523d15493a145daafd54d017d7b6396c7d72aa1

SHA512
b74423f43e2457e6605989e1a68f37662e827ef48cec83f00e6c72f45fe8903ccad8fa077cd7b45196ba4a2fd5f716147953e017e9017cc9594006fd77fb87e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDE32.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE44.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit