00028acde71b64ff9beae6d7134fab1fd9d3d1a761c97e64c23d4cf3cc7957e8

Analysis

max time kernel
142s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fac952054a90dfbc9e65d45761c41692_JaffaCakes118.html
Size

34KB
MD5

fac952054a90dfbc9e65d45761c41692
SHA1

11c4a1174a5599972f548f0c3f62250d6c46de31
SHA256

00028acde71b64ff9beae6d7134fab1fd9d3d1a761c97e64c23d4cf3cc7957e8
SHA512

e07ef251a8fcd7e0da178b821b04f78f33ed23896181dc07b2e0b665f6a93671585217684a8eb8fba55cfb127c8d3f113bb11b45006f518b999f70babfe849d2
SSDEEP

192:uwzub5njOZeFnQjxn5Q/NnQie4NnhnQOkEntrvnQTbn5nQOgNcwqYkcwqYAcwqYb:i4euQ/UhYG5WgEnAGDhFLi2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE9862F1-7D07-11EF-B0B3-6E295C7D81A3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000008364beca3ada8ceb74428834196ccd1065f325993046103d9459c8c3e6013791000000000e8000000002000020000000a9aea66cbf81908f927fe28e8f11cbd28f0a8e4dce2d9531c57c60640a2eae58200000000994bc31463823ec67e5628402544e3b2e7b004b2d0d4bffb3a6101145540cec400000001d149afffc519b69d892b15fadc7272a9ea792a6bdf524aee537ca83ab94f2aa08e92610beeb16fc0f491110bf9d51d8c6294429845bcc553c04d90095eabc62	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000004c7a3e928a3ed731d15ff12177ed41faa6eb62293c509f8dcac9cf76ac97ac78000000000e80000000020000200000001777fcc74c85e1d2d8a6cb6cabb65191a3a41040b9c71b9d3c6cd71b78f9f37690000000722b41f2c7ffd4854da877ea5ac95e4c944998565dea34cdb52a81aa75efd8a03392d172a446d8d29c8b0ba5774f5f8a83dcb02dfab9d189f8899f212b50a172d697b65398d46d046a114095822316f02c2c91c753a3e16b3745c59c9d2138c683b9bcca38a5c08c62d3927c2f210cfebe617df702ba326f00db0eeefa7a2728af65634314abcf7e93f4f84fa254218c400000006752e1176ec8f4e1139c5fdf9114365ed7aa8db229891eb462a3777e54077e011c5d416b61259fe35310de643826615c09186c9cb9b8cb88944eb915201e0afd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433627725"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20365cc31411db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1560	iexplore.exe
1560	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2684	1560	iexplore.exe	31
PID 1560 wrote to memory of 2684	1560	iexplore.exe	31
PID 1560 wrote to memory of 2684	1560	iexplore.exe	31
PID 1560 wrote to memory of 2684	1560	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fac952054a90dfbc9e65d45761c41692_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1560 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfc83b2d4fcb193aee152ff9a35a0734

SHA1
87fe369aece13fe03b1d4e743e27228fe40f69bf

SHA256
5beb83b3be952323e27ca9845796a8bfba50bf0fb44bbdde67b2e39a9a673dcb

SHA512
34a745345c853eb3895b5fccde37ce58aa952d4c75287d2db503095a783730141e7563969b2f6f8357eb8e1819a23f7556ec9011d7152ab73aca3f8a5907ee12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21db3545bbcce5c67d0ab3497925947b

SHA1
13575792d99bfa2c1bb40d780aa1cb27eec1544d

SHA256
4983b2af8705fdd8d858bf565272658b06ff13441837ed02e09a934e46190ecc

SHA512
ed1574b4abdaf6f0c394f406d21ae1b46b835f0142783e303b37d3bfe857015c2ff94abff60531cd993735b58b4a0a7cd3448048ba1dbfa7bd195076c0f3d702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b4ca9203c4bb021151bf2c0a56b782b

SHA1
ed1fdb7a1ce0a729276eeeb4ebcca9fb18911bae

SHA256
74bbe1db57be19f33a40dd0d619dc6eed05edfb2cbb6ed176a4e5f0f8fc6b978

SHA512
ec2f67b4992eabda462186b0a2a745cfea85588b91c5c4396c4361757666f55fd88570b394d58f84fa8090b92d1943274aef4715542eebc6c32536fe252bbca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c5c8e4e54487055c6c9f8cf5636a09f

SHA1
bf0ed5db0cb93df63dd53be9557794562c9f916c

SHA256
fe1eb7525896e5a82301c82af98ce0db76a678b9f0c42dee84feb1c0530557ff

SHA512
2c0d80ad3d0fae497f844bfc37695a0a7c4f749928ede1bbb89a584201f7dbbe66b6d6ad9818b94d1a614f864db0c51b9f965ba718ba4b72e2614b86daf69b96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2f33669a4960517165011bd0958dee3

SHA1
c2afee1addbe1c4230cf9d2842e769da1eaa6fc7

SHA256
1903489a78b5f455d28567315f229a0e3306cdd301d59cf7f539e390b80320bf

SHA512
bcf4a693188862fb2857bdc8aef74ce71840007ee9966076307fed2c58480c4308446f8bd234338a0f5e0af7a1072c378ad60f12f23603ed7b004dd6494eab6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bc016adf57378edfa9199630b12a9ac

SHA1
12a8089df4ab9eec2becd3013fb42f1794a5f0a1

SHA256
8d1b9071a8ae0d024cd53bd25da1466b5384f2b1aa5387115048c590595aa9a5

SHA512
c82ad533dac71e70194efcbd24f7af76583e57e5ae4a04fff019558d7d6e83aa178e15fbfa62c2150f55b4855993c682d40aa77bf773c8a2c5284a64d87c067b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e79aa67781901bfb8c7872f4932bf1d1

SHA1
3b74a9e659d05f669551720c3bc61d6f04d3d741

SHA256
71ffe83b6762c0014d54b4ae5f43b5649c80136295c60800391033f95f72f94e

SHA512
3ee0638be1e0dde3d70aa53bb6b1f3c20c285c7849b3beb2cca0253fec8dc444458a1d91fcd302519a6353a677603bb04885c9400a39714cdf6cafed7bcd3e8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee1bd950cb3c9ce0e6ebe6f99d35b154

SHA1
448960be066e3a30e10ef6f1f04e71cb306a014a

SHA256
d04e6dea7d093d5927f478c1aa75ffd52da01d19e51509a8f456ff607438fb12

SHA512
fde3a9464efb4ab7566cd35ad3158f1fa8e7c3a23b9b84950f4d21eef9e98a64f8cabb87045197f15a0e1ad4f0e1bb5c8fcbde81cdc906009b4b1269dd0314e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar738.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit