5443c431993c8bbd08110b48d3efdcd098c6e95d6638f328e5550b03531936c1

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb004b16020c799e17a570fa298cc031_JaffaCakes118.html
Size

213KB
MD5

fb004b16020c799e17a570fa298cc031
SHA1

b2b9178b6f6c7de58bfc99193920d0f280067efb
SHA256

5443c431993c8bbd08110b48d3efdcd098c6e95d6638f328e5550b03531936c1
SHA512

2f208abcf9777a7d688aaf48433a1f3f6d1b0ac3482c3800a25edf6a16e2b8461c61321669235a008577621af7fd517efb7288b141e5b34a149d175e5d64a127
SSDEEP

3072:SvRK5qWeNtlXyfkMY+BES09JXAnyrZalI+YQ:Sv3RisMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433637342"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5826DEC1-7D1E-11EF-83AF-F2DF7204BD4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2668	iexplore.exe
2668	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2824	2668	iexplore.exe	31
PID 2668 wrote to memory of 2824	2668	iexplore.exe	31
PID 2668 wrote to memory of 2824	2668	iexplore.exe	31
PID 2668 wrote to memory of 2824	2668	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb004b16020c799e17a570fa298cc031_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
749c092b127236bd7ca71e2c6b6e5fa1

SHA1
98183570d8a09847d4337f45dbfe9298b39c6e55

SHA256
bc3c4c94289dec4960b12d8653cc19092f0288ff2c97d4e52ea8adc3abd1cbdf

SHA512
628183c73a0b8af20c552256da708d2ed0b7ae4e5035cae5639165608a0b45f454e7d6b90ef15a1c9beb1ab9011f264164e90b2b1743868df592391d0e6c44d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
880e98e0f412b888815785db65db33c6

SHA1
98eea6336734ea70a15c2e3287ac93787082253f

SHA256
8ff43c538329850a6e18a53e64a6fb9fc7ecdaae85bb47e2a14305c9b24e8e5f

SHA512
487426f84ed20301cebed4babb57bac2dd67259179d2c538e58b2081c4831f570c83e683de95af8666d29922042ba185f37e93d5beab116c5da0c86dfd8ca533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f370b94f48a94e2d193f406159a8ea6

SHA1
f1bf05069619b91f8764ae524bd9987a379d2a93

SHA256
034efc6c60c1bd9560b8ecd1fc4427fd40976e294dcf9a27aa3c525b10e10eb3

SHA512
d09dd570f716ee4012a8ff8ffff80c61f6c8e4a8862258f56be52446d2df0ab140c0ad05f6f91a8e6444989f01e0f8d22aba5cd03e67a3d341c9dc72f34f973e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf0d89290112047b57002bdbeb6baee3

SHA1
e31f37cb70dc3f3276aba3f262099596721f58a4

SHA256
fc57e3b9713273da9a6910355d53797d64c07a77d962767ab163594df578b168

SHA512
3dcc3a73fd696b07376e337ae884474f79e130770e4ad4d1d56e3760861c0f027335024ebc1cb95a4cd581412ee6f034c9fe4bb16fe8d16bf0e221b276c35a9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d84d2527d5e1b1d5e891bf2e64f05d18

SHA1
1c54a45268814bc471d0915692cd516ee3aa7e85

SHA256
2b621f191ee4a8a03d966037ffa2c2d39ddf23af00bdbe9e771be55ff8a10c59

SHA512
be5d26af969219368d54d5fd09527bd6b0e55c565993cdc5bc60e94eacc2fc560ac62dce4b5012b7b789f6e1adf2a2082aec0640f09053c3557bdd259b7c9d76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6a4f95fec27b17ee75a55eddd779b20

SHA1
297f4f4c6096fcae5cd06a8d6386fd3ec581f720

SHA256
ad96b285254e9bc97c5d6052fbb19db2d2cc4b5579f870a657b300ff5e58a325

SHA512
fb21856a991a2081f617032bef9d42d0e455a83af6a13bd14ba417115396402eb16663a7817e0d6e7aa4f4ff692ee89d8ce49c63b4fe94f387ac106d1138691c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194dd5fa093c4dca25d87207906c5df6

SHA1
81e435abd4cc1e079e70db368a4e39f2bbc85416

SHA256
21580bc3710db2e6f4e008f23d1dbb7577daf51c92361e8f2a0d0392a8c8be95

SHA512
abffb372e57c5beff64ec67ac094683f95b1818b503ba8b91de1704df93bea0c4a7c54b8e591b14178653f6b1e479583f7022bb33cf800538ee7b142a4dd4c9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ba0cb8f74f3b6aaefb40fc626ccc1c5

SHA1
b413c3e59e24d1525f900140c32e443661d47f9c

SHA256
a8037651aa95e287d6f09a59a8adae123ff71d156843434f7a1725908019d58e

SHA512
0dd3b6097e9f8910b7a744753ae8331f8bfe98761a38b31a7a34a97c319712128b0a69525482fb46183d88788274226dbb5e1f22c1b94f87d1c8955dac4b42dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45dd8652572de39c3af8c9a863b7af8a

SHA1
a968ff8ab07d6ea8bc6723b0f4582f54a5029404

SHA256
926e56f3309651521f642ccabe262709832695d56d96783e9234a2ebb92f968e

SHA512
abc880d00c7121817b0f5a92de8042575f20cd5466258327e9289d21ae8e24daf5b15ceb34c9f60c9c5e5d1fb05a00c27e89305ecd8e0b2125ddbf5faa015ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3869180c0188bd81ad1d65ca6dcdb633

SHA1
9638967a06c152e5e2483506deecd703152c4df1

SHA256
25a1228a31cdf7b98c5f9fdb0d6daa884e15d49eed268266bd12cdbd596a33d4

SHA512
8e9d0cf7b40f25ade19dc8ced730d434d330c76d2b023f636d54a279d231f5f14a17639f3bcb81bd517f7a503b6ea512030a0de7981a78885c2b365f8f1b5408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c7cc4b4441d289961ffde3397d372ae

SHA1
526ba7ffc74769f6dff788a8f9554f2481edf375

SHA256
c56a88312a5d196f3c903289edb48a6fcceabe668bf5ce7bb11d49d273d631d2

SHA512
c48f0583f7f78726398159c14fd45125d50fa01ea88d60672af2e715bb121e982da56bc4e591607b6992bc02ce0f464c84b610949fb56b5d110772f0a512cc23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7684dd671377e5afeeff3d16d02a834

SHA1
9e841107dcde159ac7448c7a299e96e9e05b71a9

SHA256
f3aa2088969156da99b4fb0a6db109ce33a14c53330a6ba61a6994ce07eaccfb

SHA512
1818f4ffeeddb07a052ea811b3231866c89504f905871530018fe9b45166b1dfb62f0b49959143c73d4f24a36c6a75fa2a696d374eea69cb7dc8408bdeebdf68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8d5f68f92455b9bf695e4c7310e9112

SHA1
1592e51c0da311e0bed9e67694cc4d906f4efdd5

SHA256
a5c79b14797cca8249ce180b74206e78a84cfd39676c0adc2f59c903487d2d15

SHA512
f08dae7b8c3914fccd2e30f53f367b0871fd3ed3cdd2ae72be8a04f1835261f02bb6235786b747b88ff0fcb3776c3303598a9d7bec83cfdb33f73de28a5bebb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b103785bb9aff93bed52ccbc3353bb6c

SHA1
47411489959b541d7a386539737c98216998966c

SHA256
8f80495fb63053e07d470345109100dafbc9b6515fa6be580ffb84cbbe538e70

SHA512
fe465a59a442f882e6c45ed174aca9e2b17ccbed095ae36f4a91544d164c5e8c31a85c4dcf472e16ebec5f11076cc721a7a5d2266b3e61251f0f31473506b364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6073f7c7d77cd6ba7eb7cc56a1dc8dbc

SHA1
372de92c56ac248b81c03df6271c63150f246a69

SHA256
114a07c8d67bad79057da2e199fffb723846a27dd814501cc1b13e69568e46af

SHA512
47fc725ca2ad0a916587c438b20f17cd93caaa6b9521731eabaa2f34b525a65780197d55aea6ea96fc44cbbd2ff41cfd4775f9d3c32442b62749a88816a04405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40754149b6d1f744b484ffe75af9bcdf

SHA1
839e4126f8b00f1f09b5d2298f78d3848d45bb44

SHA256
d32f21c0e3edc93b9eb21a4cca1b933879a070a0043964e8759ab7ac313ad46d

SHA512
02022c07957a055bd7429b92591cc12793de8da25cdbcb1261921f8f1aa74881412fef8862382c9157a8c59cb0885425a0229610cf92542bcf968f9a5d96081e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a2a6286d34d63cc698105ff0d38b0aa

SHA1
92d1bb20f157b134ab9c2401168619b99535d41f

SHA256
b6306943d86ed4ebe4b27ca17b37f8d9982be784315a37f2983543ceb00acb27

SHA512
5627a8f5afd909281f2b83fb8f0ef77c1b624ee3832ccc4d75c9b0e98ddb79960fc12920078635c46b088aea3735977980e6a0e9157afffd9656396d0e3987d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a47f4f2c96ea2e4d443a7705e504de8

SHA1
47f142a6d02deb977f3ca5d46c499bb699a0d2c9

SHA256
bd9e6b5d9ea9f42b7e48608e80545dac35e56924efec0f58bc169dbbf967fa77

SHA512
35ccb07fadccfb1f9e00466b6c6c99d31c7e1023032f2416a28056b7e172ccdf19aeb9264958d3e19e4968bdf4e97c09eaa8400d797607c54420cd3f84738568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2db84a142fcc5bb009ea1ea7e49b1f8

SHA1
c6123836bf557c61380369c582dcbf0a57a820e8

SHA256
bcae9f7873a66c4a37fe819e95fe30ee02e27fab22339620c404dd6eb8fe7091

SHA512
9f0e01f46492b4a018e52d2737d80b6a01cc7f48affc285fd9cc75086b1dfac7159ef5576668be5761dee31f75441b8eae7544e7b464bdffc41d567b6143cdd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE996.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE9F7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit