906eb62498fd6f57adc73ed01d444354864c4516036c608d99df7abbcc20add0

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 09:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef819a420edf2435bb4db7d70b23dc3f_JaffaCakes118.html
Size

19KB
MD5

ef819a420edf2435bb4db7d70b23dc3f
SHA1

7c23693aeed32f4de43fc8b0d3fc29e2233719ed
SHA256

906eb62498fd6f57adc73ed01d444354864c4516036c608d99df7abbcc20add0
SHA512

2c7a29f1bfb8d965172ea3101ca98a790438b281e0e052b34568e432fa0ea1a80c21ec202804e26d1af4a7ec1102483cc8e0c82f15c17cf9deaadfb94e73d73d
SSDEEP

384:Dt4o+aSpW9RMwqYxRRGLHmA1HA5YUa5eJVP15CEvcWfyzaVGt8SlWh3quZK:D3MgRMH9g5YH5eJVN5CEvcWqztWh3quE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433072941"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DB48781-77FC-11EF-AA6E-5A85C185DB3E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000f306d7e5ba0cdba81796218ab382e43df9e9c8e35c56c4a42c37ff60d212c1a3000000000e800000000200002000000084c1d78695632da888ffc29af385be9012ce0bb0cfcfc5231811fef58798f4379000000077a5898cd16cb2ee561f7d4c2b2a341eba9fd01d5db169a5f565eb36a3c493f8a2625ea411b0bacec847b5fad1dcb9097fff317cd9a20caf012b9ebf0fa362a48d37ee81711d5c6f8b469c603b07a729211eb90d7b8edb255d896a93e35e1877d4fb973404b6c33b40c81d4b10d266e1589576b24363f345dc9740e8e710f3f917b86a091d9386e0da8d062ac9d2cb5d400000008ba974619fbbe2e5bfbd0a40c80c4bcb2f00453ae2f8fd2ace98aea03a619bb9508ec5cf27705ac6aae4e9d3af8fcdeabe3fc658f070ab68f82c8ef749fa2f38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000e21acb6088a2047b7aff8430c117ec0901a3145fa34dbab5ae2749f4cc7affb1000000000e80000000020000200000004199ec44054d8b7ce04c0aa8e845705188ee4962a2f99c6aad6fbc397cefd77d20000000931b428399992ba5b2e0ab357739ed56b987d5b956417fe82fa761f3f026f988400000007ed891ab4ac8345de19993273b54fdbebd13639471326acc6c3b141e9d6980df36027712b9a42798bdacb7e35919dbe527c97d633beed5d91937201b7738e85c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ab6a16090cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2528	2160	iexplore.exe	30
PID 2160 wrote to memory of 2528	2160	iexplore.exe	30
PID 2160 wrote to memory of 2528	2160	iexplore.exe	30
PID 2160 wrote to memory of 2528	2160	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ef819a420edf2435bb4db7d70b23dc3f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d556ac1bcbb96b19e16bc59a5fbba7c7

SHA1
970a1bbbb13a277d5926658f6259cfb1db532be6

SHA256
ee7966c7101d464b3dc75062358a423210d037eb0122934b83964bcd6ebdc461

SHA512
c8faf253d5da086881b70059c9e12819ab9d8413e62568de0a1554fc3ef1fed4c701e4ca60e9995c558551b35cab7ade9df81c8ffc89af1bbdde2126f905de2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fe950b913afa962eaed045987d3da9c

SHA1
b8b63626d3c35b352174002031e96acac9878f7e

SHA256
d0b1790906125e64fb6eba8d25c0b0f820bf1fbb43df7a5a3419e67539bcf600

SHA512
461b8ebd4c6d3294c1168fc4949d622e56d7687d3271c5e921907fcbd57fea76afd5c8671e8e8f89a500c9b48da55ae4f23430be46fc7ce86212bafa1026ca94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
161fc3cb9eefbd775392996e1eaebd3a

SHA1
3259276bc1787abccc1a10f35fed79cd12c00ac4

SHA256
a3e72a8866bc2abeb2e29dc207507d439b64aeb8852bc9634c6802e420dce950

SHA512
7dd705493fd5d7a9d8cd32257afc1cfb7522915871b40df58caf191fd1638a848bb18a89485250bee1ab26750a8e88ec8d72a5beda085739c291b2c0f013fe6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f52f5acb24b538eb64786f7efebe056c

SHA1
6fab9af50446f36ab1f90c06705d0006f059b245

SHA256
ad7f02a351a7b63a2909d41b501feae2f66bbaeca6f383009dcb79f18e9c45d7

SHA512
97871fb157bb7027b40ad537cf415ae1934f8e8f45a44d537f52f26816b0fa186dc6cd4ed4198f4c0698530f91a0a37053a3bc0e0bc1c7bf5118caec0bf70c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d5601da7cb5b32af35311ba62b73c9e

SHA1
ab69a8f06a2ce66a123cd5e316da26fb835d4862

SHA256
d7858b6b3e412dc9c6ebeaf6645e962586387ba16ac6783f128c5e21c7dfbf3c

SHA512
6e0dd049a1e797e701a30e2c76ab587c4f954f2289e2c9ba6e3915d7a1f64ae34d7836c3e297414f90dcd9272875655a1bcfae6e2909652f0eaf22482e12ebc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8be2cc388a0cc779189eb48b40cf32ad

SHA1
0fdde5663adc1923d674e016b4c58bff7925b685

SHA256
8898e1d3b15378a0e9dbebb685189e1396c896b0d83c30b56745b5c03c2e46aa

SHA512
616c6201b51bfcd240f8ae58232f1484876233b65e0cd6f3da15c39be3d217027fcbe77e7ff44647245a1b43c0b75b2f8971db5af867331c5296c467223107e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c49515627f1d5cf278621be897bcd939

SHA1
cac72e31ed8a1c42ab77cee50750753786257cd9

SHA256
f1d8dc95d3162ccee30258125ce82675a6fbb4e58adc9def6437287a0e9602c6

SHA512
bb99892005578a11b4cc4a52aba14de7bc7b1e991babd62f721c8cf503bda46a6beecb5a9d6a6fa75d8fdb9ce7f0479a9af84e910f210405221caee4a999d4d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2fbf6b70b80cada7a1fade77ea5bd79

SHA1
59e506bf4b2245a656c660330e37a4c370cb8484

SHA256
e2d12b5d3c9e73850fc149552cec4fcfe840d4115b94ed6b060e28f271654485

SHA512
58c1818b6de7242728317a2185c2f2d410fb2a748c1506d1fda9112a711a7e9e6c78eacb3c8a40b407a4ac431c84555549f8cebc35b3c55b7938c7b7100db569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
497686925d0b3ac7d8753f588e2a2c2f

SHA1
8d71790fee52637a8a01e29be115c60a8e75f8da

SHA256
46ff91af45d4e8b128a3d0f3f67de4025dde8da9bea8d8726f7d8e1a0780a2f2

SHA512
f4c2daf19664ce34394fef83d73716259bc3c9dbbb58c42ddff40e49dacbde6788c8174b6bf1f17b8c5e0b49b94ec3118616bea118149c80a658bc309be9a0f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6456e2fc48af0fff4cebe906726d02ae

SHA1
0475dc34542938f9e53875559c18e0a7b76e990e

SHA256
9092f6db9c2268bf2559a85d8ae3feb759cbee33dccab38b153f4769bb22ea86

SHA512
55d2047bd73e38f10bebaf88e99413fba888852638e86ae16f59b0a92071074fb661fbee844c70cc49809f27e5c7e8070eab55ec5ef7bb22a7c55b8d6718aa15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bd1c5c2c60bee5598ffcfe6eb55c2bd

SHA1
6779868a575901bd58d91e3b34654c65d1c62b70

SHA256
1a697defdf9edd42f77bc0983cf4b0af90d795c4695b1b22eac661d19f551cdf

SHA512
6e578fca5c02afc37b76c34ead44df3c64327cdc2a8112b48d987db0359fc2b8f7b15ddfa75b6650b3c6ef758b06e513121bfdc2ba1b6c84e41fac8df4f8bcde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96d0275a3b56443bdf1b2d5d0da6eb20

SHA1
e933a28a558393dbc59fe13a79f0337b685468e5

SHA256
b8f5b141b6ddcd4c840a5017b371f5ee99bccfc02e1ad9f5a9a9b5de3a4e4abf

SHA512
0de2fb9ac692fd869a27b14e91ac23975c1130d65b4d3ced12c0394971fb631efec16dabe544eb442e6699988e857aaaf39af2a536648d26d08ef773a953829b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49f9a992f44b0b29596155679d65f31a

SHA1
78fb5f28e10aabaa0345878ffec0dce2d6dda89b

SHA256
2dd812517347b8c3a079c33c7d826306e0bcb1cf943686845fa1258f6ca36adc

SHA512
cd36c83e4ccee19e11e82a38f517b7d52a11d42ebbff56c264a93457f6ab5fc583581d7e2b2a0633b1c2e830bad27c48245de17583f32f1188845db403fd1c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89394d490fac97c196d02cdaca1b8405

SHA1
19e28a74b1bb35e75dcfe2b8bfff79138427c441

SHA256
7bb820db8d3a29e73b0c1ceab953760bf1507ed888e7f2d056a0a53578792b0d

SHA512
c849aa566f4639ed7f173dd25d4da56d69689da4ce72771c3b9410efc1641674f821c37c4f92797eb28615ab34c98901e6f3aa044b42f568c456ec9ce29f567d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7953e044dba23461427ea0ef7c77171

SHA1
5f42b90ba54ce3084b4d832bf9832033b4720ffc

SHA256
5cd4730d4a1d9ac4190567574495eb9b7d3ed6f3884fe7c4cf52c4ba0db4ee86

SHA512
8151fbef7862ed27428561289da4ffeb8c6bf4c30b90cf23eec3952c03fbf58e41e7365ddaf4c1dfe440810055f1278138f9463bce25c1c43673e17008d9bac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74d6a49314245fd37152a5b637d6b026

SHA1
b25f689a576e91c9b04f8bbf6feaa33ab01eb8bb

SHA256
28ac8c01ce57d384b2aa38776041d2267283bf77c4aa8293342cb4b089fbb9a8

SHA512
def37dd3a7d690ce4263964e59123b3f7d61ed3213349ea9d6606e77959db16bafaba3153bdc21b36302e5d856f54abe422ea219b95fff2e76dd87196e787000

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab56E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit