96d4728bc9fc995a4e8343971dc7f4ad31af72c2260f7045a176fc39b85fb675

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9fce1c40e85c42aed10f96147e04f77_JaffaCakes118.html
Size

460KB
MD5

e9fce1c40e85c42aed10f96147e04f77
SHA1

8f177969a0d7d9bdc9ea7374e27da0fb9abcfab0
SHA256

96d4728bc9fc995a4e8343971dc7f4ad31af72c2260f7045a176fc39b85fb675
SHA512

3f4725aeaf0650726da13e751982f5a9e1e798fdcc4ec5d654bb9e8142dd0c16b9b337909f10d7a3e2b5d8954f81f7a84acc01ed13c52ef89e00e0fc1749e78c
SSDEEP

6144:SYsMYod+X3oI+YdsMYod+X3oI+YRsMYod+X3oI+YLsMYod+X3oI+YQ:55d+X3T5d+X3b5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000270127b32ecbd0bdff6ef6352491b6567cce9d77454a1cc2aa54e9136f4ba516000000000e8000000002000020000000ca0a67299663a899c92ecf62af3e788438f25f80b541d2221d9cd23bc2cfde9b9000000051feb77c684dfcf13a2e0b8cdad970ee0d0cc2db70b0a60aefa8f4aa97596a893f699744aa7ea74c22ede53c9dbdc9cb6c364bae65d798bada083b4498c94d6ccddb91f162a80d13b9ee4aa94dd70e05367fcc1d875dc716878792d6eb795a6833453b10edaab5b085f9078044f83df831a427b282b15d5ecfa1f44111453236ff65fa7c00de9987ccd03e459763643240000000b67c4fe10c6eaa27e19728d35d12793a5877691b4ec1b5902153c662d2e4dd8076c4b6c4b2e5a5976ce5ba09d0bd2633699571459f1203bac58613918f8d815e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432856117"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000007a0809b3d3bc5d43547cfa069ec0e18504235a7fdbcce5167c713a07056c2b94000000000e80000000020000200000009326919a165c0565e4a625e77ff3c600069470acd026567cff276c9d5decc34120000000897ea223b3797994c4e08ad0f35a91c5c70be502fb972886799a0861f9de5762400000009fbde446273eee260fdeb73abf0dc570a6c5b54ebfb5a32b70a4d7666aba3dd4d30ea31e1854bd4ec4430d563a8c4e6bfa6f91d5d21326701c6ad7519c313bfa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b6d443100adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69C0DF91-7603-11EF-99F4-E699F793024F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2280	1680	iexplore.exe	31
PID 1680 wrote to memory of 2280	1680	iexplore.exe	31
PID 1680 wrote to memory of 2280	1680	iexplore.exe	31
PID 1680 wrote to memory of 2280	1680	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e9fce1c40e85c42aed10f96147e04f77_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4e6af67d10b1bef4ed776640fd6b8b5

SHA1
35418eab9694b7c784068ad38f0715d096e5f36e

SHA256
237ee38eb15939d2cc547f1c001ea7ebf5962151c0c183dab84045b2ed4a4424

SHA512
61a7054577f3e91f153f197053d60e4d8418221ecfbb449393c2303887b178e5ed0ca15863ec4de666ecaa0fcebf0739fa84943bfb68c9fe7c44589be5e57622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d06b2d56ec445f9e7fba93282e3e6d5

SHA1
24168fdb5821a18f1f12388bf7bc32fed5a05918

SHA256
4dba08c0a613e2b12d6b9c351c35fc1e4299f51cf5510e8cf409593a9ecaef3a

SHA512
bdc3092f128f107c9867b04e91436d31935460b2c9a705a3d50629d5c0957092235049d8a6469fcc25941b9683c43ff2c01340cfaf05249e596f88f8bc721270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3a71c340cbb923a5dc3302cd7c78c52

SHA1
c3b36bd302d930aee4cb6bc64c77bff1eccc9d5c

SHA256
5b83a418d2b3a4b7dcf1a75dfd2f226703e4e12b430f982de6c230d952414d94

SHA512
e27ff3dfbde7911f0cfc799e795734c75f54342bc529f24dbe1ee063fe3b8357936aa4580a18ebe65b117faa2da70dc08791841f7b05a5caa1a910b01cb26bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e5d59e08f3cdd86196cbd013ab3c10c

SHA1
59dc65e6c07ee628d1381e3c1c2835070ee1282d

SHA256
8fc2aa9504089eebad5cf9f9f443391ad148724b899a9c06f4a83ff5ff69d3b8

SHA512
78e45417af80f566d68e6a1eb1cfda3d4945f340347349af7c3600464cac950fc0f13affed4f237935ae7df4e3674056f0b4fc7813d192571675b3455497b375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af4550d47e8424bd229570bcef376bed

SHA1
777c3578bc4f6da1aad8a4940659612c17a1a03a

SHA256
8f0d78ec25cf653a815a0e98702eb414e6233481b67561e3a437b52c64291d61

SHA512
c1f53aa5c612d12cbb67dc79f435b9ccde67f7c4a211685e23fcd51e399fca989d84dedbff5da33a831429b6396b300f19c68b81b8fa786e409e452850b54adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05a6888e7d9ffb87cabedd8c1a27f12d

SHA1
7dea37be2dc2404d98b8b25d137881c5298c1033

SHA256
d01ad98db89628e0528e6330054c63baadc2d02ccc112c448344d838fba016ca

SHA512
b9a9567d0ce69dcffd69f7f19f69bb594b45c304bee5c62df1df970abb85d423cf7d39f328f3b57d131c3351527b6c4eacf765efcd5a48ab5a07338cae6ca6e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b26206ac4f9bc6b09535bc116913a50e

SHA1
4113e554df0312c71d8c7897a1294dc6ed117242

SHA256
cb0e698d53b44850df83633e19adde7de1b1fb322bad761399e16c031dd5b087

SHA512
1cec3a89459349b113502a9c82014f96aca3c03415d25b7731dc0db95d60ee893551265a97bc5029452d9e3afe1f046092404c0ec8b120c075601e87b35aae89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d09fa23be7aec8b755774e3e2859f279

SHA1
0426e2f0512173697a82f1060c4b4a57ee6337fc

SHA256
b6d22512e37994281020afb28ef423d870935516d333aa3445e0c5067c408e8d

SHA512
eb68347e378bb256ee8fc8a1d723b74aa2f0e46aacd8597b7e0b784493603d762013cf6c204448e1f4f877e59cc96a133b6bbdea3b587e7dfd6ceb9e0cf3a7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53b471a4d6e7ea0de03eb2eeaedc6136

SHA1
a12402b6d84e03c92bbea6a67917eef7cca2b576

SHA256
5913414df3cfc53ff05e8b6869bc7dae860c6e03e37911a7a1dfcd99693b9312

SHA512
69cda914d80eb181c24fb57b5f1a8e40bdba2f975a902bda659a663800c739ee7e1a55ae5600c23dbbc34b47242bc44e5a7b502859645b22b59384400c6570cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eadb21d3998eb19e07b7f11a8078ef1

SHA1
ffbb50bf22dd7c715cc21f2ab1ae460ab2d31dbe

SHA256
c6493ea1f576702ed9914ce5bf4805c63e5b9b0ad1edbc251b829fc599b38a0b

SHA512
be0b929fd4627547b6b0c54c6b9b57a7c5a858717cbbb094f4e2eb2c596692111751ab159ffbdcc9a10e156050713e255430a7e862a407aca9047c552a09fbc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22da3a184178181b771422c548a7bbd7

SHA1
627ec791703eddc7f3636d0d4508da62b2994d71

SHA256
2287d0e9ce53f7908cc5ee96ce5afbc6f078cabfad990e09e5a7728774a427db

SHA512
3923a74e67c1687f4c7e5fbe154a2b5131ee220e04ce67bcbf2550d450d55c75d7c775f33c22b740895d68e8ceffd9fe8380e0bebe8fce1bf8196be213173b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1539e1ce9e4536d913b793ff32821c2

SHA1
36dc6ee0764c43035bc5f52ae307e033d7a9584d

SHA256
746bf9c6f4105fcd1ca299223c23c9435c2d9f1161efaa27c43766baf0383563

SHA512
1b1f52dafc877eede6b2207e38701feb59e459ddad7ec05409f7235baa7ef1c79d456b406f6a5d62b8d7bee0f5be969caa6217daf2826a418976dbfd99100a97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f4c933c806c9294eb384e3ad27bc420

SHA1
0fcf94eb41b22bfcf552e34bb94c44924d24b6ce

SHA256
59f9f70906f9ec85c02f83357c948550e1fe1f2478347e9aacd83b923c3a7f0e

SHA512
0d6cb08d83d025945aa0c629989dfefcd9f67568319059bb9086d82b0dd4c4153f2e993d7695369fb6744c8eeba8836de7d816cb8e6ead83fe1e1ea9ae8a1413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a40d09c0cf52eaaddc575bdb664eedc8

SHA1
bb6a8c2a04f30227ea24b999b6049f1a1f5151fc

SHA256
7470f7a2d32dc5a37fa6a92caa4505a15461c80d128e907c696a93f715a11ddf

SHA512
f4c7e98c6d9653a18b0740c1e167446318ccd5a6ad693becdcdab088483005ec633d26fd56051e08540ff21deba6eeb862045265d1db417e858920e8c5cc8a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab120B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar128D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit