b014e2d13a42a603e94451fcbcf8db4fc556c5c0261696fb767792376e937461

Analysis

max time kernel
137s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f71c0826384da4899d103f6a91d82159_JaffaCakes118.html
Size

139KB
MD5

f71c0826384da4899d103f6a91d82159
SHA1

d1067d956111a92a76f5e1f7334f8444ba29e733
SHA256

b014e2d13a42a603e94451fcbcf8db4fc556c5c0261696fb767792376e937461
SHA512

e05150fa9e1d285edbf801c5bd810ce788bbfe0abe3ab9b7f8cea72b784d61b64029adf039fa7988ada858a4a1eaddf1b166c328aefa17d0df305b3cebaa8318
SSDEEP

1536:SdNra4FMl3FyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SdE4gFyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c00ec0aba60fdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000008261f0719359887c360504a1436dfcd474035088a7150c9196e5c483fc4d2b7f000000000e80000000020000200000000a0ad3b22b99074799eff9fb68dfb2ea10634628ff2c7b61d329d21718a99bff9000000034310bfcb1e3171a3fcee9b2153f5091b6f57574103940b1e24f009e9b71d286dfbcce909e9f3da59c259fd4cdcc8586d993f192092b2af614d5587a9c868e6df80f676c52ab094205fb7b13ee6c0c62ceead7d23a4f296d196cf548b9eba3c3b86fc490a78b3d91523f8a3df6be25ad6d6299a6a36f579383074ae5c3422084e6e4ff79c67f72297c0fe82307096b6f40000000d964ca430913fc7c6483c1120a2d0d70417b869cd4f1d76b86eaa7a5af8350c9296939e1b1ae6d01119a857cdea892ed1bcf93f2a08ce3f0dc5ebd4f5e859605	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97E3CC21-7B99-11EF-9E99-E699F793024F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433470377"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000030bd4d7d4daead36cec36167df681f83f7f3e3ef5cb67cad9d388c0e33bbcd9b000000000e80000000020000200000009245fc15add20a1e1edf6f86822ee8c6478253b2f4a17805473558bfb72569ce20000000bfeebdbc50def20c3919fc19dd70d8f9f88ca7b61005b1f79e8f2bb8708a9fae40000000e117413573ae6cf340cae1b74cbc5480fc7d2e7cd87f59723f040bf0b0ad9d0cdba0da810a950fedc8ed078158a2ecb62eaf36c09243eac42f8bcf96b49bd0b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	iexplore.exe
2260	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2852	2260	iexplore.exe	29
PID 2260 wrote to memory of 2852	2260	iexplore.exe	29
PID 2260 wrote to memory of 2852	2260	iexplore.exe	29
PID 2260 wrote to memory of 2852	2260	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f71c0826384da4899d103f6a91d82159_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dccef70fafd899029d2b73b95846917

SHA1
ea213e08573f77911edfcefbb777503a68a9c56a

SHA256
2c9994c76ebfbc23271b8e04bbc3cba0a05c2c83c5401567d2e7e8e6e74d4b09

SHA512
6c5edab404a762f3ec13d42463f1cd1e53bfd3c6e87df0c55ec28c0169d5cb4e9eda054e2b47fe49bb5b3a79052a77fba626ca4a10647f10312fcd46f5c66abe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d1ab6485e9fdae06f2b1897ff5e2a03

SHA1
9f2dff127cc6313a498c0dc9705be8970880077a

SHA256
b9f9da700334c6ed7b7e4731291e65f7d8e351bd6bb5dda13e0f188b36f71c57

SHA512
051e172e5cd6237225945519a65ae60c1a657ae2bc6c2f965ef57b3326ea3ecd4981928ef23e1312e1f8f2fcf25ca3167d61dad0493c52e40f261cf5e8bbf958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ce6afee794083c36036ede329908aad

SHA1
df42cbf635d257c214c58b54a1532b7a20ccaf6e

SHA256
e346571669be15afbfd647947fddaff967aef1bbdd955731aca150690b803ca1

SHA512
13d8ba66116818cf0f70eaefe918535c1c482fb85c02ae19be193f8a22a6154cb48926b4c0e0c1382cded03bc053a668b67487524542127002c971611b682812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04cde31e8f84241556afad12a43d8b72

SHA1
f818bd9b20ba72f3ff84df1f95d10681dcbb7fcd

SHA256
38eb2f4f86875fd9c2c36d4fbd296b35056725187125b6a8c9eb37aeed74480c

SHA512
7bc3dc016597ef51dc4c650450cf36ecefff1e7b703015378a61fa246c4a7f9240a4bdaf7b261b01cff311b978f68021e5b23bb067b6c40a9aca31e185e03aad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
263095ebfab947917bc9f049c4b5e8ac

SHA1
eb953708be232a15d0d2708939fc869170df85d9

SHA256
fd0eb41fd2f40b7d9851a4234d7cf156f357477a57c27826c44dafe3da43b0f3

SHA512
a28d4f465aa177c91a4d0d65c0f96cfe5f655b8d7ba3c87867dc6a4b95be8b8f1e2d38d5d88e7f663a3560d2c9824622017df3dc684cd8ba805136b24345a853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7b8d15d1de9f41b13542de8f0eb3c5b

SHA1
c9b8f944705b2972d627ad0e6e2bd11d27b98269

SHA256
c4f40ee827b24dc61dd350c45e7f6eef3832988ab66b51b1cc0a0a816b507ca5

SHA512
cdbb8f1b11fb6e54beb3da141cb680c2e0dfbeda31e5121a384ca716b1ede3b795955105f385dbed24c35ba567d2a017428878e88fd85429196f29f6735b8c16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdf0c0d2923c173c3871684d293491d0

SHA1
b09d87cdb25c1d2d96cb9804d8e74a1fb447fba1

SHA256
737474dee9e0887647cdddfb97c153da35fc38fa17b54c217d88496ce9127b7e

SHA512
f3cc0d0bbddea90750eb2b0c75a56684b53032031478a47bed2eefa7709552781ddd0004626a456fed8f8fa838295e27b7d3397ed6c0b80c240f1af98a5d5c87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8304dd2ac67fabb0371d9ce863f82df6

SHA1
461b85858a80b90a103963b834dcd1f4cce1036b

SHA256
c8d51e68f35d76f39d168c1caa4794ab560b9f15da6a5406b755ca8d81775f1a

SHA512
0120c2782d5068dc7c47bbfbd26e0cb598b2d8d51bb4ae7d98fbb99886b04985199e4bae0ec8a236203ac0fbb5aa87e352147dd579befacb8bb56ed187bbe5c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d53e2786813eb939ba01538aa4130b89

SHA1
c8165aa5ed157bcb8a21032a5f9d2e71a933f3d9

SHA256
f5bc5a91572e56ce8a7eb41e8b4403e29485e30e6910bc8c19348a1cd2d2b1f7

SHA512
a250c1bbdb806c3950e5817a933e8468c8b50fb1d02d3fd17d49177357f676298f32ee68c62f49d6cb128c8575061de0b824766527d0d1a5d3eeca2a981a317e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e2f9400450b3ee12f7bae57fd3d0264

SHA1
6f42e73fc773e659acdd0353b9dffeee55e165d0

SHA256
060e7bef5b6d6c4c0e0c22ab45b7b0f546d98c85eba95907575d9e552525a718

SHA512
4fa4a8190a858e2f44036acd342a188b3767dfcc7f57a19e78637c50fd8fbb67fc9287f0236278749a2380655857f0b51efd4b07654ea92ca947c33562a28d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e93f0e69e9b4eb0cbe5840bb155659af

SHA1
a220e209ca0157cf8b47b8edaade3c5833d0d515

SHA256
6a68b5ded081be66eb9bec16321493461c3687540f9436d6f10ae7041a6ba597

SHA512
d18f7b53ca14cc8528d023c40d85816a6940fe577006616cb5fa0c4af66c726dc6587ee2c3dbd645db1404139695a438c006bcce42c66c702527e27881c6c409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35c1dc1872c0d8ed10236d93a70b2889

SHA1
cec12f4fd8f92e1bae93a891325282a837039ebb

SHA256
c41c20bcbd4ff802dbb60a689ad0a0d9e7ccf87169600fc0e16e28fc9e32536e

SHA512
96b337555cdf058ccb0d40693243669c65c98bb8d839301d3281ec9fa5ee04ffe1a210850cbf1a5ae5bef91e05c181dc43576baf7b7c7245d522c2cfddb0cd57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
879ea864f1e4134b845ffa8f8234d585

SHA1
4879ba9ac03a4697bafeb79921cc7dda828dc913

SHA256
c82a4b40b7bbd3d737e741d5f8b7cd41744e164781032e84f853702081ffff33

SHA512
de800d1f16dc5edbb1cd45df63c65ee09674e84cfef5d913d34ac7a78aac652c3a1fd40a9943abbf9e8dad28f2a825327bce01a7b7aea222c1736f7335ecc922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52df0324ddb03bda22ad0e21d7bb80ed

SHA1
0207dd6e46ac2d89a155a952bb8a59646d36697e

SHA256
3b7860fd66d84564072b93b554820939d7041b23243f5c7546b5ef5976ecbe93

SHA512
be0f6c8b1641a59628e00841611a8bc2c1f6dcb72e6fd6ee9e4cfb62689b62c174f3a992b3686a1a9f3458a75a112fe19ddf563c8691575a4620dc2e3eafe4dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab93D8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar94B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit