c3e70f8b823cc9437b9af370f9e9625306bf116a61bba5c4dbfbec7208d2917f

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-09-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fadae20bd6fa5a7ce718e399eda81749_JaffaCakes118.html
Size

423B
MD5

fadae20bd6fa5a7ce718e399eda81749
SHA1

3b0665ed3f85790cf0ac46de3841d18803713309
SHA256

c3e70f8b823cc9437b9af370f9e9625306bf116a61bba5c4dbfbec7208d2917f
SHA512

0740de21c37259e6533470138131245df491d15990e161427c2aba51fc62dc42b0285e243afe6521d093b47f82bd5237def03acd42b0c37ba83c4acfe620202a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000a9dc93a45ae5dd49c2aa30dcb6366d759bc7c20b9ac59db5d00825e695d55802000000000e8000000002000020000000831aab350dd105c6c44943db6b95b1bb95347b546cc37698d3cb416882b43185200000002b63d874ae4866f991ce79db8cf5d8262153c915e9a41e9c5597b82b61ac1bd54000000069c267bfae2e028f70eb741f340529d6b4362f45b09d8f2f486e59ac9526a7a81346f9cb7b94af5b0f6852aad12d3e757cf8175c23501ada8c6f6e309d3a1715	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0D77681-7D0E-11EF-881A-CE9644F3BBBD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433630593"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06465751b11db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e5a50757a001547b41ef67fe14c45e2d34134d0a1703f7c8fed7d7c0d828885d000000000e8000000002000020000000580b52bd6ce07253f79bea6c1dfb84bbf1e10bb3971159ac2f08b007535b9a8990000000a835f96022688b9e45a16d86212c2523d6f918878a64556502bc187140cb9e1efcb04f496c3507c53fcd14746124c7235dd06737f95a57f6fb575397feba0809b527267ee86978d74d501d8868dd05dbfa1369928207ccb5a70ed906243138edc58b54ee76349b12e054eff201585fc3e912b2eda4d3eac363b03a2daff781baca1e966e0e7f3156e88d9e56a03faa3a400000000c7ccda64dbeccfa9653bf8c21afa76d9fcc605297ee65aea3102b451b8219df479d477ff7542bf5e90a91bbf13b96e780d2c71dfc0c2fda386e8dfc9bc72da2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2484	2856	iexplore.exe	30
PID 2856 wrote to memory of 2484	2856	iexplore.exe	30
PID 2856 wrote to memory of 2484	2856	iexplore.exe	30
PID 2856 wrote to memory of 2484	2856	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fadae20bd6fa5a7ce718e399eda81749_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba118f258891c94088396bb176ff8990

SHA1
c9923c4cc0b5221fb44e689f6133b2d3392eca98

SHA256
27a292089671ac9fcd40d8e848038f658880156b92b3f364fd1cc7f3b1618d90

SHA512
a42299dc8f061bf61bcb300f155b21b96c8bfa5886f3075831e133ca24116c793cfb6bd07ea0a5702d09ab91f494331cd4edae4e0714103d6dbeb2185ee923b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
604cd7b71898de7409a8a57629fcfe81

SHA1
79f0f657ca7956ab8464f7193ecd97625e07a9f2

SHA256
c5d021810ace9290d0d7fb906fd8229ab33a26ef7b6daa72d3120607bcc3806b

SHA512
de14707024f3007276f5b36cf55a690a70af10f60bbf1196070dded97df320b6636de0fe10e092ecfd12749d60fff382aab48f1a4e2c64934246934c5577968b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e7dbb62057862c3e891c3f2b68aef0c

SHA1
a5df6469e5e5c03ed52788ee137b26efebc929dc

SHA256
3d73921f20241ea2e2820e37e08b5bebf0838d51fbe51c45d9b1d7759c8d1b06

SHA512
35bc624b535869bb0dfc4306874908adb0d2300741907e8ba14446433971c7a997b1bed320f0b9aa8b8f09256221e888ab2ed535c3ec8c80ffebdd68a8772603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93f87b50404b56d02524c412a905246b

SHA1
fefe46414f7c9a1a9d32183ec5d001409d857c56

SHA256
fbbf0489d52cf0427124e69143258cb0f68f0fa467ebf33d6acaa94d38857dba

SHA512
44f474800c619af411e5b73cb2078d52f1cddbd246e4257709c9adca4bd3a3219ca69c6c3783ef0ffd75618d99a7235177b8d5ac141f3b60953908f9cb3e8a2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e016531986012aa5545a49db179e2ae6

SHA1
fbb7a0327f03a42946b28f418f5b3fae7162cd06

SHA256
53e3e925bb0b59ccca8f43fe3fc6930f688141b8ee7da6f40fbfe2de067d99eb

SHA512
94b230367dd30b2a6b5e5f1f5f7f5b982ffb16575bdefb99b36c971e50f6e47b9c1fc4cb615b6420b79ede76469d8867baf995579b6086625a20638cfac5ca06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c69f33a2b5f65cce0adcecb6c680dfc

SHA1
44ce143724c79ab065b26f73c60596e27ed877d0

SHA256
a7eb10b0f679579395b0ce66eabfef92b3f3d2eca9187fc0727815e80e94903c

SHA512
afe47e24e71a7d0c61d450fafb746c7d3ad123c26f7fc132f45483a9b9bb02f38dc1cf83dcef1c9b1e99236325ea7f0dec90fbf14a476f72ebde14432d99a0ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1627f6b7d81f0b3c81971670a2d8b1fc

SHA1
e4922e6de8b6334396dd67dc8ebb513f2b54919c

SHA256
330b5cc33d157ca1870f52ec4f2a2d25bd47e3164161d6dc8c7e4a10c3be6d37

SHA512
fb4e3909c7fad7caa768038c746ed4d23a713939d8ddae5b5e1825f7e2a117028a422337cff9e13e17262840091305816b7ae52f6cebaa677731795f4bda22df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e13410c7570572911bdbed72efdab80

SHA1
d45d0daa416ca29ea18dd8fe9e0b2c7482c2cd78

SHA256
df3daa65f3105df41bc6cde4886493491a2054968b4144a909c04b9a48131b94

SHA512
0399264b0c93ada0cef7bf51631eb0e3aee4a017c44c1e79b7adbd3a283e70e787d82481456b498222bc0f285969cb1a4bddfff82647fb469c4d8b07cd92fc9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37b55340ed5aaf33e6a2e57f4d92ffc0

SHA1
bafb534b25bc63eb7380a7ba7deb2180b28445c3

SHA256
8067b34379d782c32d32f0ef183b1357726f89bf3016909c41d6d7275d8b3cfe

SHA512
b959c11a2459f25dc13af0cc520a40f62eae150d73352136cdf41eb78397174ca860eaf2bda8ae52c351df29bbc544b0cec995ac774e9b08b5d1a78c8db962bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e96a9fd6ac4d1e86fbe343e3478e889e

SHA1
7e4b1d6e2e5a2df9f81f08b3031ae55a5bafd73d

SHA256
b3b76beed2eec5a39043bf122e94db20e80c0d9d6b8ef7909d21f7cfed542687

SHA512
17a1657405afe75240962cf112aa4ae6e3d653f77f0be6b0bac57a06522945dcd2df53e7e14bd76bc52d6771ba315cb0ea03a62ff75bfaa81b9d9a16384b046d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1c6a3331f57a5fa421eb0e58ff8b171

SHA1
baba0cb0e03668a484fb6e91e02b57e562ce612d

SHA256
dbae1e1bfc4a63b3f7016aba979cfb7eeeb88557715b7816f156f682504e789f

SHA512
6ee3d28e29cd24c696d1ba5a4a3b87d8825e389839a76d322ac5cba33195466dea8bf867d2e04786bead4c3b3789b532bf5a600982fe4b683b3d0bb494e1e864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0b5ea7b7c3b266868d39e5c70e81e67

SHA1
dd6d99db168ce6d77e15661f5b50a8029dcd3933

SHA256
7ea06a6454ced3ef1fd7bd1444a5f60ab91eb6200faa4bf2d566dc208d7b3e4c

SHA512
25d265db74d9323cad7434eca565e7270620c370ff998ae2186472119f1544ba9c9d0a52e484e412a1b287ad7ff4a6f5d28ebf123569bf8c65c359f40d1bd953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03c042c35a507dfa3a8d896d6de3ec53

SHA1
99f90c19108ed2a52a7c0b0ef0ebfa895d26e25e

SHA256
3de8b77fdb64384f38d5ab068abfe38f8c6c542a8bb01d38e422019b735f8239

SHA512
fca097adab98d5f6485c30251086165365fabf67eb6f7c864d396c15324bc7149859734bc1d2073289bfc363412b6485e23463338e63298b871eaeee5e571bf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bdd6a9c75fa5a16788af9bab884aac5

SHA1
d7e05b8eb021ff73e7fa708cdc70fe2de55de58b

SHA256
7df2031ed02d832b2cb5014c2ceb43f7d051ff77a33f3ba14511416a4d0f5d7a

SHA512
dfad1563d9fe56d1564f76d9c5cda2c3c9465aad28a851c74c7fbd62f258c502507312b3b4fdafbe37e02b8d3734ebcd572f3e96d56074269acbfebdc0037c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c572329b244028318aefb243e6442738

SHA1
27059fa008607b9a7c8d0e728e654c2c0d8d20ce

SHA256
9b83706122b551d41bb58a2ce79e179a09bf610984a79b1989cc105dcf26888b

SHA512
1343041ebcf0c7819f1d271899b0a34e5ab9b76a0f9184eba113eb54a186ae7ba5d6abe0899b4c7773ccc50ee9823ec6f8fca44280cf8c21de712da471808ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e5880da78e3815fb3bfb55f5b933a30

SHA1
fd8a78544e9fbac536d0f1c30ad865a8008010f5

SHA256
d0d7d33bf442c53412769550b60f3f323d9eefaa4ccc826897d0211baf21fdba

SHA512
6667fe381295cd881717e20511953c8c33224d88de4955ca3971c6a4147fc4a1c734606da27fee747d1eea4746ddfd0125b5b745b7dc96ad78d236a80fba6d3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c219cb78ae7dce011f9191c69d9e42

SHA1
25472c9afb5eb2f841fc41a30fa15109adb02fbf

SHA256
06b2a53eff63c9802d7aac44fd1946f3302b10f7d6fbc80937428aa451e35062

SHA512
b48705ac65a566ab4f1f1343967431befdb54651b42de6244811378cd55646d7897fa0f20ec4144d921380074c415f9fa394ed83cc06f14dcbf047ffbc04a93f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C91.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D41.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit