1766e2763bec2a5840c57843a6a6b14fff2027ae4d74e79fa09147a9bcd77b08

Analysis

max time kernel
91s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0600dba46c2fb6c7324d044db2442b1_JaffaCakes118.html
Size

22KB
MD5

f0600dba46c2fb6c7324d044db2442b1
SHA1

2eb445acee01153c269b02efbec86807e6ae605f
SHA256

1766e2763bec2a5840c57843a6a6b14fff2027ae4d74e79fa09147a9bcd77b08
SHA512

3dd41feaa2073ea49fa22ef4f0f39a454603ccbd45dac9919535e5e8713a8b3585d1b839471f2a0653dc1eaa450589d3bafe28b2a52c875f1ee9e2667b08f37e
SSDEEP

192:uwTbb5naGnQjxn5Q/lnQieoNnQnQOkEntLHnQTbnBnQ6v06J4RnQNjMBIqnYnQ7W:4Q/jv06kKX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433104508"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000bfe1f51fe419d48079c8374cb1bdfffafed83a18b9e99c927ade68576b7b8010000000000e80000000020000200000006f14dd28f28103b86052140051b12cc1d8f057ab019875b7d852d96c38cc264690000000f21e96b08fc4ebd6ec55c9c2e168e1f4810a20cc7220ee4d35f37ca32e7f0a0347bb3372251e8309f9c609c7b255c980b7cbda470a93218f227cc4203c37ac181983fa43094f8cee2d1d9830d4df2360771c0ca543bdb924412c39142b1efdde76c1890d5ea7edfbc022998c41ba039f1ec4e2fdcef83c716af59b0fb186a308867af52b44cd7d97fd86311e1b0b604440000000acb5251ce837cbe626c6687ca398fa3c55f5b4b5023d9935b6112b246ebe3e97a3a51ec1825129cbc469b716ed6c23e0d904360ecd9c7bc80ffa9b062f15ac32	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1064cd91520cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000409974c22cbe3f1512d16730ea1eb10bc99e16ec8d31436bcb6d4f7e2774ff90000000000e8000000002000020000000966b3ac1643da428674738ed4bcedff17d12da5ba4e8b1744800a94a9d88c0722000000073178fb3c7074f5c9fec891bd6817f445baa5fe8f7fb0345c541f154221110fd400000005daf4833cbac0df1cc9705b4d6a55baf5d808af8a9e449f02dd5348bfe3e443926f5e86147bfb8fedd8c8ff6f59cfcf06a48b5557d9b0ccd5baa5231ce9a7730	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC8BECD1-7845-11EF-8B64-E6B33176B75A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2744	iexplore.exe
2744	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2172	2744	iexplore.exe	30
PID 2744 wrote to memory of 2172	2744	iexplore.exe	30
PID 2744 wrote to memory of 2172	2744	iexplore.exe	30
PID 2744 wrote to memory of 2172	2744	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f0600dba46c2fb6c7324d044db2442b1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c0128f0f60b3b1c6ca3c2386257f801

SHA1
a7619e72a45c2c155b53b266802a538ccef11309

SHA256
d3ca4abcab5f7e57f1ce22e213725f4f2ef61d87c5aec86b49923b5758493ca8

SHA512
0f11c5bb8b7f936bf3b3b3cbeca68bba447933a9fad2b260b57b5ef96da3b7670a27d208b031d32b981b543dcde4d3f36a947e131e2950a0eef6c8cceab3bd19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea8db8f64915a1efea4f4e9651efb0ba

SHA1
3b585a59e75c3d7de7117aadc3af93752d06d09a

SHA256
e0ecaecf099449475f11fc6baedbd7e36ec9254289e4d01247189c5730c65414

SHA512
05b7d80402805b66aa363dd540a2c0ecbacc9ed319e9fb198d7f73f181d7e93531a0079eaebb31a92e9485c36810086a32a8f141a63a5ef17cddd4602ea46d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be8b204546b2822b973bb9d9d0a9bd6c

SHA1
9f7b31fe710c5aa19728bb61f3a93fd5da9d8cc8

SHA256
964bcb8d226043edea0293b933bad7b92c10c608a43076e77f1072c2325aefc4

SHA512
3ff4fc9623ac6880451eb312aac8857ff73844bb468974132e889939ff4b981ca8212faf608dfbc1ea1d5f942a3a6e1491de0ad6998f20fa555f7214675737c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7de33bbbdcab01917a1ad18680c9a81d

SHA1
59f1fbfcc9679018b938c2f97d07aed6d21a468e

SHA256
afd2feaa0f5bd8308d61d3f36b6e6dbb7693813e3549254dce84caa37566b3d5

SHA512
065de8376c35031e1d1ac218559b141077fa33ddad0306d8b22474bc08c9eed9ffd3cff685c99461734e59a0a249d6644e242d8fc1664f207e15232fc2bc20ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52b549f90e4730eb2582d77cd48a06d1

SHA1
dd71e8f620cdc8c7c5b8632c26e4b4ecc0251c09

SHA256
220db145cad156e16428442b15f04eb89af252260010ca75da6b6aead125138e

SHA512
6bdf5af18641ec3bcb2b0bafc7918dfeabfba071f5034f7d73d9f7bfabd49bafecf41954d0884c5a9d78085efb47c6d2124923caee9c13202a62059cb79bb3b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8aa49a6b21d724abc1280b4fe5fe9ac

SHA1
765d9e028feb4cf3a301910837dc5a4166f4203c

SHA256
1568f5b15eaa71048ff32ad4b85b32223f24a4ef5a5dcf45742783f563722e33

SHA512
acf496c0b9c0c91189da8bf682a20f01a7029a1d96096f8a70092330253291179c14fb9af26c9e4a6526a3be1f2d954024fbf31e13848cffe2fffe5cfc223016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4439edcd745fbef5971be967e975a99c

SHA1
6a6698724d71ac3e689c572915fae82a4f6ade48

SHA256
2bead9d20d121ba9d6a72d98434289dba1e2824949bdb3dc58e84b5471ad1206

SHA512
408b5bc2def8bfa0201f1043845dd902f3722efda77909f448a216266835e4a39b0b9849e45abe1286345e4e356f37404b6793d4336062508585f0c30e1e40e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c43b9167d2bd0fbf270db0d6933f2d87

SHA1
2473dce04aa1993a1fd9094bce555aeec354d475

SHA256
22dc4f840cb1f9f3e49b74ebeddb48c81bf31e57c900acc26209154a049023bc

SHA512
a147c1067bc403739d784f368e32129d5c57720f6055210069b4b98f821af88bb9c9d85d1b24d7df93700ab420e4e33521d9089c44a4d9a9db1d65a34e2afd26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b16f4d57e5224cbb3a2b94ce2e89b98

SHA1
d8ce8b65b2c3fa93538ab60526334e1cd19d17b6

SHA256
a1b4f1a8d083c706b10d633ef45b02f5ad1a7fd0be0c5c7d9869573b30c04420

SHA512
b1f650cd5dde9be13770038bb32432c91c6a42d038e087b50ee12d60f010abd7321af591d11aea4e444960657faa8cf59c66c137f71e531d1cee393270462dd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b99bcd975d2cab4760a73198b505f03

SHA1
85c4b4c1839e9d68ad388a5782eb137e2effc5db

SHA256
8b3ad6b18a96e75e07a644c69ea51ce745c3411b644dfd3c1accf92dd908acb6

SHA512
2aa78e8b371c7b85361e24e2fd9c0afd516ef20afa09844a9796d42b597b7a4acf09f770d9aa77a1e339047ff5b00fc59964f31c6f0d370c8e8ea2410481fdec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81c8c2ce210fb25d66c61e596c5a5870

SHA1
556c5abbae607772664a73462a7cd057d5dcea8b

SHA256
06f9bebb9a4fb9c0af66544c71dd80127ce608aaa3e77fc426e31ee270f207bb

SHA512
56d5772cde30318ff709ed52ad0dff5d582a45899a5d58b768bd91db3c15267ed39ab98bc73d56109ca06738884f54d0bb8dc8825681e470261a84337ff3a9be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9782.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA395.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit