422e0a2f5a9770e0d56181f9c1c6f6289395fa0d35f8b10999ca36d9671b35d7

Analysis

max time kernel
66s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa483bd765dbde0c714064f01ab9fceb_JaffaCakes118.html
Size

27KB
MD5

fa483bd765dbde0c714064f01ab9fceb
SHA1

960b565c7a7f797b4a53495d0a78a3ed04d388b4
SHA256

422e0a2f5a9770e0d56181f9c1c6f6289395fa0d35f8b10999ca36d9671b35d7
SHA512

2b2b89903324080f55ce8dc873b6e0e6e94eda37a745a23fc8460f333ca6df25e3da16fea5a06b0a7c6a0bd1663ecf5a43f06dd5481615fa69e60a9131d59938
SSDEEP

192:uq6rQNjQROX4mUCVb5nvE1T5J6SgWWt40vnQjxn5Q/ZpnQiedQNn5ZZnQOkEntb+:nCQ/aygcawkn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433596590"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7600F251-7CBF-11EF-9AE5-CA26F3F7E98A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000ea7dcc29f674b7d6a66fd9836e4a0bfbd8d0ae59382a39e18fcd4a2a85215dbc000000000e80000000020000200000002875c40a29b7bdf1c0021b733e44ca28d700c10c8f7f6acae744d57051d8ecf7900000000171c4e0843d94cbf01a655ff35cd71693dbb6ae64082b3c5c7b3851efafa75f9e73e967ac7f5a6320357e19807a37971cdc50a26637a9c6e3d7ed15be9a005c3fe6367c5b82994063694bf2604302ee60aa845e4d9fd558eb892d3081d302fcd130803e1f004212315a628db94e831aa82547a4e54c9e38832625f1108f9ebada8c86882e5c65829f2f1f215cbf297c4000000097a9e2c7a870ac38c424c228aedadf80dcbe039f4f9f0340ee61fe5ed7538fa812cea3d6af8b0524ce4bb462e77ca4860c73b9cd90754c7272b67b2937ce3d1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000a9a31b080b4c71207c097860b7ed9d4b01ee1c2cbcf1bfa9b03574c73b001193000000000e800000000200002000000002a5f31a0646d0d0680a3c1ee6031cc121264659c61ca8da3226078e89fd7352200000006de9edb07bcef0d9fd480953f15fdfb8e10f1c39a5ef63336e92398753201bd8400000007b9b880b81e3e1a81c13499af2b15684c752708e0c42417e263f75479d8e4beb6ed3d7d10141b1924c3f23e51c2cc74f2c232268b2cfd8e6cbfe77c9508c0cc9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0026664bcc10db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1768	iexplore.exe
1768	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2428	1768	iexplore.exe	30
PID 1768 wrote to memory of 2428	1768	iexplore.exe	30
PID 1768 wrote to memory of 2428	1768	iexplore.exe	30
PID 1768 wrote to memory of 2428	1768	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa483bd765dbde0c714064f01ab9fceb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a58227dfc1fc91cdcca52c4f1504782

SHA1
89bde6791b5817a474dac63ef268e4d652598bf6

SHA256
39739214ccc28c5eb8e87233a355e90564c8fc7559db0e1d88cc1b4137ef1503

SHA512
8139f655577a5171c3a2cd4b145ba871fc73989e2cd4a4344f7cdb1b360eb9cd57fa1337176d9aa572e1af165fa30747da6ef12ac757fbf0ac914fa3a3baa1bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
551239486d4bb2074fe01b13b34573a4

SHA1
e832ce3f348e8d76be29224cb9fb69cbe809d382

SHA256
f78dd96a4195bf8e72472f5e5f57fca91377023bab1eaff4a7b76ddc5db82444

SHA512
29b78d5be2392aef907e7e4c642d8cbb7795dca7dc1815c71c0e1de4fd7f6121f9594d52247f948cb92af39cd355d8b7a4435be4093a75c3774f274cbec2eac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
297b19b5459047d0af68e4e2d01e3e7c

SHA1
9ccb8b3fd4a0c8f2222488600f0bbd1fdd38660d

SHA256
6697eba0fc67e7eca7342879ecc1ca4c877e8217221afdf523578864acefba5d

SHA512
70bd1bad41db6f8dc6f659fd0b14e1620050e7dfe0c3d4e458ef794aa4cfe7068c6b29c16dc4dd98679684f117418648b6a8edb522d494c46ce960e18b3b6f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1142e62c91a1b40a9166d73aa2c5dd28

SHA1
fcbd221937b96c88ece31d2191887b50edaa49da

SHA256
f2b2f1194b03e642c7f926fabd5cd6614bf8b2aadcdf546e17c0ef16f959cd46

SHA512
69c647821c1eb88534a960de45a4856ec1ac87990aae3eb4ffa030bc1fee577cab32cef0fa8feae53dbebc118012d984ef4d5cdf241d8e6438453ed32d8002e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3649f599eab7a9dbd77525d8d0cf8f6

SHA1
38e87fb7f482d2d365b0e3049f1a8ca78c0f3540

SHA256
d9feaa0d0aefeb6a9e37733f5dd5fb5167b9a063a3fccb1f72582e132c71c0c9

SHA512
6fcc1e09adae9e5a981a37fdb5f110f9215341567f25aefbf7a4b8c36a696e7700ed7510a84fb24536d8940c8ad9323f578e1233d68af27b23e3cc93815273cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc9c34a5342503da9c61cbef7df1bd17

SHA1
32b932d1b7821184c09a4c260787225dd9c583e5

SHA256
22b5f3d32f291ede9b72db25bf82551c18f103b61f187742f04ab9566654e9e6

SHA512
4c6343dfe7545ccf6334afade043f044594c1ed9496d8b413ae42c1affa1219dfa2153ff6d142e6d3f4d93860485238b1898e9cfe48fe62ac7860159f9d67c6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f9c869712538edd7df6ffd830e70f08

SHA1
6f912eb038207137bc76cc7d85488cdd261828c2

SHA256
bfdb2295d7d1196bbfb75aa472f9f48b942b7538425686d5d52a37d3a2102304

SHA512
bd1a6c3a5b2edb7d093ccbfada9412e68a989d347d94e0e67daab366f582dd82a33e1b7e4a36e0e2130ad9425a35493be54c080890dbb619b78acf5c0ead06b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87fcbaef42bf8e5d8193e0734a3d856c

SHA1
62fc0934e64ad1621926d4c96cceea6c66175eab

SHA256
2ba3dab6b3ca3406a49a3443604e4a3cc917f2767afa50cd63446cc7941348be

SHA512
5c5ae6bb7691416892287b65bd2673742b49510a008dd8828ca1d25c270a64a0f2bc2392036629959fc468c9b0bf5ab5d60f9bed5968004876dacb9bafd4ac01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b26a7ba66fa6a1fa3b79f3c705f8492

SHA1
254103d197e8838b367691ed7d7b256e10e68cea

SHA256
b839663826c301a64d3250095e2eb659a96473050887f2e7172c486a5eda38a2

SHA512
7c00bdd3d157b62709bff064bceb99e00335c77b401001f4a1a2e7a8d4fa1ff5583c9a6c58144366ba3ddf8ba4929a4998cd4cc54a20662a324c92f7fb575695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34e65e882e5eda82fb5b97616f2fd259

SHA1
2a8fee8297cadc1db2d66f5518a9aa68d5ff1429

SHA256
9a28ade8b849be094c11b06cad7fad77845b3d5be314f0b5314ec2de97d5706a

SHA512
9b044aee49eef0538b0122dae5da68f74b24968e0a82db505829a4004bddb9d6b0a7e1c402626735e224d8edaf25f4bd27b4a406a33d0860d9ef89cdef31cfeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1103042ab83a2da7a9023ef1f43556b2

SHA1
f1e6ddfc98b847cba14ac3d11e5062251d8c62b5

SHA256
b0bee5fb76506defdae074a656b5cb65aa30967bc7720908f3db7cbc1c97ab00

SHA512
6c190f2af038d39714dfffdac962679c57b454961941874522a341800b8cd766f8b5dae22735c9e51469210cfa5386681b20961a8f53999e2c4ee2d399567c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD359.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDBD4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit