44f5fc237d940db3c5a33f66b3e4175eacfe99b17886b6238e3afd938a8eb1f4

Analysis

max time kernel
136s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6eea2b001ba4e31c26bd71344be78fe_JaffaCakes118.html
Size

20KB
MD5

f6eea2b001ba4e31c26bd71344be78fe
SHA1

b678a41e73b39cffb5aef627f24117750614f296
SHA256

44f5fc237d940db3c5a33f66b3e4175eacfe99b17886b6238e3afd938a8eb1f4
SHA512

cb14707408d397c371876e7dc5722c3d15d932dd4e7ee8857218d56bfc3b2b4c7170792d15a8023d30878635ba87c9e571381387935e3f9abf06f4eafc4d5d0c
SSDEEP

192:YuWcfEndIBdtvHiw2/YN4MGurDRQOwkd/RqkcY+CXWhLcjTzPiI1D1MMZhfK5/kk:R7Dt/if6npALwIcTD1MNtDESMtMf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000d2b12770c7eb7a17fb66f3f62a54552328884de47013e7ade6c0ec269e20d1f1000000000e80000000020000200000000cbec311a1b9825466e6356589a1410b7cc81d1f29e3dc0a70fc85bd55f873af90000000df415a27a23a152f7a9702ba46e4772629fac0accf338ece3009a0bc954ee55593983f4982998f66bdde53aa940016fef9ab707bbe2a97a05fc4a46e2fee6483a1ccbd68e3f8bdc550ab2ce7e7248ea1470403cb305a5a335ffd470c627c88f5f340e7274cae2c1bac92c923ae3d05b8b284ca2385794375deb9a5c4051f3b97c3802ce37017c263acc5c5fc7641707c40000000eedf49d7d33f80c81d2b1e89d8fd5d0fdde17d8e51e649e81b54656b8fb51655ff65a274e6528d96bdaeda9fce5d8b9871a17fcb27b4e4f4283b739b7a97f1bf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ee91d0950fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000008f368eaff396f6e4734cffa1335feeec964dcdd629cc04c63419630388bb39c2000000000e80000000020000200000008a83e2f8da1da4d8a511acb2f10516d572997ea25f523982d43f954f6e68594f200000003bc21bcddbb727214bec27e43164fe03f98e483459ed89990cf3ac35920344a84000000065b1812b39b04a923dd73ec54d9183573eaa235666836942fecb43adc5bb7ad95122f8d7e8c1d78afec094a0832212096504df5d9a410add94da0bbd676b210b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433463242"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB260BB1-7B88-11EF-92B3-F2BBDB1F0DCB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1056	iexplore.exe
1056	iexplore.exe
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE
2768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2768	1056	iexplore.exe	30
PID 1056 wrote to memory of 2768	1056	iexplore.exe	30
PID 1056 wrote to memory of 2768	1056	iexplore.exe	30
PID 1056 wrote to memory of 2768	1056	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f6eea2b001ba4e31c26bd71344be78fe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1056 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c36e9b25b1962fd115abf81aafa81ec

SHA1
5be14c76eea7ea45cbe0b7742db11d10d41fa32b

SHA256
4d48353ebcf49ea965ccefa055c13e067b7664eb7e1b2117830ee2da9d3caccb

SHA512
5020f8ca70feb51671c858732e57b905971d7ff0ebf3b9881e5bc534632ffd9a7f45cdf259ce9512e212c2bf43f29d83fac4862d5f6e2d163d74c505fa49d76f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0a4c125654de671c7ddb6479db1a406

SHA1
f895fec2b4c2cac0e03e036af00ff21ff74040c1

SHA256
21dfeb9d562c1795703b0f144fad02d4d2662b0dd749652a75e1529bc982ada6

SHA512
17b30eae77bd0b75afb0df137e89d702c7a79eed01f4ad4a96d2208597df9f8684f4caa6b89e68f5852e51406bb611c4331da91e2539a17b30d0ad2c454dc2ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee18c6e1c3db2f900a026d79b33e117c

SHA1
282abbf88b371eb1602702fecf5e0107b66366ad

SHA256
dcc77dbcffa534275005d204d422a1e9181205f1e6413a3a1a10aa06200c6fac

SHA512
d84ab58f693de68b9ce941ea2ebbefe86d94a443721b4d98703f5f916bddb3202a261926b07ea295e01aec8be6b114b5cd5cd43b1dfafdaaaa7eb003d20a5499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a571331d1ea07a3e75257882fb4a8d8

SHA1
1f46c1c8c49ae3c5686286d850f40ff345302b35

SHA256
d7729a3976ea1d45ec6d119a02137fb06c43cc7ae247ccf4f89ed7383b239d12

SHA512
ad390251c401f1abd45b0c733d6769fb168ebbad91221287480790cd2758ba2106cd599104cfb2f1a8b34415e6e245d2c7ee7fc88d4d5f621de3c072987d4730

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
242fdc49b37bd32e8efe47a72592c315

SHA1
968b6c6559aca772a8d0819a05e6edbf784dce10

SHA256
0ebe0f7f45cb10ae5bc8ab65e7140b7f55e49fbe080ea5afdbe84a6ea944c8bd

SHA512
facb8e2457157c823bbb691533c9a28b5fb99c4a19669cd3b987d72452fbd6660e172848e6ad0db18e63a55d141ec65ade000ff6d510ca2dcea2a488e951e202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
690e94306882e95052eb3d3734223471

SHA1
66076e6bfff8589bf083f3ded17fa5c0d3ac18c6

SHA256
5f98f5855bdd7b2eeb5708e92e7ed78af2ac5452821df156ab7aa50027d4a798

SHA512
6ac7200c7d08100ca53b1941aef6a655a510eef5774a2d8b810246e55c412bbce0aa731d668b2fbc3c16d7ae486ee1e196f0b2e47753eccb863301103dc895e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edf954c82cb0bf847d3f8b9b1070d439

SHA1
55fb9210032d7411bbbe02d8e46c65bea24549f1

SHA256
6fdf6a99f95e87a448d8585c3e5638d734d1d6661c749667ce4c56d1c5f34519

SHA512
9286c5d15745ece99e48659cbf7be7c5032d54e64a1a1e39a2b7f2154669fe80b1aa9089a29a68d23ad01346eb6087d5f22d804dd117a6fd1e2f2ee1ea4097af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b06a2efe8696016f76fb7f266dd1a360

SHA1
5f867337a0a8bce811f97a3dbc63e16af19d36be

SHA256
403688fa991ecdbab4229b6326c8479a0da6221a565b54ec31c3c079ccf28e15

SHA512
6b9e0feacf80f09df515d575e8771f7f12f9bd543a257136b6776f0c7887341e0783082337cb010b5263be4f0f9e75b63094c0fd17075b54365e5281957229cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dec9944396f58fd8e11e8c53e8e6c2a6

SHA1
460fbb409297275c6ad1fb0b3b9608f4c1289ae8

SHA256
34ba04fa236b6d1576063f538a36a9893516c2cc1677127265ca56fcd5ff3645

SHA512
72641b6402c86db89747667ede9f1dbc1fee1cdb099de162e94e2805cae5b416aae7c54ce1dc83c23452f8c0ec2c45f12e6bca03feecd1757c2989a735e4888f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f444d56d7087e7b15b01610981826178

SHA1
ade8e1b3941caa4b3e659bea7886e72c7bc1ca62

SHA256
52e2db7bb904c9f180f4786f583ef7ea29ba767a56b61488e0f38e1ccaa04123

SHA512
b94a3b9e066ecec91879cb1818a6458f8d01eca7b0cbc5ad1f081bece428cce9c974016833138025ab4232724d1aa099fa1778a58bdaafa3b2da05268c989988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17b2435638d4f669b54a128313749f19

SHA1
5652040a24602f202b8c0139352c3b8246eb2c8d

SHA256
905677e83038e127756ba00c214e4b71e9106257a69418d7144363734937c05f

SHA512
525b9c4df5babe856d383a5cf117923767b87f7ff15d234c5a3b0498437c9c6a0c3b8c4dbaf0b49dc36bd4af604187708cecf1829cb79d17ff11c1e685bb7ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8504552f88f1efbb62d65677ec18489e

SHA1
cf3983773094a4202cc0cb532d6d144ec56c8205

SHA256
e7e6642c237627565dfca94ab5d811948debe2f766504fa3a84cea8dec1ed5ab

SHA512
df36a30ec7a0dd27b08170db36cd1a4b0ed52427c49cf25b27cd1f83286b61e9f7f4fd0df4e1270c81df821ce6ad1e6e64a45678f821a54a2b1f785b89751439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6bbcc158526080e551090f7234fafea

SHA1
e60de7a286b8b6ebe415a4e28d19f9ab6010d29b

SHA256
48b9e0777c4f7c0794dca60ee7c7a6cddcdd893fb22e4bdf5c0d956c1276b405

SHA512
a53ba0ac8655fcaabcd644e6fa6226116d7937209de4c637c705cff83d848acc2d6af7d706b563dc0a2d4aa09d0e8ac414372f75e459a08e9d5c1d341ff4fdbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb2eac456c965eaf3ead7fd66dda3e20

SHA1
3b666a1cb12b994a05dd3b4884002a0d7ca0ef00

SHA256
a58c6bf19ff61c68f3df8b47958120bb3d21b37ba38647d042e52d2030a7f9de

SHA512
f9242b57f6c2b5d781aa08e75143a6526f0e8fa41c8426d7335165122229efa472e2b5609da2b0f7b007df202f12985fe5541ac523d6589fc9094900334ca12f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1bd16d1661ac8c24aaa2c59d575427b

SHA1
4bed14c92d564c39236a047a2b61d21906758f3f

SHA256
cc0bfdd6ff3ae31897be072278dde829cb7a2f16de130b5f671ebcd2a9c8f8de

SHA512
bd0b6a1a662f23dcd5d8573f686460255d98c4e05781abda722714add4e09b2e0ffdd166eca6ea04383deab33ff7583febb6dafb5b567ce628a0839d66ae435e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7d6a70a1f24f347a8e1a3f83435ee5a

SHA1
dd37827301de412be19d306f1f7977b71a277457

SHA256
e3ba94eaf6aa82ef8ff30df33e731b0db268a689ca9e1c29efb5a0cfb7d2408f

SHA512
684488464663b51048c91799ebafe4aaf177e9a7c178dbb791f421be6904a6b06474f7cf5cfd84d2558c93969fea22c3850a25054415127a82bcb7f41c781fc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E20.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E40.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit