0aad294c811cc970af7b05cac8fb7198e526a6d3579240e2bdb2af5cfb1ea87f

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fc42bec761599da6fa39dce8526f1265_JaffaCakes118.html
Size

233B
MD5

fc42bec761599da6fa39dce8526f1265
SHA1

00e45cafbd868928309a87dda8ad3b6eb0357982
SHA256

0aad294c811cc970af7b05cac8fb7198e526a6d3579240e2bdb2af5cfb1ea87f
SHA512

438375538918e5116194de6900b20b334dcb2c7ac9b3284c2c4131a493caea1359822494206ac44aed4485dddb77feb5bcc0ca85081b6c59f1eb7b18ba7fc86c

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000009e0fad5c4329d3d7c42204f8778f401fe051dbd3543f5dfadc78e72ac0821cec000000000e80000000020000200000005438c304bfd5cf3ccbfbf0542be6426826a672d4f5bfc6159ce4baae9048d5462000000039241c8fce2531f2b49c842bf74416cbbc8d85ba5088d5f3602dc19a3a378fd640000000c22311842ae36f61735a402807e8f3fb99b514f9b26aa87e1b12646e15cface44db2680f3b0206d9f6af915c8cb5e23d61980f88784e6555424d7fd7a63815a8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433686992"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFFA7041-7D91-11EF-B0DA-FA59FB4FA467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06b08c59e11db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000006f60cc4390dd66285340689450723cee0791a6e56bfa1806589a2441f1de90fe000000000e8000000002000020000000c87faeb0b87d27baa19a6578a1749826036037c8c91a626b0af98221e7eccdcb900000005c482095404e248274def04c9fb63249e3727887d863803b238b6fa8aa082fcc5c6b6aeb0ccb1c4acb160127c7af3869e002c0634d5f3499c5d885760c77a2d961ec2e92aebceac6556552d897ce7726bee5cfa7a2fb91d59c0ee6d00406308b13a495e37fdb10e501d9c8ce0d83ae755710898241d25b0f71f372614f7b5c20598c47624b99a1022a399283af1cdff9400000002c134ad6e61be1ab202944f407a2a1f7caeefac25b57c241be127a473be067f212c6112ff262f394ffb0e92493a6901bbd99ec385aa5eaf4b8b4fa8c8d116afd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2428	iexplore.exe
2428	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2748	2428	iexplore.exe	29
PID 2428 wrote to memory of 2748	2428	iexplore.exe	29
PID 2428 wrote to memory of 2748	2428	iexplore.exe	29
PID 2428 wrote to memory of 2748	2428	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc42bec761599da6fa39dce8526f1265_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2428 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21518b56ab1ac8228da129ae5bf359c4

SHA1
92c3b0299ba1ba30bb9dafb79dd2b48adbf301fc

SHA256
cf88f18b46c916e27b81c16ccaf54b48b436b22b82170173159ea0e684bf49dc

SHA512
05169ceddf2739c18c4f83bcb5cd91ca7dd15cd4397de66f635a5a14f44a6178f0c6add2d8dcb2e8208b13dd3935a3e4887cc23292c6e1fb38081d98d40be4e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee95aa8bed421e4c672a54c125a586a2

SHA1
01a97b0224b1b991c557f05d3eb6b3fdb7432e59

SHA256
aa9d0f58abe53fcaff87496e45fd0b2451d869e67d1f7005a108ce50d7e39621

SHA512
df595d2c0e581934fb8c716edd3759615f9238f29ef2416dd7f4d02d86ff49c289afacc23ec2f19ebd5877669d1b881e75b0212b0d7b30a31db2934d11786252

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d8a33f9974dadc2188600322443592a

SHA1
b2fd131e1e385fa6fc9a7794094b3063c8afbc9f

SHA256
d00e5181b4ec1ba61822311320da9b5e32a9b171cc321b301309f39e401e130f

SHA512
a8905a108f15c64b08eb33e9081e9ff3c8203e37ede02bf1d4e543ef989fc4c145e6174c6552330aecf5d0eee6f7d0731988e35e55fc735ace350d4c3ed9c8b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24c15578e9d38033d59caac4c24a0a1a

SHA1
ba5c10c1cfaf42b2257a5ae43d1120d460337863

SHA256
52a273e553481fe5e6875bc772f28ed59d59cba051c5b0dc1f002d37b77feb0a

SHA512
fead37c7dbfcb2268fa5a151d5de825dd12c952df4115e4575fd40542a18cd6de8a640194788e2f42f8ae64aa95ad273a8e73e0c126709df3a5ae27342399c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e047d85b607f1ac8c3bddc58a0b2e7cb

SHA1
069aabc9e09b84f2c71ce7184cacc738e9453faf

SHA256
527357c9f58a04cece442dee1fdbc3f1ab5f795c86bb1482753b21741a6d49da

SHA512
ca972b35ee854f73546a6b5dae359032c153fd8ccec2e662981c85de3cbbaeae6802459d5ca41e0d48e551bec023b87e0400f6180206b67bb191649b8bb6dacc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
191bde2e069ae3edc59882b12628aafa

SHA1
a132d17e396d655f218de9cbd66c964b12c5ce2d

SHA256
99072a4ac667917020e55657dab02463c93ccbcb0ca50ba712e0d79b5ce73f90

SHA512
fbe52f37c09c0c59fa07d9793be93632d6264a8717d7982ecbb41a466df77bcd8e4babe720959841957929b39d278c10fc85981d00d3da5cacbfcbd296115691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a09fe40c2a3c45bd5a721926f7bd3f7

SHA1
995299dcbb3e0d6748a244f9ade538bcaf8a198b

SHA256
a250ad7a03e0974933b0351a0e3add14cc6d9c2fc2595eefb607e71c11960b23

SHA512
b0567b8592400cf2b6efe0833bf71dd5bec9c9e626fbecb76173d405d72226a299d3203e136459b69e04fd5528b0e7c6bd8a9b74b8da96e33eb05e071a2e446f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96d3aba0f83e90fbb163621e12f80c4c

SHA1
724298e893dc603403fbd8348c4b14d7ccc3aa35

SHA256
e088855abab701bcd5953c6b64dfedff9352f25c613634907f81707c3fb3f0df

SHA512
fdf7b2b396921539a4a586ff27bfb2cb422e34f4fd62e0fa44be317769b2dbc83617504ccd52886b0554149b8233909b60e53e9e6fb6b8127da2ff1b68f41dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d55e12908fa9af506c91393535ea6661

SHA1
1a1c9edef4780cf89ece943c87974214f32025bf

SHA256
096cd4c12f0115d8017f0ca796c9f223bcba802e7ae90a341902306a7610161a

SHA512
77332f9edc23ddc529ef678f047269a1e445667948b6d63f1214194c13cd60917c0b5f750912282af8b5826b7f6b3cff835f69c176062cf0a3065c9836fd240c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b1e77aab81ee87fdd018c3c7fbba64e

SHA1
75250c078790aadceb148b74dc98f2e599778dca

SHA256
a62c6503b5c410d3dd5658d6c32ccd678b0e16b3340499ecb5acff9e533e3161

SHA512
dd19c3f3167b3bde733cbb797b87141d00b9bf64062c68e66e61b1aee1d0b2ea5255d1e7dd0c4883a312a7d6b1798e5ca9798ed73462d0607ff04856ebfec1f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56e1038cabbf4675e03dc41b1cc703b8

SHA1
cff934cf0600279467a0316c03cef1400dd3901f

SHA256
fbbaa66858fe7c64e63584e377f98248c8fc2cd11657973c1d8e4a24ba86e43a

SHA512
8a7e737b6da315dbb4259b41065f35063a6d47ae0b0a18765f9bf60b74dbd3e5ecb33a519885d095508698d6eb5629ea13cc5a8ec26f192a7265002faed4a082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
033a368a825e8ac97302590a0c3e4e2b

SHA1
8243e5250897f39e6464b5d6efe43130fb2ea05f

SHA256
f6cbbf7b2df8fdb348f83d95c7a48a1994d37a0a2a4d091191ed54f496179b71

SHA512
4900b0b5194b34be3a5ff857fdf63e7d9d7844bf0a9aaff6a0634a02669484115b6952b058a6293e02f991879974a6a78792db2d41edb78a4ba15bdadea9ec36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32aecd151989419cb024504e9ae2e087

SHA1
fabf9cc7c8fd0a367b538f3dbdd13e197d6c9719

SHA256
b3f87ff3e39ccd0bb31b525215b8ec700d1344dd40f09fdd99d9027b6afac02d

SHA512
a4844a9c57944b376a53c3a3f6175b3c4effc4bcc3f66f6e4505a9295ab776e060851e21a270d44de5e32d44f6ebd06941097018d05d4109c2d38e74cc835063

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21fbd2215cae85d88e1989d47b8de751

SHA1
ac75d0b7f6525b6fc3c80c64f9ba8c265de423b8

SHA256
11df80bb7642a15ed169f6cd14e638e66879bdc35c0486be2d8778b41ecc91a0

SHA512
f0b6e0a07551555c617d2b844d59d8d665d99b298987bbab4e55e8debd56eeeb920bafaa2bec6416daf24ba247d9992a64ff476af5b7c4eeed586f25eb93f812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b3c239daa9d66db8a2d35b6cb56fb7f

SHA1
5a584bd00e5b939dd44764438b40127db7f86e2e

SHA256
e978251bae9bec702e2df561e9b2b57e48a2fbb411f08b86c70068003f2b0c28

SHA512
99a241c7c7effd9556aab647ad1c8a20775718e37686033c66e3cdf591514852c3449eda6ffd2cef54d7361f40d7c373b1f0dc9bfca3742ad336d88d9d9a6626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6de01e5384788216afe49b418a6bd414

SHA1
f1579754239ec26035c9d1c2018b75e464db7409

SHA256
5900bbb19d9a248addd4f499361cee961ead55702b6e79bf8bbc1da41d5ac1e6

SHA512
11a9edd43cfd8a66a4a5b46172426bb69399031378257e177e2d0b147f88ad9668f62947cae0c7c8bdf0a254c17ea1ff50dec3e1c0364d685fdaaa04190b80e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89EB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A1D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit