c14fa014737cac3954000665d65f1ec29b956c22a5e849742a310a8a65e61b4f

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc51b9e41a4accdc119f62ef1a1708b8_JaffaCakes118.html
Size

68KB
MD5

fc51b9e41a4accdc119f62ef1a1708b8
SHA1

3118cbaf9698233a33958ecd4029f1be76b59b05
SHA256

c14fa014737cac3954000665d65f1ec29b956c22a5e849742a310a8a65e61b4f
SHA512

f1884ab8d2b8d2506fd55dfa5e0a984b67381d0534d1f45eb059126809bfab4d677bca370ef4e4d9761993a194fc0d1ac47860352dcecba1f36de333dabb6def
SSDEEP

768:Ji+gcMiR3sI2PDDnX0g66jYuCV6GeqoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:J+pDCVzeTTcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433689076"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d2d89fa311db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000001e8bb078ff166b3fa23a6a8289638b1910a13854fe2c22034d847ce5e9d98275000000000e80000000020000200000003e23fe6d8b2e5ab19a0da3ceafd0d7de9830b2620dd0c5fb4d52bd9a8b85b5bd20000000a9e0e7ee354c46e7eb00ae9d4c7c8aafe54c7f4236a21ff0e0dec1a9a2bc879e40000000e7c5dfe66e11d7cef23b9c12d66d1340dada8570a5d26ede0f52cc863f2c98460b5aa56dcb01562e309a2e692930b6e6fd2c61796b96de9682364b269162aed9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000008492d39a4767d78813e3c79251b2adb7165f82ad55ad73605d8bc07c1101a1e6000000000e8000000002000020000000a9e8ad436bb670c051615f488a0a6299be02dd629e508b8eccbf9bdd44b37ce790000000b4f575180527f779d511a8c027436a941d4a8434ca476e5a3b7f137ecf17907755430ffa3078e83e829d673530b21834f20615b591de4116a52fb33857bf2fee2138ab4169afd47cc46a73d1b05075f523f1a44b626448ca7121a8e0c749dbfdc6a14aaff62f12701a84b488eefba96b980d51039334da79a59c2bc7b883692b33e61d1d90b755b741567263ead6aad3400000005a5ec0c12d22b0910d143d681b33dd52a769446b5d2932c39b8c3589300ca194c1b4c425b6fdd59195190cb78f937195e5d558a9dfdbdf0368fd145566f793ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA9EA641-7D96-11EF-B6DF-4A174794FC88} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2656	iexplore.exe
2656	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2612	2656	iexplore.exe	30
PID 2656 wrote to memory of 2612	2656	iexplore.exe	30
PID 2656 wrote to memory of 2612	2656	iexplore.exe	30
PID 2656 wrote to memory of 2612	2656	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc51b9e41a4accdc119f62ef1a1708b8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8e863b600024af7cd121088174bbe4d

SHA1
62ba474a5a9b67797f55347bed3ca0644e251668

SHA256
3e5980f9b834ce6f0d7c922807d9d7e8cd55e558ca4ba056575c43dc979f3a7c

SHA512
5ea3c322a9f382e3f73631f904c14c981281e0b15e7a1c2816512a62916cbcb04eafc3126e1f9aa9de839e72889c155d951105fae38ae44312739c3ef35cd50e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f328fe4da57b03059d4cb63ef7bc390

SHA1
9e07b88ac3319b757078a7f502215b24d30ec3d8

SHA256
d6cc6a429becd1d7dd1f3cf1f1ab593316a7103741b6776ce49eafda05f9cce4

SHA512
8d5516120a1b3fa4444267d0641b002a36d20f11ff0f525e111cea91075e97e5c223de51d6fcdd63573e61ab51598d182c21c61ee4b6daf2b38edf32a833c691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc087aa34e784bbc053c13e6d1906dc4

SHA1
1ff6d37bddba4b6f02d2e13a26161ec8a4e96a93

SHA256
9f4d8f810ae7799b2c1ef1a5b1e6142995209bd2a5fe5c001fba6e8e2fccbe88

SHA512
4e8c7aa3375ef9416a499a12bcc5a531ac779817b6faf2d4377945e8b45f3a9aef857ba4fe7566f8d28404e2225c99fc7e628409d5a87f17c2e88bd9a9a872f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68fa2c24435a5f7722e69b336dd01400

SHA1
316102bc97f3592de642e0119acebe907531eea1

SHA256
ba60a18037b74f809c21cdaff0ee83e513f86059c0965f990ba50098db8914e7

SHA512
7ef95d0b73d14ed62f9eb9484cea6575c0104866c8eb823ce1f628aed3bb73047e275ff11156ab49cf487028cc727d4bfc869c23bdfed5cd2172b3aa3ff99afc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5250c6256d738a00dba0d671250cda8

SHA1
80237642714e2fa15119fd34cb28f5975630b652

SHA256
46c09387a366b1e1a4713398b67df1ef67ada731cd8db5d43c35950611272365

SHA512
ff0ccf8d53412c851b5ca8e4198b6cc28e203446444dbbfb6b571fd4fd28612d22fc0bf715439b1a268c12915dfd37c41205b4bcfe746f0854ab84c716de8503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7245edd617f4e9b6f810dce8f32864e

SHA1
64547ff68f5a79684a8e286f7e6e9aa7f7245423

SHA256
ba2c97e33d14b86d2a3d729b1a9970da094932175e18848217ca677f565214a3

SHA512
12af44409035219da8c6d06b612e6aee053fd190f765cfb9b83aab88b4fb070526e57b6b7b843baa1a7774f33117552fc6643bc84c781756b87b6d3460e1a2d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
331b501703ee703928bc9af2f6fe0c6f

SHA1
542f14ef98ec8e51650eb29d882a68b1b21b487d

SHA256
793d33cc8f4eee2a1c5fc21797c23796737e9a21102e9f65c8caaf611583f784

SHA512
6a11d1f29ed234541e6443cbe27e3e22e667d3308af9861096a794bba065908e0b0e5df0fa5fbcb0f329d332d633aaff1e469ec384800f280e284b6f3edaf576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28efa9d836cee639ef8193349a494dc1

SHA1
9c7733c13648a1893aaf0a0127248b9dbf8da3c5

SHA256
a64739601bb085628e913f7489951bd861ebdeb06e750e1876c16068090fd5e1

SHA512
a89e7d7f62458efde3e7e63489b9f06192b75a4363adf4c407486cb88659789eb563372aa3471af82174da143ad17c9d8ce00055a458e04852c82a3542130555

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e06963d84f7d054b78bd02382d1c6c29

SHA1
178841afac6c40d99c4ed793163ea7b9e70f29c3

SHA256
4944bb5fb576eb71cdc1564af0319bd92e0edabec8f58ae6a42df22a436d0de0

SHA512
843519fc22beee5f06e46b1934c5dbe7b22712282e85d1d4e4f6bfbcd626ce9999867a1970c9b878657fba6763cd7c32f61eb4a98c68835dc049ceb19ee287bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55243af2f11abc57d924b76db59b3a8b

SHA1
592580610dc6397c269f343d495449e20f0f76ba

SHA256
5dd5fbe6d83d1b180fdb1b9d0aae7342c5d6be491fdb995bd88cf454b6fd8ed1

SHA512
4c7c7daf5093a1136239448d676737b692ee6864acd589f32f915030ae58a9f73e4292c54721a97e021fe3b889f47020233d55281bac16a15b75fd7f5cfddba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de75d247bfb208d579195fc3432bbe4f

SHA1
c7ef363361b89c3a298e3aa965292329c4dcc17a

SHA256
1607790c74c9e6cd00b8f68156963a77d4a7d7cac5dac3736c56bcfefebea4da

SHA512
ed375481d3b0f25ebee9556191dbe40a2f7761d0dda97ce5302b02bb685e843e0e38af86129caa715f8058a7fdc49b4fcd41729dfbc1ed0ff68da78942ee1fe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f73fe285e51b46830a15147b563ab8c

SHA1
aa36267e3f0ea613042de8de3cf850431d1f8e4a

SHA256
5b55826e910adca716114195f4d3755340124145f40ec468163ae930cc5fe20a

SHA512
445ca7d0a32f8ce0bd45f3719d86bdb6f8b684b48e9b4cef99889aca64638312e9f0c003920bd063062868ad5090faf107ce6bee4bb9036c9cc07baad35628c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25ce5d242e0af8eab40b123a001eb35c

SHA1
acd53ffec79563348f984a35865dde53d657ecd1

SHA256
6e239965d0b4f01d07e65629cf4dbee734a5e1a85f0eacd180947f966813a71a

SHA512
5105bc2e62529488c65dce5053c8258768f84c16fd638d0aab8b48b27195b14d360a0e43f4358f9c26cca2f71e149919a99966c7fab6e7d826ff23e8e3582f72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5EC6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FB3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit