1672a16468cda8f7fd871f855da906e7e85f68bbc4ae466d06eb684c1581a84b

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ef6aed343df99261d73f986515164d55_JaffaCakes118.html
Size

57KB
MD5

ef6aed343df99261d73f986515164d55
SHA1

acb02b88834a78283d5f25a8a615decb68bb5665
SHA256

1672a16468cda8f7fd871f855da906e7e85f68bbc4ae466d06eb684c1581a84b
SHA512

16785448a2c1b894d710dacc877bc03f7f4bfd94c433e6644317b7c2b504551f6c9c18551d099cd68b984890cb6b1fa7487d494fbfc8cb77ea019c45c0199432
SSDEEP

1536:gQZBCCOdl0IxCyfIRjfsfAfef3f0fmfqf5fMfJfkfefHfBf1fOf7flfSfxfLfuf0:gk2r0IxYUom/8+CR0B8WfJNWDtqJzWu/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433069455"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a7890c010cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EBB6591-77F4-11EF-A641-FE6EB537C9A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000066090b82809e2ca25c9f4315774f73442c97168dce913fbd873973f298d9c91d000000000e800000000200002000000053a09ec37d664a3f3f802ca83c0ae495db53446abb3fb1609d7a4ca034b56aab2000000026e1b933dd8d580162802dc3921d77045a4649717ed5e4e070516603b0b508c240000000218ae6e7323a5c199beafd6203e0b13bc28993260161c8526d16e58409b8012127949586d1b6b52e1d15e59f52c56bdafa1f6a1616e380abd8035cf801b5f9ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000001067f994d65bcea24334d02f1ff5722af95169e9a88f6e26b54c1d9ed5414f9b000000000e8000000002000020000000914f2ebb386660c0a207736bbc660cce3c1f4fa8b0622d8f810754e4a7a4d54b90000000511e5c781d27f6503e81501001c0c1fd467456125c2c58bd1767fc5dda8ef43ccaa56fb9572707b916618869b61ea0145181e2b568c710cc832d404ecde8a2381bd63f428be70eff3402f535bfb1b938021f2fdf5ae681c68ddda90a7f7d31f042cd5e91610fbe7c008ceca9a870b44a152c4d6f59b01f7657ac67f961bf7567e444a72aa9aa72fa42f6dbcfcbca094d40000000345a6b409c7037515799fde85032df598b74e91ca4110201db4f3f3462096d35d74e51391ad7084e5edb735b3a7fb3dc3af76706ab648822a8fb319df333109b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE
1708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1708	2176	iexplore.exe	30
PID 2176 wrote to memory of 1708	2176	iexplore.exe	30
PID 2176 wrote to memory of 1708	2176	iexplore.exe	30
PID 2176 wrote to memory of 1708	2176	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ef6aed343df99261d73f986515164d55_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a86913e99fe3ae67a6082bf1cc4af721

SHA1
5cec4b35d0f46d62094026ec5d8ad048e4acd73d

SHA256
0d9caf266cdaa08068bd37a00598625ba05aac5c3211e78eb7e7477550ec6523

SHA512
8bb39b779e4ccc1e334eb8da3147a835a7ccb4721d0f8f344b5f4c241e57a92bd388b389e8c131d3e343de867ba1a82954761b233710f6f5c3d8fee39455adb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69ec9e7b5a96e1f689838bbf44626f01

SHA1
e3e45405a53aeea764b548462432e9e387fed459

SHA256
1ee7250a57ca82cdc23c97389a022db2290183a5bb76a3d478260ff32caae64b

SHA512
a55e64e7f496baf41c5a27428e1a0d0d36606b20eb2cc1d01a43116b5e6d89a9f3385709890f5272172db04549cc89dea1f9cee93b63593bc857f214f6a7c9bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a031e49ea16bea982f9c094bdd420016

SHA1
3f9d23c3105b3e7352225fed27a787d2cb8bf32f

SHA256
3851fdfc02a9a5282e47de7a8f44fd5a8da58b2de9f5d1e7d18baa9918f327de

SHA512
81677e96b024bf89659306372a4f0077b9eddc20bd67383043f72ef1cb9b81aea1940b53766ee93b6ab4173b0e84ca8d3ff88248a8fe20378b408605ea4934d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33f6050f14fbd6258bf23f755928a722

SHA1
e08052cbbd32f0d84365d72bce5ac263a4ebad37

SHA256
ebd7f11bab91e17c9bc155d9e2e26acad463a0aa3d7dcbd6c210cfbdf07522d8

SHA512
a593e15418bd9f8ea6a8e228da5ce31f7d3803bc5c520967eb6e1b42fe6a515a819ad7e2a991931319394751f64c0aa4673f605721b33481422947c7c6c0105a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ae54ab56cd5a18c3ce7e63ea987f4b6

SHA1
1668d626332d570f66d0974274bf8023d2dcd31a

SHA256
946ef7581c190e50e47c88af53236bf3d67afc9a1c2f160959fd40d8545bbf96

SHA512
c48c59a1a1f671433e6cb470503f1dc0f4ed37ccf7069955e69a312da3aae5acc7de6520e2a3ed90efb10f8ecfcdb7f564aa08b767f44db717834502928a24ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67ab12a7ae51b3ed4e5d9487a04421ac

SHA1
76930df684672e6875423baca999d77f891d335b

SHA256
32d0dbaecb6c97b5814bc3308f26c7d500744036ff37dc31b29c2729545f6e2d

SHA512
98f6a4f0a1c5f3bf590ed37897de36e35a3b0a95c815976977922fe45105eb074be56d43c796a2a1cec502b385cf82a6d7a689b8bb461eff5b003f415848df44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a524b78361975692f0a122ca3d14f2f0

SHA1
ddb0af68be33c3c7d607086bf0969b55d5ddb175

SHA256
a31a8825a208944a3e7053e550ed9e2355d91f53a900e4242e65ff44cf140147

SHA512
3235d144c978be3f45dbf90004bf06fd8eaa796fe63131374bbfddef53c977b11ad4d39edfe42c0b73ee5e977f93d851fa4d0abaca07f40519243ec224feaec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194bf026903dbbbeb1ead8e3ff86e47d

SHA1
c875b00c0508343f5c50b4c1056af04f97ceeb22

SHA256
cb407ebfd56fa585431b5fc7d6d9cbf7e11862959360e838f630efe7c942b0c0

SHA512
70c3b77cfe97cf1fbd7d0e34da01724d4d4efaeab38210a2baa8b02e519b94d63064727a430b87f61ca9839e58a74060ee95b18ca41b40eac043a9da49e7a4c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4728947f7d742d77d4248e8f1e5e683

SHA1
e1fbbb312384c6edb82b517752a825a2cf579d2a

SHA256
d09e954b212af18ddf8f87782b0660d8c5edc61a6cc77f9f0fbc91c95f7f1bd7

SHA512
f350b73615a3dcd089f44e6f45366e8a35a1f8c8bf55fb404585d47c4eeb604672c2c53e8a79fca23abe747d4a25319bdc300d2b06f3a07b965ea61d787e2e22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
001c79a5f1865e2cb8a13fcb5a941948

SHA1
ca096a3c270661b0d04fec108d58dbd0f742440b

SHA256
4f580dafdded2e19dda62407ca6601254315a8154935f8987d24a425b560fd00

SHA512
3273fbdef6a901ddd70ad1b286d91a013577afee6308827572299511e4f847af73e5687fd608f3e686c8238fa6c7e5d4828a436dabd4d16f9ad131a619179a81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4829b8fd1b169b7b8d3b712c032e8eff

SHA1
9eaccfcc482df61bf7746a8ffa2faeb6f6ad6373

SHA256
0253a5fb804559123a9ed53d29007cbd00cd26670108473ad42676d0c82aad83

SHA512
983d2c6cec40ccc1db26da8a34816083e7cca3a26682e99e6dd46215ddc1b1108d78811b92f2bbcdce12adc3c31c83adc9f55eae8915429602d08a64edf78e7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47ebc08ffa2747f8f31ff165b4f0f49d

SHA1
61261024fb935b799a7f0f27ce4cd1e437a1c5e6

SHA256
5111ab987fdaa0fae0c4080f90d8dff9d4c61af0091ea123b197bfbdb39b5fcb

SHA512
018cd1635c0f84f607429b68f2b2877c85616d913f6b61ce3222df38610d60456a69d9a33bce94adf47d7a9d90445409ad71d98f3070b7608c4ec6cc486ac7e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b0b2ded5a4b7390ed22062be70c6381

SHA1
6a169ae130233d3cf1130415590824b8a7b21bcf

SHA256
dbe10e682777e22684e1dd241706027e0fed6973070fc4ee11855595c2df20c4

SHA512
ab25ef1181df8492074142ed9219dde89e52b8a2f24d842e006cfffa162a65cf976f33a5495879c7928203ec26cbf8573059f376489a51739a3b6df288f47ee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebf7f7412c78bc35e4d09eb4bcbba03b

SHA1
4b4d4b3f170ce2a7e1e7e699851eebfa4389c7f9

SHA256
85beb8ca16a9bf0854450b00db57bdb735b772f7206de9200290d7257732efd8

SHA512
ce6d770605b76be73b474afeb5dfe5e16abd8f2eb8a95e37b20f8405b5cda87369505605daa0c3c3e45472feffdbd579adc6bfc1675109f5b8e1b4ca29bd03a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab740A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar740B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit