b1f621b1c261a3ed8f3dd0ce30500724149024eddd22f5b5834008178fca6dfc

Analysis

max time kernel
137s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb142ee6732070371e002d364f9c2237_JaffaCakes118.html
Size

15KB
MD5

fb142ee6732070371e002d364f9c2237
SHA1

9f1d797c626ecfb6df8d78c6337da9b89feb88c7
SHA256

b1f621b1c261a3ed8f3dd0ce30500724149024eddd22f5b5834008178fca6dfc
SHA512

6e0080532b4abb2c8ed1ba1f1ff224063175e45b3ef221d4ef2ada83ead893227805e959895b10e477b48d4e35756a967761aebcf2802028dd7a64dd4ee9f35a
SSDEEP

192:M3tW+CVzcB66edKLIqw1LI+DwUrdEP74MspUzq9nx0jJZxT:EUVAB6qLIqw1LBUUaP74yq9nx09ZxT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000064ac4965a8be317dca1fc90697ab307b9e980971eea7b7b5b157499ec019f89a000000000e8000000002000020000000a430bb516bb9026e911e63a79c1354db0f14bca272557a916117300837f71d4520000000b1cf8c07bc4c7e6b689814bded3878b90b77d0b90f0ddaca31dd32c2aab4d792400000005d741e98e90ff7c24bd29a93487d42d62beadbd5f603ca7869cd1af57973a523907ad0a41cd82cb28dbc6f18a06373e2e01c5ced252c59b6186cd1b68a7ec863	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000095dbefa5b41a1c6b8b6e24e4d045d7bd3aefcaba91a4365f80d5fc09e1de03ff000000000e80000000020000200000009695362a3906ad78a6f66c2a663d59d0b5ad91ceca639ce59f1164babb0af0ae9000000041a3d2b393461afeb646d386778a49027833a457149f1bd6e09164eb43c3cdaa3751ea6c5632b9a345f73ccf21101dfc6d8df30056fc6db32f271eb5830303c9a7b031df68cd58c1a207fda3469e16749c937a04b586353226e01c29cb44367d9c4dec7f97a24d47f31c1d6fad3f5e8bb87e8cfeee9fddf28ea4d94859325e95d051f166a6d4b066c8240ce6edc8434b40000000a3c88b413e925118b8d9ee75f2a50e30e9cbc228c18479bac5b4284492183d9b6d7cb6e16b46ea4768846903d896e6dac7a8a0f81ef5abc1aa91c145262ae090	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{474B7721-7D26-11EF-A7B7-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502f3a203311db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433640750"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2636	2108	iexplore.exe	30
PID 2108 wrote to memory of 2636	2108	iexplore.exe	30
PID 2108 wrote to memory of 2636	2108	iexplore.exe	30
PID 2108 wrote to memory of 2636	2108	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb142ee6732070371e002d364f9c2237_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e080c1536e35a87ac31537838f939162

SHA1
49e1fbea15649664604c6e5e7b615840f4f499a5

SHA256
adcc5220744a85a89b0ac89b585eda85894ff4087ecc5738035e3ded9a27bfa5

SHA512
36f4a532475c245bd07982b21fc2f45887f331343a543919a71f6285e7ba217919339f27f33b55e979db583960a539c2ab3f32c8c82d48534d432e6b1ba8e74d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6de511a587f86705a4846c6b876360c8

SHA1
0b526241a4fa935270561a927d771935cf8e62e1

SHA256
6e93d33ee36d4eaeacf6ff2afc698b1b4e6cc80eaf066b0602076414a1c7b958

SHA512
0aa527a649bc467fe976b82cb4e09d4632eb069d1e7a1b909f6966e2b06b6af48a749618803008a3ca1e15ed4e6615f4c67943aa66056b742c408ec4c4f7e72c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ab0ad70e3ff1354d315fed129067a20

SHA1
0fa67747c6ab30a604e355f2dcb2d49066f90418

SHA256
3cc473e09d851d67f101ee8c61234dae518b18c82c20be2c59f207a7c491a865

SHA512
3f7df253d85648f61b37a56e4b6d82bac9d4998281057294998ea6e560d426f6112d61b64a9cbfd0c973ce97c92b465eba2db8b1793fce599a76debc06a283ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
121e601c6de6c44a6c7b7c6db22dd0d8

SHA1
680c528824ac4e7c4edcf675f4a557510f9763c4

SHA256
d09143929f7f31c4b828eebdeb1a72a2e18e02cc196b86f5d2026fb65ede6b51

SHA512
0ec2d6b343a4b2f94cf57af9bcd7fbc76800d5b52a077c44f5bbffdefa5f8b9a166c0ea5a1a4afa8eb7a7bd22c0ec8db0ec0c0afc5fdf757245691807a7526aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6f92bee055bf4f87b2523c4a68736ae

SHA1
1be7f5957ef1d6003b1fdcb5399f622670229eb3

SHA256
58b02f70c7c1a98cab56b432cd33e53beb3814d193e738a18f8103f906d48d81

SHA512
b956cb94c7cbf23f308b55aab26b72fb475a9a38ec45eb1a1482b3612713b5247958e0f84b8dacd86c398973b20d4f2918f8d1f1efb1a24605fe3f046e6bc994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbe1fe1c3cc4d9321ef0e78ce854cda9

SHA1
b8efb35ade03b9267f2b945328635a7232808835

SHA256
751c58a77366ee0278dacf11f0a7ebb6d5a64ce34af607173f2fd83e2b580cb5

SHA512
0c198cb17457492d8682ec6739a3debf2f84f5a75fce831503625f65b1ab404754f666149aae83bccbc463de0264716c2455650d1e00fe06583c8b4f8f7b8751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bda92fed0140a8853b04054b2b995391

SHA1
abcc15a864ac7e316a4a3889ad232ccf4c0b7ef5

SHA256
3cf1e9a02061b1b87b3afa5cc6744284800714a2d1f424f76055cf7ca8d69b2a

SHA512
b0caaafc45fb441cdab3573c2d74eab05efbcbd31510c7273f147b91b3f98e92c5ec4cc285ab102d224e0f1b3f51ea21318aed7df2cd93f9bc670381d569fa5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ac177f43d3c3ab3f81aa1e56aa8d943

SHA1
df61829be2d0fc52c51f4326ff85017bb530fff1

SHA256
5aff165953a902d1e05cf7880fed556a8d31cc4d618925f20191aa0abd468617

SHA512
f03122653b73ae762abe0bbcfd48376ad7fe5b73cc88d04b1d8364f1ecf54d2879a10e64864377629df49937e40aa7c6f6548db4051c33ba0fedc61a96bb2c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a27061044ecc51ea1d84339c9f8ba29a

SHA1
6f3646503862fae4457b73c31a39d7a8d5e25266

SHA256
6065122fd348c480e686779e6842eb5f894554848e27b2c3b48c8b1e64082270

SHA512
2437fa224a97faac2268368e85f78d01455d4fc4faf959452790e4d392788591b99deb03155e117e701d0e54c8e2ceb55cac180f589ee97e8174d5c6e04b458d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d3c2b011495ea016c0977973181d1f9

SHA1
970bf9cd503f51a81ee189d4c69f11a6b6750446

SHA256
02d9ded611642fbdb5f1948e4423812b5472a07ff7edf1bbdebc582d6bbeeb62

SHA512
491ac311a3d7dfe7d6f95a0ecac147cb118de12f30a67442066ae1f5f0fb8d158978cb08e702cd042d919283223d62652aa65d9c4581b59fb659f7d8eeb82952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8bf0592c675a67bd8e41bda12b19b79

SHA1
1b63f44b2231e5c8f0df31ce47dd8fe7d4667321

SHA256
8de0898b064340ba77dd95d95df21f70b16975f49b3137d976be902160a84242

SHA512
2de5e7607d3ed0b31f4a7c68b254f87d1fd156d21175bd084d9d7e94e911dfdf263564433d2a79a2c20786cb9e647ecef8dcf1d269d2d03c49393e62f9faf091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2e57c062bae77675aeee81a9668dbab

SHA1
ad109fb04ee63a960da31d498e36658dc0fca791

SHA256
44e1646ede97d2c3a21cd24d6bcb52eb9a32b34bbf85afa46434cb00b179af83

SHA512
b79ae411da25e967d610e0ce9f68c0bc907e03dbfa3af2a24ad65fa29dc180f612d8df64f72cd08ae45e3a3d1fe35a8105ab5b8c0ad3d948591098232015b38b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4544243284a9c46e32ea2b14da598a7

SHA1
176e9f4fd2f4d70235f252698aed0846d83fe41b

SHA256
9ac0aaa50764cc42aadfdf7e2029eb35249ac7d01ae08122dd1a23c2edd02bd8

SHA512
6583e62bce7d11e48ceb223b91cf98ad5dc9fc6104166f7d322848c9df6f3de8eb39af9691a1beb54e385d3a635a781f10ea4d7ab758b5d8d2cd2f397abcc280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e13a778d5480959a6dd9226fd291b910

SHA1
7e1100122dee25045c8825c1849d0186aff61bce

SHA256
3a020cf48096a584ffe7bba5ce7af26a3e8c14983de0b32acd5e48255ad917bb

SHA512
f946199a45be4f4de592ba5f463e0de77affb70d9b8fa3776f336e7160f9e367dfd5d915ee4819886148c6a500bce76ad9985eb00f2875c020e24dff892f94c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39626aa4bd6d9c0eabde7b99ad848b4b

SHA1
e97a34135e0e432bb0de4e1d36afe57032c69eca

SHA256
67a6b4f201c4f39ba87d8e84511f49e5fc3af0ea1fd8dcba11245aeda387dcfd

SHA512
6c591392802d692b574ac869c57cb16f442750a0aa30fa8df7498924b85615431c67b91832b2395cb674bda48cc5e5156351439e068b3b04a6d6240a843a08e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE10E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE1FB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit