9dc3abe9bc8dc205fbf8f09e094c84486131c663fe2e05ec5627a993ab659a32

Analysis

max time kernel
71s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fae4c9474d595c71200a3a99ada243d9_JaffaCakes118.html
Size

23KB
MD5

fae4c9474d595c71200a3a99ada243d9
SHA1

8b9501f8b76ce8f03f8440b48edcbb702eb576df
SHA256

9dc3abe9bc8dc205fbf8f09e094c84486131c663fe2e05ec5627a993ab659a32
SHA512

09de9884bc47d793de3ea84ddcb23a33c39f9174f791fc741a0594079e24e732e2a4c78e9b80494258df82e25471bbc0fc39c53a7056938d30bf21bf84056345
SSDEEP

192:uwfGb5n0SnQjxn5Q/3nQieeNnbnQOkEnthpnQTbn1nQZGLnLnQtQqMB+qnYnQ7t0:jQ/BG5Un

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000004f862b6b42a7ccf0f8a693fd7e14fc3955c64cbfc9e30a7122a38b2e7f04035b000000000e8000000002000020000000b32757cd5be01ea0f97383eb55bfaf1a866c82b946303c0e5751bfed9e09d2f920000000263431163365ba72a65ed9bda8f118deed0622c62956aaa14eff4fea04b84a84400000006b67e3339a8403aed57e202e38c0bc4aa635e07ff9c7a8c393b747905610a0ec831215453ba3ca5f6f15ecc46c594c2db006c18f101c644bc1488c4d1e9f0f50	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a1e0891f11db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433632325"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7646A91-7D12-11EF-A4F8-F6F033B50202} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000a043c27c109edae748107bd1c360310ad62149902d3bdd1b5f8a6c6d48bddfe0000000000e80000000020000200000000924a24c82730aa406f5a510e376ce09c65c3dafa243c5e560019fe07676b5c29000000097e88fd01e72917481fd271e975984894d62b9613c5eba2c3d9daf6cc84620707d5029a0d114562ecd95a5643cbfeb6c733a34e388f42867b7dfacc38573ff4b95c6d9751df5a034bb79a35a7abf22cabd9515edbc4b7de057f61fc132cee69cbd95811d2a1801698b01a2c2df8ad9b69f66c7aa88e95099901045b970583a5e1f3317f4c1952fb32500452fd63d510340000000c25c3df363e4b86f966348df050d9cc4b2fd63a6c6f5dfb3972d0845089bb506469eb831feb35b18b5c09054a64839d51ef5c4030c54db127d34936bf339e9dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2300	2540	iexplore.exe	29
PID 2540 wrote to memory of 2300	2540	iexplore.exe	29
PID 2540 wrote to memory of 2300	2540	iexplore.exe	29
PID 2540 wrote to memory of 2300	2540	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fae4c9474d595c71200a3a99ada243d9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
166252efb4adef5c16e06d74d95cc673

SHA1
67c07bb20d6e5e7235a1bc4bf47c6ab7ead764b9

SHA256
6dd9a031c46f44aefc9ded9723f5ba50e6be8f29633ea5f035399b9ed0a114ed

SHA512
ee710da86a6aa23e83b1880b7af875ec95765b060dfffdc3c8467c080fc0f77e20188c3c64fa879c2bdd8a36b6ca8b3f8b61ab4f749e05214164f30edc3bc053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39d1250e8ba15796c9ecce6f7df59546

SHA1
6659549f43b058f5b90d87958d31c28480f9734d

SHA256
83217b0284225c5b8581d55d5ca592f752d34f0e90408009e7293e4a66734fa6

SHA512
bf957de4f54dce687c37f68eb39a1caec35152ed1cec2fd6f618f1a36d0de991bec2dcfaeb354014df77bb33313343a9015d63fa7d63c5618b22e53b22f5b129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10b2b88bd3fe6116dcfc594746273859

SHA1
d6ec741f6a41623e66b0a4bc3f9006151af3e895

SHA256
6e7ee5861b5ca6bf81e17f9d4b7ffe0a66963dea58520aa2709331163fdc4dc7

SHA512
fa5ef7b1cabac90581b83fbb97b619f64739bed46ddef1426e5c3e693aab33f98aacf5ef234a25ec7b9685a2efc03bca3c81f1001fac18213533ab9a7452cdad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbab64f203066d01168771719cfb7953

SHA1
18880b676928531517fbb0d700979dd10ec286f8

SHA256
c39f9b17578239fc2934c9d6b86cb13423302b4b6c59ade18a93c071200700e5

SHA512
82c72e45adc7298258d93fa92473e3b8767c6c09b84ef18edac2a96a668ea55123a828ed99a32de90a6526cc341689a61008aba051de61205cd5d87c5a262db8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67b74d23a0a95a49beb3e092c069b22c

SHA1
174d358666c62305c6bba7055250b71fb4dd9053

SHA256
761d8f772c9e3b914e5fdfd6ac88af56497d783c693a638bbed814b36accb72b

SHA512
fcede3ebad7ba90e2573cbbb7ab1b613deda307600063dd9338238d3effa16b3f4b5619cef12d0d169983ee810a5b11a5e4469d914b50f8fba7411774bbf0f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a955a77bf018b15e2f361b45518a974f

SHA1
562e6076f23f580d6ba6a2236d6a1b8da0fd8551

SHA256
10d082974ccf29a5d2e6e543ad7fc4b4ae88d30bd0447332d989f323bc42e75c

SHA512
4ecca5790d2c049beccfea507fa7459d68d486dc6c5d5da6670fc188d52f30cfd73bf3db0ff36923b8c0cf9649a8278b032057a6ddf141ea7f55234c869e8d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55af4a5ae2a920e8052dbc8a97e84fa4

SHA1
e833761de62641cae02a0a604f7951eaca601614

SHA256
c092c5f6c159e779df8e0637a46178787c651e575f9cc565c84e089dc500e330

SHA512
45b00aa86bcb1c94be67bbe5fbd94bc94e9d2b0b0217676ebe18788a226a199105b48008008d2fd5d841063d7c34a01896f5fde3b2b8230cfbfe1a73b7b32bbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bc6a64966e1ea90901aa228b7e548fd

SHA1
46bedc3457c2ead6bd309d09bd333b41b520b0e4

SHA256
91c052b149a8f52a53bbed73a2af33a72cedc2d2f6cfbef76ede6fa34d16c564

SHA512
a89f1d0c853c0034dcae5fe657e3af2daab2727a0b832208a7d2d6935f1e94522ab389b78ab1ae23bfd78ade599af7f9d143895807b729dcb3f8152c683b0690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
983860b6095663d3f5f2c8d1a870918e

SHA1
5972bcf6e704eddef1b9330fbdb5f1347cdedf8e

SHA256
4805d2b621f9aea61734643a20cc60f733c5c83f898143edbf8d85a87f964c51

SHA512
579b02e10f43b6006fc1a128485dcb7e7b289ad118e6b1017002de9d245dd2272c0ad64750c6fc17e887085c07c90ff2bb1e29b1bb326612a17b003c36e5c16f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8588f58915d5212281f179d1f3dea0b

SHA1
20dac021921107b6c9781a155c93788b822ecaad

SHA256
5283d85bf76b94b9a2f6a5b5ee9fb5caed9fcacad1b800206e473d2367297f87

SHA512
b0ca83976d6150d7a3d561d0b1fc83accec2d2128783b28b9b37ab3f2a993b49d6fc618b8a3c578eda16701cb6243626d9e6bccaa5cbd2f98017f3bdb1d2402f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fe2ad9744d01fdc74d8ee8ed0a224bd

SHA1
36532081634e55abdc4ad5ed0e1d0cffbce02f39

SHA256
27b7674ad1f5eb9830890413ac0639c922ebf06a18e65db3bf176f86232c94b4

SHA512
dd79d2036792ec0674081efd62d360104b5290f9ad2ee78a0ca877bd60d3c6fe27187d0c0c2469f369a9dc581c5909a00d3a871aee9eba2959d55c629990e96b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdeb81b91610da35a6294dae3da2f460

SHA1
db2b54ae2c33e60942d86e9bb5393460552be596

SHA256
1275146abf91e5577ecb886430e4bf81cccab32ccc2b0dbb8ad5ca486365804a

SHA512
31ee50eaea94fdef0f3f3f66bcda4d442f028d5265fd5dd12ccdb25f343b87ad4f9361ea3d18e8af5ab33195e630275941964199b8c503f158e6b5769b252305

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5227.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5289.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit