3c5c3e790c997e5ee4dcd1883a576beab98d3588354b76491bb7b89d2338cbee

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4e7ec0d85a0ef8561be0818f09d4382_JaffaCakes118.html
Size

4KB
MD5

f4e7ec0d85a0ef8561be0818f09d4382
SHA1

b6c85693bf3387b974f3b3c86bbe75d74498de14
SHA256

3c5c3e790c997e5ee4dcd1883a576beab98d3588354b76491bb7b89d2338cbee
SHA512

cc74f325ec2d2bb539508d6c0eb57fd0270f574c17b1470ff4faa8efadeeb5164976ff9fcbc5c081ea12be311b9d9dcc2baf799f98b72897697643690e97148d
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oc3pcPwx:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2006b2f4ec0edb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000009df31a8b88ec96bd558c85fbd109bb85f34ff4c38338a45f5aa42dd736c4593e000000000e8000000002000020000000853a0d23ca689852cebbb7dabc4dcdc7e7b5a530a1cb4710cd1441fb993c0e4220000000949897a66e9cdb7e227af3a3f29db6cc42e3079d384bbd96e068377567ce47fd40000000ae4d8f8fe90fe70517b6b80e4bae5494d204c9ad09c2764958b0b2162b805adcffce824f2e452e5cef75f33e72a6f66fc2cc17d529b2612fef01f3f84e027983	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433390717"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000730a43b65462eb3c8f0e45ea19dba4899ade9b63e58e2178e0c398a1964481c2000000000e800000000200002000000026f6ec0b8064db07278f0a29ee87ea22eed85755a3d422308b25ca67e8088425900000004ea59cce0ad916009b14de99c25d8ac162c8e1815741565e30b4781479ca64f81858730daf4a4944fcab7167bcc8be23613f3aa58f034156064b8f1b321ae96bb718cd79d74f2380a7b8a9e8ba55af985fe90e8bcf4803088085f25bc803807760f6781ebf95e09a66444f2ef1e28b24f8fce8639595a1c7a26cf3ed794ddc6ea3bdf4f5466cfb4e6dbda909d11e9bc440000000eca7c18b920f959884ec20585496fdead3cb3d95c0f8e0486b9a6b76d33a70776a4706508f50158ffba31a19ef57b95947925f954cdacff37886e7bb75cbde8b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{202C6CA1-7AE0-11EF-A7C8-6EB28AAB65BF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2388	1952	iexplore.exe	30
PID 1952 wrote to memory of 2388	1952	iexplore.exe	30
PID 1952 wrote to memory of 2388	1952	iexplore.exe	30
PID 1952 wrote to memory of 2388	1952	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f4e7ec0d85a0ef8561be0818f09d4382_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a25464cadb5b194c55771df04599c45b

SHA1
e95bea15f3c6116f59280f6ad8bd3a1d2eaeec3d

SHA256
d3f38227b5fc5f6666c8a6d2a4d76da09c82c8f226101ef9ee88fdc9e7ddcb49

SHA512
6ecb0ef56737ee3a37ed9d23524533ccf1f43b6c314784877f9ba021391eead528e60fa6a443beb36484ce567138ca451d504add4005286ab4fc7e239635afca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6322206cd66f13ae437dec1d4616dc51

SHA1
5ead7a896fdd24cacef9e5733f94440b5235d795

SHA256
10f8363d16842ceba000aff98998afa5b4aa9290bd56f0c9cda3fa4089961c78

SHA512
3ff49a27df9a2f645985b044ae9f179b12db6bfa82c669ba9c792145be3bf713ada3b507d737a76a89a2879a71198165cce652a2c0a647368f678a98cd90a17e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8740a3c3d41144dec6ec8cf9a0d8b92

SHA1
50cfb33e35993f41cedee4ff12833ea38d819a2c

SHA256
325f3e69b81aaeca5d68a4b24928369dc3c4e8be39a6e9e3a5f06f8b512434ed

SHA512
dce5a4dc56781665aa64c6f6a165ff992ae9353f6b5214aaa10d31f3f60466b55c679bf49458d90a3b006a83824e4f6678a3ac72fbda0a3053c7a73a2738125f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b7fc03f158dadab0fd6c5daf90b8bb2

SHA1
0d3e2f85b35572fcc60eb2d06d6770604d409308

SHA256
49a654ba3b2b18a7f184ac006e6bdf73d4bf6799b0e343d8c9de49a9f6e42c6f

SHA512
48904fc584f96591adf49b58c4749959d5f89aee8a2a41799fe8bc4aefcb36097bd30b218d990b7ae9815d032be4f72fbe2a0dd46360af4b8239a86feaeb6171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6a7d8926e3f9117d000faddf0343f16

SHA1
25a7e0c8a23c79f6bfdf4396abd9c770656a973f

SHA256
d9d570b1aa6eca8a96fc4ced724dddaa3be67e27cb12806b61259059837c7255

SHA512
91832148a83ea403fc4100c8e82fc2e629a3b44f1d55f965e0e1876cc4d9873b71d363142fd011bddbb1628d9e4ece6ed1d3e146b2f6a8cbfa66c71e1f37f8a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e9b3889a5d997c55d39ce113a1a9a4d

SHA1
3a36138b7e5236cc69d03e5b060cd0e95c0e6b9b

SHA256
451e3bb71eb1ab7d53d88c8ec8b461da3ef1c2e966e71f07033a763fd407c50b

SHA512
83b2b291fda787c7f9ca534d097226c4475d0e0f265259edd2bf67b986876a18e1f754841e51bf6211f4a1a9b511bf80ee39a43fa55eddf551654eba468e366e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4ebe09e8ab3d4b36c3395eb631135db

SHA1
d1e73a3f6b41c01ac8bd149dc2e6638b4b6521b4

SHA256
0ad6b2b4c157b7a92325ff9067c7c2f67328879a6c0def9004486417124c43a2

SHA512
a0fa0647fff276abd4617db9252a3c316669265f6ff86f663673a20645ded81f6d9d6b55fbab2f5da929913971f620d68fad0aca7eeea9e583fd16f69ddd62cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
478231e0f39c21a2ca677bcd27bc2afc

SHA1
85fea89bcdaf667f8ff94477d9f923fdd4b607bf

SHA256
a38fdf0fde22f3b92ecdaf2bb359bb5f8f1921c511a62655d1fcfdbea107657e

SHA512
cddafe42bb28d888b27dd66f9bee13a0f232e267f9b92123de9a9da2cea89ad7b04a1501c394323c3d1425c4899f2537b82f232f2128d155aaa1f13d28b0c103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
864002812fa20ce3fa47524fbb12a7fa

SHA1
0ce714e283ecbc3daedf1fd1d27f4482535fa931

SHA256
c4bc70171d7841bb1e012e7ac7029c3fad0eee5330595fc0c62b0f333d8ded93

SHA512
acb15a157ff9b782f0e19a3d8514d5165fa2fa853063e692ca29900efeba55806f8c25c561737fc8f8391616b5592d14652041057786616b7a241139ee3666e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53cc3cd2624dbf68f88920a02e77b104

SHA1
cfa6bc9569eea5adeb9c91a469ab91448592472e

SHA256
36089766f230599801a556600093790c9c52deb5610c384711739dbdb87051cb

SHA512
c92b07da964969ae22a8262e6f8fcd4d90dd512cf22e2d071eff4080e7e48e4b766043568ece85132583f3fe1f031ea17c06c4475c5656ac853e103c9ce17103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bf34a80708140182616b9fd549d1518

SHA1
eaa7f0853fbdd72a718870a39477bf27fd22060d

SHA256
e15bf5cba48401e96446a3f1fb23f05c126e87fe8e361cd3e083776dfcd145eb

SHA512
c08864705f004982d0a71bf9c0982bdb62d88e20213af0519ec85f129df7ad810c99c5158c02c12365eabd8afa8f67c746bb91e397497c6328464ae9f9e74a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed2e5539901619513a225d8156317cd3

SHA1
b335ac3801ab1aa21d84b44f1f7f296821e6ac04

SHA256
3353d4b0454481971e88741e8b7717796d1aeeac6fc7286ef1b7454f66d138fe

SHA512
db6383a94d01be3d75664e11810b12b304cbde7dc11adf9f323635992cd86fe640a39209b0fda2fc26a1886720555102a0872e3f2dfb7700d357faa99a0c5408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e24e78a636bb8875fef851bc609282b

SHA1
53647594643d27a775c4ab631aafb4e80fb63104

SHA256
475960af346c84682326c6ae2b4feb76fbc6571ddda72a852b049010884224a5

SHA512
cecffc29a7e313f6fa2fe2510dd3df3957ed49fc8bf5907dc6541beb3a2dac3d1637fa5419441ce56fe35dd9d5681b1e47a316b53935e99a707e97693e1874d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6247bc913eba806703410c8abc06004b

SHA1
fd80ac9e4d7b68584159a2c2406ce5335f18bb16

SHA256
f69ce4be4b8d80324ac303f80daeba6ec62efa669bdd17db57b007d182163bf4

SHA512
1b2271f670f458a6319dde12b88274676b1886d36a532777d21c1944d0246558f0bc30bf6862e8c994bb7ccbc39be5e9a6aeef9d1deb142c4b976278b2129978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b43df64b67cae3376c5b53f910321f9

SHA1
cecd7bdb9c7cdffd275a1cdd651022ac24fdb483

SHA256
e639972c374ba84dc9523a45b792d4154728a27a5e530e8ca1fcbf5d55f47a8a

SHA512
8d133d73333e8e21c456e7228a1e82cf565772f2e3b2d3a6f9a97b801c1cb5a320e0fa34a8324370f107c1a0707e3c26b262d11d36c8f71fbde700002747bda7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14c5b27ecf8039acdb8b24e1d04310d9

SHA1
a908d186ccac5ec87a081c4d475bd8e32067fcf0

SHA256
02aec97c7d1f09c1f72bd6b2b10c0d65452f50f9d59e9b97f5d8ad0fbe615a53

SHA512
4983cc00207b4da8051785b91825c49aa84a50622020a545a32dce728e9eef03040eddb039d7f1b0cca620957a37bbfc94e262639a56473f217ae9c7f0905334

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB85.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB98.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit