debe6a33435d1af3ced9b84d73311e0f250d3e2ce76331a5211a9445d0d6f50b

Analysis

max time kernel
133s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa4d53ebe45cdeec6c595863d0488a01_JaffaCakes118.html
Size

461KB
MD5

fa4d53ebe45cdeec6c595863d0488a01
SHA1

ec142168266080bfc14b81a97efee4ebb0b94967
SHA256

debe6a33435d1af3ced9b84d73311e0f250d3e2ce76331a5211a9445d0d6f50b
SHA512

b893c9af7bdf649617ced20c0181949d4020b6d9c8ed371378fa4da6d2ace5660683414a71b77721d52533e0b9fd8895c653b74aa4bbec3badc79bcd9d4bf586
SSDEEP

6144:SUsMYod+X3oI+YSsMYod+X3oI+Y4PsMYod+X3oI+YLsMYod+X3oI+YQ:b5d+X3q5d+X3w5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000001f783af203035c204b67aec842502884677da9b39a99e48ea0fabb4f942e8b1d000000000e80000000020000200000002cf0147aaa7963592fa61bd4e43a08ac3050f20d28c36e679dbf658e1d4abd4120000000e6904e18b3bbd78114f24c8533ebab688886d3822472078f3dbcb433688849a840000000f62d4770a95bb3eabf3331adde0271d5632378a20efd129bae51f84341755791b641b2a21ab2b83abf1e8e29eb62811ab3663f0d4aa26169af482f0e90c7b3cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000fb6a577ef75ca0b5919431ef3c5791e54671a8a54393ce8ab01ae4847512c881000000000e80000000020000200000008c13ad98be6e965cebd05af24dd4f588c74810788513e49e34aaaecf034b05cf900000006ecb5afcb69f85212204f58f9addaaf0298df52a6712c40a32b4597f2ba9265a8a56d8d39ee5c69ed00fe6c1faa9d198aa8eee21e4cb997d9d0a054f2861cde13a422ae103827e20fda43776000dada63b0ca50e2c3372496422c7bfd82bfb16b2e5ffefe4cda27562dd8b6c12942eea9a594c141c6007cb431ec5945c33fbd2c5e53bc996953a4710fa6739270734334000000031b807fded0c30a4e2a4d8d95f621f95559d28f124cb360649c2b7bf7a07027eab27ff62b50c138e8bc459268369064d0a48e589a1ab62b6da82de2a8d4a4c04	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433597373"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48BEAA11-7CC1-11EF-8D81-C28ADB222BBA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f75321ce10db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2772	2264	iexplore.exe	30
PID 2264 wrote to memory of 2772	2264	iexplore.exe	30
PID 2264 wrote to memory of 2772	2264	iexplore.exe	30
PID 2264 wrote to memory of 2772	2264	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa4d53ebe45cdeec6c595863d0488a01_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcf959a077f36adc2818cf553cbe3243

SHA1
8e90ab801e2f6546acba5b51a1b6c996c2d78d39

SHA256
9b2e15aa4d02b43cdae1a3cafdfe7de69488394abbd6880497475cea81d28af2

SHA512
b77d85457fec2b82ad65cd97564a60bd16f5e204ec98678403db1f145937df5492cc80e1e61b415f5541acbfa8017ee8b2ff05b2c42c304cd7cde0043e606ce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f92aadff1ce4630643344ad8b3fda9b7

SHA1
a67db7cbd55064e28dae77581281455cf9f4a9e9

SHA256
2bb4925c5fad58b5e640d45470cffa4bb93464f6e221f0c78376dbaaf3bf241a

SHA512
7120f85ff37d99590ef3fb64a90c4c5454bd94dbf492ba30b9813ac50d7f0e3f2afd664d90b6485a55386cb7c473a4bf0e7c4c96b2c2e61263b8e55a5041cbd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f4d5de1083047b4984b46f633810196

SHA1
de3af03bd8e86ae637178e466b14c344ae48aeee

SHA256
7ba77b126c8837bf471d6677d64c8d184160b2c027541bdb9d9d22831906ffc8

SHA512
2e450232999eb7d594ad1487bb4affb875ac826165be3de73a0fa338d20b2af4cf8b66c215e0c4a4ab9674fe8629dae66df81d5edfa6d5914ba9f65298599abb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
595477729a7e8fc3d82f242c6df23b06

SHA1
b92b36397e305367d8899bdc36d3548eb722ba86

SHA256
255f454949cb57e2465c9fa9615a13aef276354fc8364889d94d5f2dffecfdf6

SHA512
fac0780339b29880c18c47a6af9931f61f244687b480c1229edda60e5072a3c2117604feae4da416010a4cd088286b669758b536e7f4ab17ee8b39d899fa27c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef2067f23bbd7aeaa6a034ceba5b46a9

SHA1
114a0d8807bfd72fedf87981999325e92c078fb2

SHA256
e783a257b4f2825e4af2381b64f63b1c1e2fcb63e74586e566151e5787c5f827

SHA512
8c413934f89dc9165f8a973636e18de527b7d89788e913580614bb527b4906ec07f91cbccbed8dbdbc3c97bd284765d04cbf9a47fd3e4363db67f09ef760acee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bca0aba6c71751ba922de5a3f38cdbaa

SHA1
bc2174b454a2c09176dce3ea63f7fbd5ad0be291

SHA256
e495477500c52b9e6f5a1e6dfe4274a76b4dd064cfec0b2089b5804c480ce41f

SHA512
a4bc2ecfce4caa4db2b96d4d74ffbb08ed78744fcf26abdfbbfde99823d72415a4bcf9a4e3031e290a9f5c348eea6023f7035f994e12e39dfdc8bf5640d58623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99f91f5062aed508c9d528b4491d21db

SHA1
8f299a2a6c1ecc3100f24897aa7f94452cae94e9

SHA256
b91b1cf5e66c81fb8fddc84ef8dc4bf7509dca0b67cbe3af5ae73cc49692f08a

SHA512
494864656932a8264b932c5afbf912f563f339ccef35687c0f3e04210c64616ce8132445efcf8d7589866ce70c2598c268e547b68729f8453c4783a2c5540d93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4a271ef573d40713419e6ffb145902c

SHA1
a4173214aced07ad8141cc452d5a22259dd16a7f

SHA256
cfcfe8a63c5431f0e8882f2889a669c78398c665ab216c8d0c04253a682c9c9c

SHA512
faf0199325fef576a4c8f05f395c609ba07a0a6c66002fe90ee15fd2e8e6604a935b7ec411ae9758351ec8416473b55b22bee9a6384213c084d69447449507b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fb1e4a2ad5c833e4ecd38cb2a998801

SHA1
82c915bc7994426a316fafbfebb1f0a275940864

SHA256
9e90aaf5639d6cfa7302aab26416f3a2b5aee1609e51ecc5883f1410665f61c2

SHA512
54ec127bca512b230d19c66986697fed3e00ecf58df882e9432ac172435302f26f70b979ddf17bfcf207b89035bf45888f7307377715614477c3674a7d55a946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
507ed8fc74357e1783a1fa586b9541f8

SHA1
125261503e1d276daa794f5c24c7f394f93fc59b

SHA256
bfbf213aef91de876a240c4940a1b5884a844c9b55a711697c51299d85acf78e

SHA512
c5c6a033b068289eeeac2b4077bdeabde818dfda1580edbfd0f79a4748bb5711bd8aa116eb10457827413fb6e875dff2470d76c48cddfed6b7c7a60a4bc8ded9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b61d5e514ea97ae9efe6ab744ca1301

SHA1
2ee7071bac7010f07429b7d81e5c0e41f2b36f0e

SHA256
641b7876025e168bbc31e92c3182c0b871783f9dacc6e3604b0c6a4618dfa91b

SHA512
7fa8aa598f159996578f140e7fab6e5bdefcf923b790665d6570fb31fed63ee48992c6a34bfcd1c641a02b7cb85d0dd393dab5a5248cd3b786dd9ef953b28a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21cf6bc0c1fde5adc794f8d3208e2958

SHA1
9690ccd743d2a77638624c3420cb195a590fc092

SHA256
0645b6a620717c89163b167614c5a794d35ef9bda54031650516b1e638d38071

SHA512
5a2290ad2d117c538b9dd8cf1a10693f057bbe992fddc50ec376f8b9d7050165a1c6d576f80a7e39dcf545c9414630f7b8c2123879aa5769d50d729899da2098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c944af65b2f118f7d44b53f2fa170143

SHA1
3d4b923f687d60aa3e2d5c2b821ddeef3ab55187

SHA256
bc9d43cf4951e94d62555aed793786b9cee3d6d3f51a0ea15dbb319d6e59fa2c

SHA512
f461300a602d940cedc619c6a5d259915b31d1365dfb4a22c0186fcb65c97b41be17d42456e4498e839316b9595abb1437ec65c86f00f1b99aea155b54a0536e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb032115f11873125bf3ab4118342b97

SHA1
6ab8b4771300fd3191f54975db91cd19db07b29a

SHA256
595bc5c51eeba23a7042b8d99af2331e11e292be6d097b639822c8fd281e4bb1

SHA512
949e8c329c9e9f33f167f06b663e64981b700253f5b30949394e6f08817cbd48fd7fdb4f75fe71066761af32592155777257b9291daf1ba18696f7bfbb498dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a32b880875cdede7929c35d345c0441c

SHA1
4cb26372ea13a56c9a0e44234642b5f09132d93f

SHA256
c4d9fd9224a6ed5bc60c0259ba67921e62071facca07f85c8819dfb340b6b6e9

SHA512
fe76259ef6765f6d06422d012065e695be825a381d7672f7b7b45584602b3de822c8d9a35635ef962893f1f922a57f4fc25288d9cb5e583a4904679cca3adf09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab260A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar266B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit