d3f5d50ff53a1ccdd4f25556e449b191bc05fe048af102570ed4b239abd09e36

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f62c97dabed986d12d370db2b36ebceb_JaffaCakes118.html
Size

2KB
MD5

f62c97dabed986d12d370db2b36ebceb
SHA1

2c60c3ebe422300e2b69ff4b2c4ea0158aa75a9b
SHA256

d3f5d50ff53a1ccdd4f25556e449b191bc05fe048af102570ed4b239abd09e36
SHA512

dfece8cc157ca1d7d53cf4f2e6648b9413da957676edd745f24e6e3e0aac7cece3c34650a7ec5f3a774379257715e03d0889e7cd964001aeacb7d6d5174a9e72

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f003dd02540fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E6721E1-7B47-11EF-A27C-4A174794FC88} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000afbf2bbedc5762a0c6c62c20f86a47758d2f8fbe240085c069b6c79acfd38a4f000000000e8000000002000020000000876a50e3d9c71f58f517173797284160e425aeeb2e6ab9ef78bd2b7b25039a1120000000352a794a9e151fe3c9e27d59d286b20f1e5329ba23615953f21dfdfa4351ce90400000005689291e436fa9550e1a47ae64d33e98d057a4d55093cd9d9df112413498c8da9bfe4ef2ff23ec57fe45bf1d5f0509a73cd251f50c1c0d3c9fa350dbf073a7a1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000b96bad823fb9da3f485e864b158aaeaea6cd8573664a96f006600dbcda9c8e25000000000e80000000020000200000004d530c9b609d5a489854983ed911da1f66c5af05ad11cd6173e5142453da34a790000000ec71ce192c6c327b02ebcb95040dbdc40b9b796726e10c0d1e312aa8f51d66cf841f4d6aa464beeb54f14ebb4b15c3911df377aa1dd9d1650fb71f0808e73e792aaf0d1aec27450af4da480babf1049a44e030debc437839e1967286ddd64b88e1f9dd97ded87915a6188e45b6f20dbae7965faa5b53e4bf0db81053063f650e980634434726e02a2d54c2ed3d6891a7400000006cf34ba4069434e5d7cf7e7d318212a2f9e303d7b2be9d79d9abf99c935bfa4388d2c8dbe01152e7b4afa74fcd0dc741ffdf3227ae59c41d14d129d3ac1c6d94	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433434979"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2544	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1800	iexplore.exe
1800	iexplore.exe
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE
2544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2544	1800	iexplore.exe	30
PID 1800 wrote to memory of 2544	1800	iexplore.exe	30
PID 1800 wrote to memory of 2544	1800	iexplore.exe	30
PID 1800 wrote to memory of 2544	1800	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f62c97dabed986d12d370db2b36ebceb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04778a776d1bb0cf8b02bf92f9dafb57

SHA1
7212e0bb1687d8cae083af8b26653932e4319aba

SHA256
4478ccbe227027f229253f5352608f04737a157fd23176d5d6c6c410b7f5fd65

SHA512
6e4e6c7d9e3a3d399b23f187794b9eb110ed620f0f0fbdcc0c2d4e5635c9f2a97f5766dde4e20b3cdab60bbe6b633d4ccb7c1d45406b58412d5fbebee2e8ae72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77d8190636170a75d367f70f4f110d31

SHA1
0e64ef957fe8064fd8214cae6a92579a0ec8254a

SHA256
f1a8115bbc2b1b44e6b44a62dd1c04edd9dc8fac2a910854546efcff5b9fdb3b

SHA512
8e0f39ce03df50851f59d72c7eddaf3508ce23352b67dc8c0c17f513092cc6074f00ea65a18588bd05bfce4827a3d9dfdc153f413d77120e52520ba34c3f8d52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a148bc576f50718ac62db8d6f652b5f8

SHA1
33adee644fedaa8b5844d6d734b306b0b6fc652a

SHA256
376f6015244eac0d16a015fac52f08e4dce5e50a989acbf1d2cc3ea54c1d4f0c

SHA512
7f0db38789d8c8932e9ac346c4ecd831d0384eda9e32b672f75f6ea291e867dc2875395846511d23b6f4e011a240602c71c06ed08524a5fc7b733ed08548aecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cd5a5ebc03b34f9734cc58aaf8e97d6

SHA1
8637d64543532c14216c413816a9f0f95b4f54d9

SHA256
1ada57cf515f92dca0219e91181dae077cc5d93e9c0130c6cf22dec86acfe0a4

SHA512
ea13e89f5da4bb00cafbd7a6b06cf42830c5aebd7b55473c01fb7559d89246a17d4cf88b82936e9340b40b11ce8c66c527cf76f89094b18fcfc862e71dc4d638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1057d9327cc33b81ccc9c56f2809604

SHA1
4034584da003d2837eac05cf46cd10b830415447

SHA256
70ff581e9e8fe303fe58e2bde42b20a15c71b28ea8a5051022bbacae63d49b47

SHA512
78d95323754d73d43ebf09b19413f611c2329ece3793ecfda78ed163c2d11d960e55c29c14df59a5906c3c9c86d42dc688a45dfebb2df9ae5ba08df555f91014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9523d1b8539911e7f05d508732518e4c

SHA1
efb96da6a3c8abbf429d24811e37e5282eeea0a2

SHA256
fd32a6aa349d4046b6a6918eb6a58091e12268ff197363aa29abec5e0ca6010e

SHA512
5d350cedab915b86aa1b950b785404aeb6645d1c8a1c67878b542d4671a5fcd7190f52c9759d8d01745ccb49ff0225fe811a449a9c1e438989d80367dcc27fff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b278d48473861a7d033c15b3e108584e

SHA1
4817c18d9e83be714fcb4936e3dd111e3b1b7ef0

SHA256
038932c4bdf1ba993a0b924f2515abbb55711c592f65dc72aa3042270ba53996

SHA512
c5e6ba80e5b4243921b65cee86ac8ad5f621829ec56f76bad569ac32e845bc05f14dfcb081e3f84208e31ad079f0d3e7bddbe0aa292acba3af3945e456c8c3dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58333a0ee1c3a5fb99048b1ca931252c

SHA1
9e35d8b7a02a94dff7366809389bff3ca4c9ae36

SHA256
ac2f32ebe4cfd65e25f1432cd772f200867f41c61301c52fb0952bfa787234a8

SHA512
74e4a92a244b67b728eaf3e5316692baee62c1b60380f1307ccd7008796f9f7f94f2c1d978c0c4d9fbf8a9f43042c54df9f6a27adcbd481ed222c5409fa4fcf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a88802562f986b918825f1140631f20e

SHA1
7f2ec159fbddb7f73c194105f3f998be1e58e50f

SHA256
6dab501bd3ec5589ee75b9eac2b9a3ad98f001d3af423175095dae37a4514a5d

SHA512
75413728d4fdd51fe331958931e4a24bcc7a85120757273129e05789a60ab1e7f4907782655a8e01b5dbed58f252c2fac014f0622f7fcee7d7dc178cea26942f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e452cdd22dc01d3007853152051c0530

SHA1
23acbf334cc38d0154e7a87c91673044e2ba52ee

SHA256
5baddbe873417e12276c3ade2833d8d1984a74e017df47d61dd7cea66404954c

SHA512
80ce9e36e1a79a33b0692c22637bb4d65af484debb9d47a13c530bcdba52f229b99418031434e717438b05228f1f6fe6406f64c2670b32e5cfd6864a82b31bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b87f2cd36dcb67748c7e1ec586fc763

SHA1
cd6b05fec6718433adadbf8cf3aa938d4110d6f7

SHA256
1a66492d39b972bf2af3561aab7bcced8525baec5cf0d774e7656cbb5e658fbc

SHA512
453e858decb866fef88b2db22de3c2a804beb400233b606801096704c473661a06357577b9bc754994018894a1d4d347524ea2bd58fa83e74aa8b6fe842d5676

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD7EA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE047.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit