3d4a342b5f32247a2810d8f78899374cad0450a2b63bc9543e0f162974b56196

Analysis

max time kernel
118s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb14473e9965030b72ce386fc0672ce1_JaffaCakes118.html
Size

20KB
MD5

fb14473e9965030b72ce386fc0672ce1
SHA1

f336f8df528d8d962d8db98695c61781fef77b00
SHA256

3d4a342b5f32247a2810d8f78899374cad0450a2b63bc9543e0f162974b56196
SHA512

0a66d55e112c1913e56b0e79af4e902f7fea896237f6d1b351deda1bb6e856d8f0789e4c9c8fc6ad9d0f662de8269b3cfbee5e9b01069a781b52d02a393b154d
SSDEEP

384:tTUDe9nPwLVajAE6q8Sv8V88J2WfesOYHumSmTm9mhm8ZmPmhm8FG8R1bDzfvacM:8fSEu8wj+6mjZmKjFPLbjxlLewzh6OLM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000009ebe6a4d99438cd0082b9247f83b51ce068084dbdd1ce6fff35942ffd482748e000000000e800000000200002000000048a82d43968f912a2e51f1fd37bcdc0f606484b803cbfe9085c35db067c078672000000099e2e681b99e0a5ebbcb93c745f1a01fc3c665028c5fe6d5cb99880bbf04cc22400000008680d50338340a67a3af9e68906828cf764b324ccd7eef19b291ad63b328b2bc953b291993247f65a5db92493ab4fb85e1594c81b9c5adc401e09bf224dcd0e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000ec79d8c765045c53a71cb1d012fd0e6fdaa9c2b352ce056b9f0b1a72fa515d15000000000e800000000200002000000032a1bb8e5168271b69500a41397b48f2e77d586ccc808eb423212cb131f5b2a590000000355d4bb157fa5d951dfb511e02591fa7951ea25b609a9b7fda96b796d3d1241cd200648e125e2a1d3e356f291f5c3d911729434b01c3c97babe3d1aedfa8f2dde937a83cba5c88cd1fc74c7ec97669b1fabb922c2f382071a564f50661189754427fa6e02e026dc4605178f2461177ebe6c6367d6484f36a23c3c8944c6be3176d83722d596cd280321d41a4a924799140000000540f27252f18e6991b5f8a705e659212cd42201238fc5c8318fcbac5b77997731002a25331b06159f555284c3857cb26b2106d56bb0de9c51f9f17bf18024f39	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433640779"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70eef93f3311db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5115D7F1-7D26-11EF-90A9-D60C98DC526F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2704	2068	iexplore.exe	30
PID 2068 wrote to memory of 2704	2068	iexplore.exe	30
PID 2068 wrote to memory of 2704	2068	iexplore.exe	30
PID 2068 wrote to memory of 2704	2068	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb14473e9965030b72ce386fc0672ce1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d3fa301a4802d96aee58e2694bd2961

SHA1
d44d619e269d76dd38f07a540509aad6defe2d29

SHA256
3275b70dd317d09e8cf49164b0fa2f66633d3825b5c27e038530c5c6d948c296

SHA512
3ade5a74139349c94097af3f9e33f76565eb77b8c13f0ea51caa07498f915de1acf7e9debcdb959a9b28e292c794d0c91c8a84b93e0865174470bf99ad57f434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d54bdc21dc621119d14b5ed4526b5f8

SHA1
30bad5cd253423072660d484a3f1437948c17fa2

SHA256
b24668c9415ecd648b999a8fd48369041f54b74766c9b57ea5facb8eb0ea4ca8

SHA512
7d104e160c4756f216df6a8550f7c9117c8c9dbc8e63bfa77e125130a607a964d52034bf09c2a63b9a184aec25cd4c13a7893833781301c658cfd945d3d78bff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
673cad2afb73d8a32893629441e03bea

SHA1
604a7a65603f7353c28b64a0687d83feb80ab711

SHA256
6ebfcf0e9b3f8098f79a0d14559e50216245e4cf1b58385a869bf87352201392

SHA512
3d36197b133f3eee997afb953b15c20720de23ff9d65ebbc586286d736bac24d4f5bc1e0cfd6bc50f2b3732432dab6c7d55126cf089a3d1475428e23ffc9a545

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6a7818c0a3cfba081581e9c29e7daff

SHA1
b97550063ba0626ea0b93e3d9bdeca9953363888

SHA256
c861ceca9cd66c2b4e396f2f803a41b54014b6a115ba1a5ebc718225a2acb77a

SHA512
3b908f87a2b592a3614dae4245617f8ec7f9ec7badae5e74d2ea5fb66f1694dbe1fcb54bf895117abf1b12d3f25e4e3928416927af2ea8157964c8443521cf37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
167384d7719762ab420b894c490cfd21

SHA1
17ccad4bb578133fec21570c408bed87535589f1

SHA256
ca5f519e5a9d5727effeb8e53b081084a33bc0f017eaecb573eb793a7f2c7356

SHA512
7e83df64a1a4406a21b2b06d019d0ddc3402dd53d03ea1c9555af26a18372fe7ecbd8d9761e994510231960bc3579e627748d80d9dc377946abdce100f12d50b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8db9ef62951286a3b42cc587c946824d

SHA1
c30f2ce60b54e3fc33bbff8ab3cc5a5f52e9d05e

SHA256
fc28a829731913facbed2f9ca4599da3d38dad44bbbd45f66804735ced74a9fe

SHA512
41f8c6542bfe8a418bf8d1ff5466025d1814204afd09a82330b2b61de8ec0870a9c8189175e471bb9d4d13bcd0bb16ff53b5c2fa8b6ce3c4d1b1ccc8dd25af51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1075f294458d7b7606e5bb65722a0564

SHA1
017b168ddfd05564f97e409c673b486f4180f9cb

SHA256
571d5cdbefec8d69e9755207c371faa5c11b3c303b93f1c3a58a16b05d5f7154

SHA512
1007747406198ed733ec4b033fbcc9b924bef44a987ce1b0e623ed207a13c9770bbf38c7bad3c4e9d4ae41b039673f2a1792bd5d9e6cb01e559efd432181ebc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85a080d8a127111e1b5150465cc35511

SHA1
34c27e3929f243087c1ef6f691dc71ac85304f6f

SHA256
8b8f6603438bf7ce15fad49eed092df912282d5826c50560d55f9af553929a0b

SHA512
9de0257acd99f51b455f76284f6745739b65a8ebe41b32d6ec28612e6ce1f2c9e399982d3a3eddd165213deaf50730a08c4c62d54091a0bf0edf7076da65ce83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
165656317eaf8f1a20a6935da2ec2a0d

SHA1
ab0d1421bfc2ed2b192983f3561f79f3676c3d50

SHA256
4783733415a03cf01d325b4332b705c5cc15817eec149713f44db016f68355a0

SHA512
a0f8de8f9d31ba1a9a484cb78a1e72b8fa8ee6faf023dcf57ce60e66e0e5ef225f46bca20ad8d79ab5b351fd2234de6f0c530751afd1f3a1cc5a09169b8279b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b5efef25be0d295911c7ace1ff85689

SHA1
63c9b3a00f3f1d50a97e899ad8e72948943fbb4b

SHA256
f7d00ede85671efc13116842bcd544b6115b87cc589abc3feb08e71a109b83b0

SHA512
93091f611cd895e804e39bee4623b51edae97a73495c7d5f9f6292d090d1ad2190e284b29829b14befff57173070edf7301c39dced61aa92ac70df7a817b4cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cde5bf90c877af599b9e16276ba898ec

SHA1
5f60b1501ea23e7af78b63241d1de6af5f61a99e

SHA256
7afd5b78bdb232b1ef3ae1473149f7c1c4ff15c33e4a13a98b0e2c718a838548

SHA512
f61875e6bfdbf280e32d30c08606daab3a55fc09c6ed1121e996c2350f5d802d12050ffa3079a25b476079914278c22ba59006b3c6656e0cf4f270d4a16abb9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d8fc0e2d14071d6b856cf81f269945e

SHA1
dbf0755a278e98876715aae6ff6267057880e837

SHA256
b0587bf12caed661ba93ac856511dcdda5eb4b6f405f8874ab9153ac5ef9b2dd

SHA512
30be72807151c4dfc602fa90fe3e760e5bc318a40f758c1c3d7ca6977076b1b23657fc7679d3c3af9a84d96ffa6b5b4cf5333bb45af6a4d54a433089aab3d9bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9df8d5bc21189a7ca23f5b30b22dbfde

SHA1
8fd64409f9494e4f1dedfd2a607019fe9f2c9ade

SHA256
59d9ebca92a9fee6cb9d8300f3e521d53cdc5c9f5199dfebdd47fbdbf011de92

SHA512
a824c0dadef7dce096bdcb3a11f81ea830c10dbb80279ddb4833ca9ed26f5d9bea6aa98a9db3566563b5c96b5a589e12ceaf6aa1cf0d1050139d623290b11f86

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCD4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD44.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit