ad5d7a19392c344fb383e868cb0ab026e5ad24b25b89db69c90c9e145d04f3d6

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef0554a601b5fc4c881be137cd5684fc_JaffaCakes118.html
Size

10KB
MD5

ef0554a601b5fc4c881be137cd5684fc
SHA1

143ccb9644c318bccf867951dc5ce24669b11c9a
SHA256

ad5d7a19392c344fb383e868cb0ab026e5ad24b25b89db69c90c9e145d04f3d6
SHA512

20303d0e27ad1b687f4f7fe057385c44388d23555f8251df5a3f359c33c1e9cfa795e83f589755a7d4bf028ea77f887a977d88f1d5389aaab31de63225a64d15
SSDEEP

192:rij97Pal7vFZ7v89lgDna7epHZgekXY4Oy9eEDMUvbF9xk6fxz1:mRPMfU9eDa7WgekXY4ziEbFk6pJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000acc67fe7be1760b720baf93275cf3510f106484aba948ea1752cf381a8d4363a000000000e800000000200002000000083b1df60bc64f655b171afcd917af86d3968980e8319d0efcd28948e7ab7401490000000d7978994651de592be4a21060c413db40a2f2e04a83219910e3feb76e6df8f40b70827c90ba6a84bffe9b3cb82209132e86eb5299589af2d9bff5968324c38deffdd952fbcff2a605a9c57735d27b750563a7653a5630f5d50703039e292ae001d57a9d42a4e21311941bcf655c41cde83ddcc99d778d97ae461fb322f347d32f08def35d19c1d386de7c8b9ceb5160b40000000155f28d86efc9bb4459f2f19c6ff2421b34706d7d282697b889cfec8f7da734ea7a5e99f9d2424abc9f9aba3603cb75ac0874c74e05a333a7e4a7bfa75cb48d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{160005E1-77CD-11EF-98A3-428A07572FD0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000c4dea3b151597ad2451ea77706606ba5d79ebfa39547b552749e958e082e4d3b000000000e80000000020000200000004423c5a7787220b8ff1fee568c29fcc5eaca0711ec8eb5583ac35bbdbc3dabcb2000000020b93159e9991d00d0edd5309bc75fa684c32694014b62f2c44dc1e4e5805b3140000000a073a6b9ca2cae713d41fd565c1549ab71a88d9303746a0aa0a324b8ff02d12be7dd23c93df1e7148005c029be4aad858bbd458898582a2cb5e645796d323f16	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bfedead90bdb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433052687"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
812	IEXPLORE.EXE
812	IEXPLORE.EXE
812	IEXPLORE.EXE
812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 812	1936	iexplore.exe	29
PID 1936 wrote to memory of 812	1936	iexplore.exe	29
PID 1936 wrote to memory of 812	1936	iexplore.exe	29
PID 1936 wrote to memory of 812	1936	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ef0554a601b5fc4c881be137cd5684fc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51521a1b937ea53d16a302f5626d5a95

SHA1
f38f97adeb11bfef8361de9823af90baa7918549

SHA256
4d92964d6c6f6c966cf3cbf89499a334f1bd5c150871ef3c33bf20af2f9fa022

SHA512
f9579c71534fef3164438199625ba2e336a659508569a01c649d1cc907506570c5e1abaaead3ac26badab3c3851b847395908dbcbeffc21f6a35c1ee1d59884a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a80600ba31ce76b04e9d0143a2acc4f

SHA1
2d69058d30e1a81a93729cfedc30aacd79e2258d

SHA256
e633072bfcf276204c8dfb42a34457e4907de762e3e53809dfd1026feb813d62

SHA512
720b0cff51b98f3d2a13313ac80cae83c0879b881f26b114694e6b9ee5343c43d513d1eb01734f3e7e3a1da8f4d2c17606591a4414e8fd038be35b93bd1b1c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21b7e53b7671ae05e764230c374d1c84

SHA1
729236c89d37fce67f2c127e7c3387a2d132fb5c

SHA256
04e8f267c17d8e22e37a44440c108504046fa4f0d8c2fd1db8e96b4eacb292dc

SHA512
ac5a530a9c9895e2cf65c30d0e30159cffb0088c682b0a5e0f863fce154247faa774baf48f5087821487e13c35724e704ade534a910e8f1acec17ab93c62ce63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7f5a8560807335a04f521788248617e

SHA1
9fecc3106876e06a65a7c41d4817d78088b7da04

SHA256
1d4f5082d6c45539eba66b8a9bcb09411af70ed7d9a263a7c5198e8cfea0569b

SHA512
1b7498890c389883616dcb389ab838f25f486fafa5a6394491649c73590069e3a4229ddca295ca0eb479bda662b33210e6d79ecf56d52d37061cba2eb03b0f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
032405c6f47ab15eff7dcdab4206c606

SHA1
36f640dc4fd42f6644b31266b8674b1e94f31796

SHA256
e73dd2ddb6fb0542e6a923efc53ab6662955360c68705cd9fa98236101ed190e

SHA512
5ba182615dc6064d1f46bb5899d5fb631ff9c501222de0af4ea67d5e1e26cec8c9d2152b1610dad64edb283b9e038dd2f77d2abf81c97e85cb7c46908dccfb07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d26b85bbe99635e45c0ab602b944c81

SHA1
9511ed308314694a6aa0c6bcc9ee4192c71e0f67

SHA256
dfc5e3cbcea36a3277ceadd56d8f19f9689283e1797cb15e7a8325bc2a5f340f

SHA512
dc74ca450b3625d258d10ce0bb1c1e05bad7388c9e198a2cff8ad5b30f1525a5bdf8871e5e2115aaf70dcb17175de245017075b2d012f43a112f1812e0e53cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6174ca8ce8aaa920ff93a9b529d4f9b

SHA1
cfad1856d8c0eb2a2c66ff8c7c3d1aeca8ed0a26

SHA256
381e94fcbf8f863d0a020bb45f5c3ab488e79d7cf4f92e08b76af4bb3d85e7e7

SHA512
7565b35be8fe8bbcb4630805f0c6eccfca2a88d6c6ec003b5b12e8f89ff1dbc10f4de20b022b5357a1de0909461307b818941156633661ec0d48bc05a19b66b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
229ae5dd857daab02dee2a4c6cc4edef

SHA1
f82ecb6ddda2d0273025b0fd38fdf2fad26612db

SHA256
8c643dc06a3794bd0f9906f5809417ef95b8d9037bc36dbab376c521fb97de13

SHA512
c8746027cab158e4f20b548e0a831e9ac377b5bac085b235e2e0e0c710fbd9aa4e6736708bbc52381706f7224267cd04ef00cefc7d5f054c14d92982c60e184f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93463a318bb1e3aca2eab540663f1731

SHA1
a61262cbaf6b58045ffd164e61aa06680442ba15

SHA256
3664917dc999b76b70e373ed15ce8cebf030de6c9ecc9852446e54f5d51228eb

SHA512
c7458a86ab324f5e7d6f8e922a0235878f0ac2d1601eac0d539fb2ed9e5d8f2978a47b62f8b9b53764b1b42e1245543a2653ae56523300f4fe958f41e3e3f8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e90247f8f8f7e0ebf38db225d6cb4559

SHA1
e3ce18b9fbe6a4ae35905d99ac52e34448e925b4

SHA256
7e88a517a38d4c718bb3ef905e5c84d073037cbe7d4b487eef643c5eff53e9f6

SHA512
9029d3c5aa24420150c5eecc07a466f869cf904ab5fecfc294e37fe0116f77e4ef5d0a0faba629f0f5370eb1c55da4ea0c0614f50b7c906268fa466c442160bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac5e22dd9ca6cf3e8a7cf2ca04faf993

SHA1
24397b7427cc31d3a493a6c8fdc5cd58e0049512

SHA256
6d47acac560c9cd409889929f06c64fd9ed71a3cac57b0e812917da6e6067fce

SHA512
93bb0c775f6fcd8db42475b0d0e615c9fa8f6688e52605b35eb119bc686b793785098824d856b8027f9ae988f9ccd6db1c5892a719140a5a266e0004cbfbf888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
696599c852d0d3ebf5af86fd687793d8

SHA1
1bc6f8b67b7031d9e56bca80c44128f16c7dfbf7

SHA256
ef1a34c407a607dd8e958f71219641da92e0e47a3694d515f0f2015eba2accce

SHA512
885041ada60385d79917fbef281003636d2d108c8b1abbc2f151b24a18082dcac960747905c6a1e9575acd97a19102283ff73ba376bf4a6dbd686501634afcd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b4f6b153d2100986109b9003bba647d

SHA1
26ac39fdd38bee8e8e234983b704604a60f0a860

SHA256
ec564dd37b5a38df83d2b14f64151282712f27f509a8ac861a7f61b554fac98b

SHA512
254ec669d3f72d9991e50dad1e47c9ff584b6dd1fc78aa527c651162ea99c31c74a058a814ff93d9a7dc8af117049ade650c833de939f17b0363c0ebccd31ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de185e9d23f05c8b0ad4eb448343d364

SHA1
a5c33496dd8fb52b1af28d681ce12d8ff43bb9e6

SHA256
90c471203d651b35e658e122dde7c585a052fa3b4fbe50d39f05e07824d5df79

SHA512
4d73936e19eba70f2a3b36c7b786294b3920eb0829995849c9d02be044b41e0ab0d6dee8dfd6c05945c94d94a0c5cdb9577399b1a75c4ad36fbdc8cff41a91d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8614.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A7A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit