ee55e43759cdd0911ad5ce97143fd0550ce576a30d6374b309338e986842980a

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9d11985e55ebeca2e64f276c9f55172_JaffaCakes118.html
Size

68KB
MD5

e9d11985e55ebeca2e64f276c9f55172
SHA1

e99bbc32074fd20813f471ac9b36f7cddd537c2c
SHA256

ee55e43759cdd0911ad5ce97143fd0550ce576a30d6374b309338e986842980a
SHA512

1fc0bab00435ca6e9a5684a9ef6812bb82d6d79a8e702396ff29a90275dd28379d024e812a872245399f5f8400a674605ca072fd376231d82f5265a47d31d76a
SSDEEP

768:JiGgcMiR3sI2PDDnX0g6JPQmK7rmKsoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:J0yjwTcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000007a35023e30f5203f06fe3f6f461c696cade37cd99f3ae19ef600736b57c931bc000000000e8000000002000020000000d3eaf76392521934588b6cdedaf8cbaf3c3038b1b91599deb99e2195aed0784090000000963468e981fd4ce28e8e971d4be46f07851356bbde8aa896479975ba78d84a17d630251322b53ef483066fdafd4d6a7103cc2127dab8c12e85d463d47fefe0e44556f18a0f81b73fb5a2ec6525262d097a939a802acb88c0633d04132d65c4f622ecee619bd3c856f883d39fcd1158ca9666c641c1b4c6d054bb1fffc753122e7023ddb39fc69eadf0f703753a9b772340000000c22cbe414d4e72552d2f5f3945517133a31a8089091f78d1667d3d6e57ffef8c9ec8a232782902e6b6daf8ab390e8e00fff200c0f1bf9d28ed90a28dd5a1be06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{733F9C11-75F3-11EF-931E-C28ADB222BBA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432849261"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000053d052b8585e8ee9284fdcbadbbba72b91195055f3df9a4be4f7fed9661f2811000000000e800000000200002000000026926d8b56ab78f9041c6beb1a063417388208b769dccc2145d4314cfb1de8ed20000000649b83daf8500d95cf8a99464fcecd007af7285b945f96334c029402bf7fc2e9400000007f2fec830bc8d493d52069ce159e8dc846ff73512dc77ff65d8fb37290c45fa97b0bd85ae28479e5a18a95c5023c11a008a76878ea44e1dedef0e2bf4195c440	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50aad647000adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1152	iexplore.exe
1152	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2800	1152	iexplore.exe	31
PID 1152 wrote to memory of 2800	1152	iexplore.exe	31
PID 1152 wrote to memory of 2800	1152	iexplore.exe	31
PID 1152 wrote to memory of 2800	1152	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e9d11985e55ebeca2e64f276c9f55172_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a9e61508f580438f5d4729657a82e1b

SHA1
818fedfa4509ba80ec2e8cd5a57f417751f96ab6

SHA256
06e2eace9ee772793e0ea2b6449d459ac40f962271b11023d6d979c0f43c9c03

SHA512
368091bb8cf7734c65ab123e40c233893940ed8c7d6e4b1eff0c5a5e4eb5735d73bbc5c16e589a52c3ffecfbd78836c44e4490e89b76c2f37888164c2069743b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2108b312f7320ef9c2ed395aeb7cbe7e

SHA1
f3e318124839fc8ce12692b17c9494126c5cf72c

SHA256
edbb8e1d13de1aab05eccebead469725b4acad686a8e2986f3c084512b42f0b8

SHA512
1875a6be64e8e123d8aaf7708bf7fb85cfbc0b0cdb5d9c43e1fa367652590ef6e370ffe508e3e86cae5d1a17b64bd9ab7f2bee659cafec6bebaafe1d615a317e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6148ed0e843203d7a279562edd4f70c

SHA1
1c1d544b7d3971409566f3e9ebe4ccd8322692f6

SHA256
9723069b1e03a0ed013b6f4cced5257b53ecb42dae55fd01933e3bccb26c7f3d

SHA512
c111c62936cff4895f1c85e572884eeba9767a6c3ed2893abbd02c6aa5ed661913db110a058c94d38a03a83f567924d24965fd0a494ba9305d9c534b760a72c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd92d8d78e90b88cab9b7cfa76500c51

SHA1
6ae92f1286555bbce974c78f3a9ddb7d2d3efdad

SHA256
a55c8ab11e6f4fbfee89eec5e7ed6d0dba825bcbb882dac603370fe6ababdcfc

SHA512
1de724de9fe8efb10d5ee64ad93d191cdaa280e8bbd00bd7cc21a38c46326f807eebd1b36abb0b93cee1e6e0b4a27dcbad7175e7b706f5d811b84356296fbfb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cca2cf8eeabab4e9c1843c043ebef0ed

SHA1
47cbbfe395466abeea45dcc026c894d1bab1b123

SHA256
5f1d1c709cac659c2ce38350be75be61cd4ea4f18b3efbbd0bfcfc91b2910f61

SHA512
0b19e6b61d887b3d97be881b3df0608664a74597e4351640972d981fae5582779279de296720a8b34fedebebddab34d3c334e4a05e6f085f7a55b97d031cd9d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e36ac3a5c467184ac6b68116b9c7a85f

SHA1
054c0922a99341cce1a734e1b8f65995aee6a28b

SHA256
4f9085f0ae1426a624b35a4c154cf0e41c94d4763aa88e14ccd972e316efe687

SHA512
6850ea14be85bf4c32047dd3b270d041bc272126486915cd1b2bd700249c02be7d57591cd3f11aea9906f32e5ec646667916f0c84c1f8ee40a51c50615b5a6ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9499864eb473d45a877f28bff6e5256

SHA1
8285d0a956900e01bf437a9f9bd6709f54c58bbd

SHA256
9ff2cf3de760a114ad3b8d266b5ac895d2eb9a3efe13b88d102539827de7e55a

SHA512
dfaea06bf5aea6cfd5b973eecdd151b049110cc0375124b70ac2057bcf851871e012b6026a0e789df297363b2537cd047b494db0d688bd24f0767edf00ee7785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc400144f0bab94aa5ad08059f97ff81

SHA1
374e6b19a5f5d1748ec2f4af430f6bbee50be96c

SHA256
e4b3d36c903b55335c8628cffd398efdd392ae66529f4e5fc00895c806aeb8bf

SHA512
88e22b1aea5830c00894dd3e7c30fa5fbc83e9bd09da135f766349d530684e7f64642e1643da5bd09297f1ebf5d3802f5cd45feeecd82b57951129d383c7047a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8be91979dbaa60ea264d7a93119daa2d

SHA1
2c0e5ea03882e96e9f9e109d67e0c6b656c6ecd4

SHA256
097bceeb3e307093fdaa08b3c5b23007ce6d5992fc6dcb038274240a889aaab7

SHA512
2f21080cecb067e9a79b171924d49fd4bf12eccc1d17f32cce9291b4039b76e036b7265eb63259931caefd44d55265968ef7dcd55aec5821de1941333bd82aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eb1cf368074ff2cc7f588cdc187c2f9

SHA1
e9018fd4d88cbbc50fe0db1146f174826420248f

SHA256
369485b58736436c1a373a2c1be91c2639a870589a8f52056bb9d597d511a22a

SHA512
fcfa27871abeb852225840f12ef3ae23de7fd719ff375c7b97741fae0f490f4b681f2226454998ef2af7c31ed40208ef8cc9f25b48e51d16a5761a69fdd75192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a4162d2fc94870b58f283e1b41b082d

SHA1
85132d18314a102a7cca82be260190ff988b5e7e

SHA256
9cd9b055519f46896baafde41b8f4c416819513b624afcf03bbc02bca8c08902

SHA512
c9cafa080d875e46a3c05e8b7915a2ef1fb8f7e22ebdfe1f2b8f524c81e9f20d89cb7fc06eb8318e52b183a603329595a12daabcf44d0cdad8af8c5d0b6f7c1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c35276f9831e64d5c0b12575373db5d

SHA1
3c7afb3a58c4cc7c681dae64dd6fdf3f798c29dd

SHA256
f7ead0cb4783ce4eeb04711c255dfce607b0cdb6f14598e72037bedbc4a5a13f

SHA512
0000cd6f4d9fcf7aa72528f6fc043a771c5f07aab8074943d8d92c855213a7c7e414af7f3f455a70cd953042182b8f3e1b56990166b7ce6a99c850c153cdb11e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe1df9ce0cf014702594aeb8217287b6

SHA1
835cea2bf6f3f53af18970eab56410a045774c7e

SHA256
77f376a23ac4d8638dec04a0900b1042e4f0eeaecd2d0969858354db6bd0d49d

SHA512
a2f8104595a29cabd22d4d818be636f1835fbbefffe79d9bf97c755d460c6c940269907fbbe14f39dea4238afd90826187edf178db303d262cfd1159b4e96713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a6e6459dd4d861fa8c32970f03fdca0

SHA1
458f6e332b1e5e7502b6b721ec0b72f47bf58031

SHA256
7abe128bf3322276dd24be11f98a346d2a65f758731b06c75d0a78259f0ddcd0

SHA512
24cc52bd590f58b95148cce06e2d4c3f9f0e3503e1ee2e8c15cc12a07e7286694e25fe85efda45cddb3bff6971243422e9862b016b7597ce71de2db6ebd7316d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
303d7605e781847eb570c1e35cbbcbff

SHA1
2a54f61486274c1036248c4008119809e27a265b

SHA256
d10ec96c06699ec3df95fdfc4797cd3a10b6dda9e19f5f22a47913a33e496edc

SHA512
2c6422c5f25cba3bb943b026a1dc3bb056c92b310ed2dbbf6ec2a382d941e368ccd24a55cfc16f8c0723ce707cca7f68ccc6a8a3f97fb5bc1127ec9730033f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
264a5946af4cbe1af5d7e00afcdc4f72

SHA1
4b97e8eb8e7ebffd390c13b9bbc58be21f0d0caf

SHA256
85904d52a4c68598de248695af70fb3813f7c3c6cec48f96c8f1dc1697583183

SHA512
0afabd0fb48e1f1a9c6a601beea533fbfe7eadde5e9d6c4e4227a09ca5ae0ecb28f389cadd1b030d37a23bf1675c78440c809894e6a8ad8354672232cbb42c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFFC5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar36.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit