1607933e2f6b5884293f73a6491ea86563d3ba854c2a9f6478f98516f5d15d80

Analysis

max time kernel
77s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa9b5ed0f8ff3ffe108ff5d01cf619a7_JaffaCakes118.html
Size

23KB
MD5

fa9b5ed0f8ff3ffe108ff5d01cf619a7
SHA1

53c222928ac74e0d24640c920ad7584427e5700f
SHA256

1607933e2f6b5884293f73a6491ea86563d3ba854c2a9f6478f98516f5d15d80
SHA512

094d10d6d35b71be11b6d7422778935bfb2109dc691563d05351d161d865f45fe4a99d35c5f67f696fcd60485dd3fc1ebc79c530a1a77432cee5cde743ae078f
SSDEEP

192:uWTAb5nhmjUnQjxn5Q/VnQie4NnqLnQOkEnt3LnQTbnRnQOCnQtawMBYqnYnQ7tq:5Q/0Vdo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433610712"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900bcd25ed10db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000d8239fd238b52849747a27b5dbbe41998ef8dde0e80372d7f247c477a54c5817000000000e8000000002000020000000c68a085171564c58eb89763e3a1a82ae5ed62cdc66ddf9080f5b4d416969b1ed900000002066ac6e7c6ba1ff2711fe53763613c0deb0cad2d3b959d7787d93ce6d307773cc98e9ed4d0a1490a9f72c5ef8c21704ae068399a8c9e554fc53be7f628dc4a94d1acf5d4ebc550d857d5150a9530469a874d962f16aef926ac5faad55539ab615bf1e0d213968b144752f68d63f2a97d44bf8b41140298bc3b62e566c8edf6be67ee05bcf8fa14a5a986829c1e26001400000001d93022956bb2db3eab6fc7c5e3e6c3761420c4deb00c392ff59bd04e88ba2fcc40dc887903cd5fbea6c6b7b492f245e42224a6349bf37d89b6f5267c9e2a8fc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50AEA4E1-7CE0-11EF-80EF-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000cec22193c0e301d606e0ceb9ad4c2da22f8a8106359a6e1f7953ca906ff1b025000000000e80000000020000200000001b4bf2822f525a5f5d482a7506f01480b9fb3d4e9a4c504369dbe8afb23e438820000000583bc2a111ee48873d95a227f3517c4aa42dc4b1fecbb306303ce7e024e9c85140000000638ffc1b24d4f4cf792dc947ff4480965fefa08987ccc93eae9e2fdf5b1998c6fdd6833c28664e16f0bbf350ff4d8e530856f09c43929d0e2e7c1d4a406aa633	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1592	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1592	iexplore.exe
1592	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2140	1592	iexplore.exe	30
PID 1592 wrote to memory of 2140	1592	iexplore.exe	30
PID 1592 wrote to memory of 2140	1592	iexplore.exe	30
PID 1592 wrote to memory of 2140	1592	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa9b5ed0f8ff3ffe108ff5d01cf619a7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1592 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a8b92ca2792a386c620500f4c7b395e

SHA1
d04bfc9321e871b0e1a3ca20de2d8a4fb5a6bc88

SHA256
162c36e8997b974cf871d468a28c60598fdb813e9f58fd0dc6c89a288d61068c

SHA512
7537deff80530e7a530933dba6bcd1d11aad0a52e76b68b723299e698eafac5228e46f39f2bddd67ba7fc873ddbcba7fc37b777190da517d5cb9853faa890690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
599dce95d61dcc291aff7348099e0534

SHA1
52cd171045df094178972016e96bd5ae828179b9

SHA256
5bf758dafb11c50b93a07195f76467a14981c8c94578dedf059529c4091f1ae8

SHA512
ed92b2d9f4e453d207c56c0b3d5def700ba22dc863b3667232a3dd272cb6882205af8d90bee0309285a4c7d3f06be549c20318dfcb7975286080e0b47368d7bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d215e2b10ff7bca256ee8d350375a97

SHA1
8271c8fe36e2c7b00d353163272c4646de8a7f02

SHA256
86cd9a50c5f6b80b93099cdea24ca7294667700a833b8ada6325e80d17c69244

SHA512
1fa8ed1a082eb31b42117a4e7a96c209cc21b5e6371435abda7dfdcd9fc95cb8e9f7f44e388c98a02bf789a1383f731e2316caeb550245e46e3b8b825faf1156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9731a359c14620b6380fdd2a5ae4b3fa

SHA1
61c4a7f1f782bab99ef603eb3095eb2d076e9c96

SHA256
5d6b795ef1e13df07ba34326822c3c238db199d2220d55f6bf83f6fc69d381bb

SHA512
7bd039426d8adcf7a23fdf61c767f35c751934c56226cc3aee10bcc83c738f135e2eff24b44f0ee23c4b3c1c1a40f329454064284fc8e54fb78fb0817a9bd474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
968d55772f12bde2c5ea5cf55e0cee30

SHA1
0f69013ec26e99d024d0137939b09d9b5c157f30

SHA256
363d40781cbaed93a8c3ebbf8255481278e77fbf633effb2999a911845945464

SHA512
e1c847a86ea1995a5adb39440fac02f9de3218c22234305d2d7c3aaa950ca023a12f633b24536373bdff96d55d71084468fa57d39b59b8b70f40edbbb273b3a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c82121f440c6b8d6ae9b22f99fe48389

SHA1
2e8e2da7a858ce0c21dff7624dd99d3920bb4bb1

SHA256
7e2fcd27f32cdc8e6639f74a7e02706f29e13a95c17e005c3bdb467c0a1f8cdb

SHA512
a05429ca6a3de4f19095622ca57716714d2297ff08dde8eb9b1bd44f99049eb4cd6ba005a0b31cb16deb7dcbad154d464b70f1fc39a80ae1957e3c565fc6c62d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69858738ec42dd8626ec77ee540c577b

SHA1
69b56392600b1c92cbb57da33397de2b72c9e469

SHA256
9309beda81e54ee55f18ea1172b5998d6af1a2684283473afb91cec3f286f87f

SHA512
7b47dbcc225a787a04de60a200f31df4c5f49dc0e2cad9efffd58b6187901a0e8cc67f1eff06239e2b85e3f125ba1a52634d066b404a104c524af5aeef3bf294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33451357b73e8f00482e8fc4ca929757

SHA1
2821830dad4968fa4b564c0a3c51534280e406a5

SHA256
688ceea3125bf0aa20f7c5b1fb9ab63e45f6ed122aae611a9178db4c7a09a74b

SHA512
d96ed9bf4b189ad75d8b2084a8bf279debf9fde17e898c5aa74a8b8218cfb56757a128c6210c77540229430a4cdc705a1b5fd98c40270afac481c5f4542cb035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fef77905d5e7731b6464a687fb24e9e1

SHA1
0eb8bd7319eaf408c54026acc1b70184c8e12f40

SHA256
da6de353193be88a991e377352ef86d8039326e04b79c2ae1ddb0bda18d7de55

SHA512
b6d02a7fa63a084c0a0410cc3da84247ac459bc0780024794f7add80ffbc43452077c3189b54313dc6aa6bf69adb152f08a10604b6ba3819bca9985cd6dd03cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89a14a43df32cad1954b35dae046032b

SHA1
b98d4f98cf72c2f26227d8eec8a0ee7fd62c5448

SHA256
b8363335a9c5aade32f261aae232a3a1339c7faecbb1d7af4fbb73d7aa2007cc

SHA512
df514fc9c556569c78c36b4c69a24aca43236382a49f2d36deab2740e7ab9c6a6c58e2356ff98e8feb946f88269f053091ccb771e16e710278593039a7e8ec21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ba51eeacd66f56c2bdbbb37ee556a6a

SHA1
0fee2e5ac78cb60c78dab4ca42da77293e478fd3

SHA256
4dd6f5bdc006f6cf69ceb7daa9af3e157db3a25bc7268537bb3f6519ac5232be

SHA512
a8ded4002021e3abef15cf019f2c830ab7e57039704c4858c516dae8e8186654f92bb705bd1a254eeec93348af7f92f42287dcddbb432630172f454511f4e881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b54c7228b435c3e3fa57bc458dee7c97

SHA1
89cd6a5b9d0cc470abba6b1177734e3ab7f45f68

SHA256
9c8e7eb8733a0554cc937d117220c9ef4097d9d4063b3fa5cd24e948fe25f7da

SHA512
a81ec1ae4dc02658cd4636d6281d4255761cc87b93a0caac44d0a4b030628f95d972f28a38b56aa2f59ebcfd8543eb4136373ea643a7825f04ea5fe2ec218b54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6c48aa736bb3814b393c6541d19a352

SHA1
28de3ae38910cce78fb0f33663dfc7cedfe8a4e0

SHA256
5593a18c143bd998d00b1ce40be16c80c28b1eedb0f3cf7b3708b8d4aa429eab

SHA512
0f0d75177bf3c6b72b88f7f577781556eb6164ac9f5679b843139af37ac22e492f6851c10bb991c8a2ca08ad91742a460022afcf34ab5e50645353df86f07b1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f8d059251127fe11e691724b2b43ae7

SHA1
774dcfc60a009cec75fd232fd07675219d8b31fe

SHA256
a46525115ab59d9b7f17d595f42081b9b2c384dba7cf18ef6b0705dc79173928

SHA512
05f4b39ee4c3804a0d8820e34b47c4bcc10572aea00d94ae369cf17e705a5ba04a1e6073301bf67f2477382f9a96a4cc8087f660cf3279c2ee6756e720f94c32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E55.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9EC5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit