a488667f3121e486ebf99287dde7447dd90b1fb841c6bbb656c0fd558642cf98

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f601e6509e0a84fb132280d350791bfe_JaffaCakes118.html
Size

462KB
MD5

f601e6509e0a84fb132280d350791bfe
SHA1

233bc2b1077a41106e77dfda9dda4340d14297f2
SHA256

a488667f3121e486ebf99287dde7447dd90b1fb841c6bbb656c0fd558642cf98
SHA512

2f4d2b47da2a61c95bb80c1f255d6117be2933f7000131eee9caa8bd36d15760491fbfdaf996ce8ad4393861a05cb079b6c32b859d3948d1a1193a17bf3d140a
SSDEEP

6144:SgsMYod+X3oI+YhMsMYod+X3oI+YSsMYod+X3oI+YLsMYod+X3oI+YQ:f5d+X3j65d+X3a5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433428892"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0107EE41-7B39-11EF-A1D0-5EE01BAFE073} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000003acd4136d02e422bde7132f1419496f9bb3df9231cab6fd7b372bc6572799ba8000000000e800000000200002000000097ec6c4ccf3d83d51df28f9c56aa06cb2e09550e18a11f04292d80916cae70a620000000937b0532b66e34a7b5bff06c7d8de7d6dc89ea9237f3afac3436bc40465051a640000000364333928607c567c43fca644bcd38c8c9ea7bb6683df9f841584997e505f92c5324e2c6cfa13a100717aece11cc9438f5a823dd843bf29f10b4b402a3eece66	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6009e0d9450fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000f67daa7f0a5d91e40e0891129b540dac3bc835c6f6319390d3e857d8e5d4913a000000000e80000000020000200000000122da74ffd071d78cedee78bc2239c7881c6b824e4b3707cf3dfc25b9470cbc9000000013683793f3562c2729abc3c49290fab18683feb0bbcffc5fe1230c6a90a20bf278d2b0f3a05603b41ea5fe5a7c5d4ece379e77cf2412efda6093b64cf5af224edef99d4ec5eb8d9a876fb59456c370220bd6a82b80e03b05a18a5868ed73e7f880337ec7d9e3f365b3a47fbe95ddc54726d2aa609590fc71f92fb38c89a6217698093ca8abe082eb84deb81c48c27c9140000000c3d26098d32be0767be3a09afca31864ca3f5f7c675e55c47dd773564c4af3bc07805bbce0b3e38c6622575d02bb86287dab67a952abead5682d133a749e1d14	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2616	2700	iexplore.exe	30
PID 2700 wrote to memory of 2616	2700	iexplore.exe	30
PID 2700 wrote to memory of 2616	2700	iexplore.exe	30
PID 2700 wrote to memory of 2616	2700	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f601e6509e0a84fb132280d350791bfe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d48ea61ad27d12da67112698a3d2de16

SHA1
8a10cb7587724205edf0ecb294f9702e3c2e48bc

SHA256
6a5bcc469c64ae75b0d1f0b69b4c78b70cc5d9417035f2e47628040e8144e2e4

SHA512
b6f7064e156af255a1edd8295b3591317a64d2fd3833af61d741bb8cc1a6bc58305225a6c073d1b5b3cb9cc61beb779bb4b79a36837905e949268e1bd338187f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbcecc98021af3dd57a20bb89577ba94

SHA1
77f2ed7f020c440d53e43fa5386e7b4d6db68312

SHA256
5b276b95c870fe59caf935329f9110f05edca95765b60066f9df933171c97225

SHA512
34608e7b6b4a8c32fad70155fffc3c45f383f6f80f785bf37e8531ae8cddf8a411467e3abef70c03661f8c87408ae6e165ffa6c4a5a8d8f9ff0d619bbed8fa51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e07a680b5f510be12b1b88fcd445353

SHA1
f3ed55436347ea743ae0a2a8a2ddf9bc62a5627d

SHA256
661724def33e75d5df56161575592fe7415de0b15008f44e6a4730999786efda

SHA512
593f62107a41f2fe937a16df8da2f3896fe08becccc0c074fafe0097c30a9a41f04719cd44264df8c565b3d775a6f7c2298b1a02ee1b0962caf47c52847a3acb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf3c5e43f0c8df29254cba4ed78d54cf

SHA1
2b9bea98eca8a9ac06e78bb52f1f156de553ab1d

SHA256
3d2aab2fd0dd8af6af3ea6bf82172a582d22d537ec80b408c61572b54397e18e

SHA512
0e5578ca0bb7e406aac9e137bac39f047ab8d4eb55ece3e480ab0c562966289cc8d57ec6e2c55763915c804f034a5bb6d57fad2a183d9d3d13daea35a7866940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dc1197b7f76682ef94e0671a5a9d1ec

SHA1
6d33b8ca956a9fd4739043dbacdb6b45aed476b3

SHA256
a3815d3bc65bd6c044329fa0abc5dcc42cbbdc4618c7d1b0b33c09c5f33ebf6d

SHA512
2f3ff1850c8edfe4ba20b46d7538366c7545251193502548710e01fc80612f1c0904e6cd99791d231fe913ce80a744a1a11802dc095d3816bc64a4e824f313db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac4c47502243195784832d2c503d3bae

SHA1
6ca934b3c5b5bd28b461ef2c070061e6e1b0d901

SHA256
8eee91af35a7451f7abeae349e2fcdc07cac9a2ecc07699f7b890de905fa68df

SHA512
2703e47df2dd017cbdb92cf38fd085dc0bef88d142b3c5532fb8f3ddcf5cedd6b1f06b65750b470dd76648d6e3fc357d6b03dcc28bb44376625806765964eb2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
defaf39da54a2017ff38ac4311980f48

SHA1
89ed2282b863aec549d5061ba2c90052ff0d04e2

SHA256
b1ae6dc1436544572b8986bb8ee3f43855ab157f3b607bb9a2c15d66b49b0fb0

SHA512
faa1adab231d93bc7c88be029da2aaa69024b56ef37e06f89f04154387bfc63f9afd4d81333c1df87c4321adb054fc54a683a0f9a849593bf502d7d6e7af770e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
431e6dabe8b9deff52c5f5e42720d0d6

SHA1
a800e5cf2684743a4116d94d1a5f47bbba69740a

SHA256
88e2a44e99746e69b265da0a2f684ea3f3e0e3cb0da92067ca76cd043ba9f313

SHA512
296939895cae43c03168eb6e389eb0a4fc85df178476ce29ac095fe1b82fbf523af578a7d1f324554c26c1dd29b7d8b8fac0d4c729121bb3a613c682097688e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fde1c098cef773c42df85153ee73999

SHA1
d5336bd7c0876a6584a90ea640d24d993a4a95c0

SHA256
75f802385fe594cc0c94249d58bc0be123c124d52233df465e757fcff93698bb

SHA512
5851db41dfe73d2118de73839f975b29c42f19394ff132b1396bd4a82c9e26d5d3443d23cf94cb2d220ccf26ab970f0ff8e75c071c3fc775e01fe9e120645ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b947082161fe4d62c74334fe9db021b4

SHA1
7d5cbeb6e67cf01944ee6db2ec4b80ce98010e1b

SHA256
3ddb106946cd4270617435af901a34cc42b881dcb3ce99533506121208534ac0

SHA512
8a9e2c7d0381bb17c0a3e85f2d9135b826eb9f4ef7c8d3de539bbd52d03a1fde279541a056f9bc5afe6648480e5f61589355561726f9815b13fd3ddd3b06f03f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db4e9883035a62ad212fef521117fae5

SHA1
0b7636838b9f4b6fb9deee118fff52a6419676fe

SHA256
79716d710eb83a108c8746c2325d9e3903b2e6ab533041b712f6957d96bb0a03

SHA512
25c60843cdf0904d47abbd582f07bb8599d9fe8e110fd51dcf093b8c66febc73933fadf571269a2cad1e059a0b04b98daa1bbb0e9b3b3432dde3a43b0111385e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a65d3e12ba03489be27d1c549e34a88f

SHA1
ca46980d983db92fc54bb73783ef75354c715a43

SHA256
32f3af8fcd56a85a95532ab05c46c216010ab244c0029370b4e9ef8de6ebd2c2

SHA512
710bb2d1228dbecf9a29a7bfe8355411c24e289f109b856c34f6abfdfc96af6cad93e9a9ba03a6a0b67d44022a68536bf24a9c51b5ef094551eea2545a78d3b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3503bd9a9d740bd56563734d71e07192

SHA1
c4ad63e3ea80e3f400009f8ad6a1be222ac567f3

SHA256
1d40df49c4b2c521c923e88e2131c12b180e469283ff1fc0ff2095ce55923020

SHA512
4104fb69df79ba177870422d7448cd76b6a43d86a08f2e5382cee4fcca47835c42bb03c5620b1ccd9ae980e9290ebee030097bd810e5fa1ed6fe7b2e4b4e516e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57b3e4125097dc14e539012f01d3a92b

SHA1
e0aa4276b4747e5c07f6203be9ce521bc8201243

SHA256
1ceb8e52a750a5f73ce767acee8863179a5f17dba694033b1096c4751645fb61

SHA512
8cbf38fc3a972f21e56290dbd876c6ca587870ac334f015ace1e79a0ca85c2342dfd098831dfe008c3ebb967ae1b1a68ba8353c96692c2d3662fbb01d321e7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d288521073b5320fbab9448f825bd253

SHA1
67c6aeb15b6f7a1dbc36132ed54a367ea312ad6c

SHA256
89f6e2444d62bde8fb78659a2108a6da263011ffe317fbc094dfad7d60060128

SHA512
8dbf05fd4031fb499301f1778830772628d83cf66f24f76087033a02d1a4346da1241db64bf0c97865fd777d1a93ab7eb02d6dca8140738e9486bec03c0ee2fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab733E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar73EE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit