a95ab6742bb2ff9f7838b1ab093ab35ef38fc64d0ce7ee259d0f41a30269d8b9

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc567f81939a9334d8c52db3e7b1b5d4_JaffaCakes118.html
Size

34KB
MD5

fc567f81939a9334d8c52db3e7b1b5d4
SHA1

b2e96dfad0ee8fe7e7888a1ce55af6013187cdbe
SHA256

a95ab6742bb2ff9f7838b1ab093ab35ef38fc64d0ce7ee259d0f41a30269d8b9
SHA512

4990b94c8de64ac4d22729a23d934074b90252537f7b3bfc9af45e37c4757f78b759a0199a4eb38fc3d13cd64603f8a82b2ca93b166628d5771b45c0abf37c6b
SSDEEP

768:PSnamCHW+ZlSLVeNiKM+Z0oM5gNq7xzS+u/BJ2aI9:PHHW+ZUu0oM5jxzSzJ2aI9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433689709"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e7d73ca511db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000bb5dee7447484927fbb1a0965a286ffa437fcf225be253410ae46467e81065a3000000000e800000000200002000000025996584aefabd62e468dba2202b95ede0c0a483e85298c421f9c936ecf18b2690000000c0fb220cc199fe9a08785883c92d9b69d5e46e19c59892e7061b5d6e00a54b70b887c32e598fbc821e8abec6b95e9cdc12c4521d065e4372fd657d7cd918aac37e6f2dd0cabe2b3f55e5ad81d58cae86a0c17c01a0e45760d982c25eab900ff71a0c708521b27f9426ec25bf7e6ea647fdc468ba03a866b7735e2a18fdfc7341ecfb37fdfb319d31b7e2c3f38ac390d140000000ef678e28202a7caebfee0090c5b0e9655e08f64b4849c5781b8e08ac192ce1921711ddf9b1064633d0af2466653ba4984ee5bf5ca88db08ae748297bb8fe9050	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000f27a652a2ee055a57c56fdae1ad303789a6ec900affda2aa1ffdd7ea87a151ce000000000e8000000002000020000000921c6a905ed7ed5d288071e7ddecdbccc47dbcbb150fdcae04cb8c783e52cf97200000003ab899b225d9453037a539ffa2c011a92212703bb0d2e9f48d9f86e2ae360b8540000000d600969b4866d6299bfc4d8bc66ae6a10a86d3d94dcd0d72f968aa85187bdd43d2c3ab3b4cdd0bef83e9d9d547735f99b1278e1206adb137e58d3f21f0dd77cc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{44B48931-7D98-11EF-A0B2-6AE4CEDF004B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1392	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1392	iexplore.exe
1392	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2104	1392	iexplore.exe	30
PID 1392 wrote to memory of 2104	1392	iexplore.exe	30
PID 1392 wrote to memory of 2104	1392	iexplore.exe	30
PID 1392 wrote to memory of 2104	1392	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc567f81939a9334d8c52db3e7b1b5d4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1392 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed5ab3c60cad7ae31c1cb10ebf1b5900

SHA1
07a667191eb8e0d7a720a98415c65ea53888e73f

SHA256
23e174d1ff39ccea1a2bdd25db5c66c83c429ffcec9d3ced9a8ca618a955ceef

SHA512
83b7f26b29944f803feb831f1510f61b119a490eec39b45ebdd11f808676526b6ebf14ac920a2f6c2397830ae924c994f91c9079808d1405e31de42647c5dd51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08cc6f0aee065ce64f6dc9e10161d033

SHA1
58d63a0c4e25a8bc32f7b6d4ed724bbfffb3b3fd

SHA256
97a175fe8b70be28cf4ab88d44e432c62c6cd86ed1d257cb8d3bf7abba9cb536

SHA512
01e10d554039dfd05d53bfada687457c32b3be19f6ef9ac0b9dd35d2f135470e63bd0218a78b5112908ca6fc852cab2a3d92b04b501af6236d51276efdb1df20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f223c30d3a52029458684cb5e33217d1

SHA1
82625b10dca43e1934788d3fda9d02511f55fb6d

SHA256
02aa41f9e170c690908db9fa3294b704a38648e82c7ef34476df4b86c4269c33

SHA512
a515e91996092bdb075fc8ad00cb9f0a54d1f1e2a49e43011af4d160d1d9a95eaa60968cac26f2cbe9b34a428f21e75dba9cf4ae62ae26eb8cde88aa90c51176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d94c9f285e8c8782498892f905b8d681

SHA1
7ca3bbf878f3da7508cab5e1cf95ffdfd1e3d0c0

SHA256
cbed529ac0b660da0cc56e225d7134b8bff72be197b99dfb85110073da42e877

SHA512
3eaa0ded3c10b911dfb13fba1d423696a3d01fd6003122d3190fc06034418346232377b3ef51384f8923f91f86488cd21cb4d8322bc9e2645b6ddc1570529060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ee537119ef691461a5ce7c099eb9db3

SHA1
ff5cbb68b4d84146b6c954eb659b5f9ad6b55333

SHA256
914e59c50e90e5b56fc577a99ccbfd05ccc7406eaf98a92b4f7876721c2b2589

SHA512
3a6aaef6d8547a8b9e28107046a2960e1b25c6e9e4be9f33625b94ad4fbac2ca314a1fe631072c90d73b4cc3b2c6a8c0fa760227cd2a04f28ed1f423a45b48c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea8008d948d996f965dea51c8ac49016

SHA1
5e72fa82cc6cb8fac2bc5c409a2865a9de681783

SHA256
d939e2714efa52cd5da0bc16f771a7f38b558f45a8cc35a4a9d5c2bce939411d

SHA512
5dff1afd8d6708ccc3c58d633caf56d52be5b6f0709d1119d7248f94ed83db6a0e169f1af504c85c4482de603b725080ecc652133b8eae961a740ebd86c0f1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
115c5bb8e9e99d51ce47a2b829c77081

SHA1
df902706546dd697bd36409c8a2eab08b1082eaa

SHA256
b960f7d3de3ae5c8905de6a365900d94ec2e2874c9b4a82f22bb62fe90a11b83

SHA512
5559340a64c6f97e3da13aee28f7e497e0af8cc8d2392cc7fa466bc8289c85f8b507b01f62e9c18a81f23fbfaef794ab60714635710be1c7ce215c4e5614e81b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e316d1a3cefe685363b9604beb983b85

SHA1
5aec24cf04bb079da54953a4f9fa93fceee7ff18

SHA256
49b6addd246fdefb59917dd5749c801b2705fb520a196df3bf9d37ea151d5169

SHA512
8a6c10f75a446bc2d7d519646ae6c14fb68b209727510810bbfe023a7c440a352c811768d6699dbd935819db5c68142891f85b645abc95ac7e05c7609e337107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9b91bb40d272fd8ab123d4446e1caa7

SHA1
6ff3c39315b4e43a864de310c11e11504b6e06ce

SHA256
4d573a6d3bf9ec527116464e6ab518adbfb0e170830cc5aace5d2a25135bd734

SHA512
244ebe352ef5df74234d30a2e0a12630eefd2658a8e03dee80f266c80f511ab65c3895949445f273cd0e3b3df2490bff3e9a673adf762416a07ce48fb8c7433f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8599b0988131e372da0d22aad1c987d

SHA1
183d25d67ae2e3004243a1d891a45211a72215d3

SHA256
a0cbed7ed25296c6edec873ef9156e950bff80656e7bccddb1cfa012e7a8ec1d

SHA512
36ea894d32e85b822bb7ccf65938c1a85be9f095a9d82d7086f0122315976f2008c14bddc6d0ff06f2df2d0dfb6cbecd8e55587524cba202d72a3920d0f78f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c2e888fba9f4ad2adfba4fcf38b066b

SHA1
02edbcc4e06795777854fb3c6aabe94b74f537de

SHA256
20bba3139db1cc29a905c8e0583b6c749b0f18f049fd2d07f70def43153188be

SHA512
8155dfb88179949b8a3a7f7ad48e7258514b35f1706cea7e7da0a2fc79c772cb348aca71e950e0b5f23d63e4616c909488acbb32e456ff08117099fb3031835c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c95c1921fee6939e88c359a42c4d5d3

SHA1
2194aec0ea4b5c1fb58d9cd5cae10e68cee61444

SHA256
4df5ade4d7827be1870dda62b2bb3e2c0feb68cbabe699b853cc61488cc398f1

SHA512
bc02c349e85a669862733cb55fe3cc4f7cc12713068843296506425fdbaa866a3a49adb7850352c7bbdb9c973624510a14250447a48baf65f507cd0bff4c240a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23248163701269e238873be40d4972cc

SHA1
f3e34e50c662fd276060749164420e7f18ed175f

SHA256
24340fedb1a9490bb858c2338c428f14d25e7d43f7df03ab866d520c83fe5359

SHA512
6d4749e763d95576aafa6de22cea853442e4ca2e5589f651507f66ae4157a1c6333a2976d46b3e200cee59b2901508203b0c555150cb64d97d2c9fe99c698224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85c16f74d32cf66eda1b067664671171

SHA1
024d11b538d2f203f6cec882a9276fa41cbab778

SHA256
67551373eec67ee12fd293fc6f44308ecd7a2b6150a346f30568ae289d4ff1de

SHA512
e2cac61dfc4c835043d67f8021db68dc2d54810a1d8a3ddd8f97d0caccb4b46454db682118ed7c36d21fe5a5bd796e864382aab5941239f59dc519fa883ef572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1507cbd1467d9ed7ad32e7b249c67375

SHA1
04e542296a228b62dfdc0c518e297d69beec3ae7

SHA256
20f59e4c959ebb6a477a753a6ef92e29692ca54f91e310de27164b255e384b71

SHA512
349b1b077c1c1b42b54ef26273e668422a9e8eea84fd01fd296d2d09ea769328345566555e12f9fb0215485faf8381fadb92fdc5bd0abff8b78f8af40740729c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C3C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C7D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit