1db5ae3727cf214211e8466e5b5c291022c818607a332e985b84ac0a76f3e1b1

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc772c6416960165aeb0d33aa30fbfa9_JaffaCakes118.html
Size

15KB
MD5

fc772c6416960165aeb0d33aa30fbfa9
SHA1

4e35226f2bebf222541c5fcaffff69abcc1b3734
SHA256

1db5ae3727cf214211e8466e5b5c291022c818607a332e985b84ac0a76f3e1b1
SHA512

439441d260be9ddae03aac0fe1df1de045db5871df619f04e6dceabef63767229177793daaa65445b30bf0a432420cece5c7b0936b26fd1d1d26c5252622f5d4
SSDEEP

384:qZdfARgQIMWRUuBM8FDfErcxKrUArY44yv41tq85Ab:0A/WRUuCqk4zSb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000912bba0d28d8344516ac566e7ff5b1ff4baf77aeada3fd2819229daa74a34311000000000e800000000200002000000066b0414b35ade36a5e2b85958694ad9e587f51a6fd190db730277fb99bfe617520000000eb647e5b90312ce588c0e930dd7273928d31d21147a822fd271c402d0379954d40000000ead61fdcf032ccf562ae8860ae6eb6336a2fbf1c504e333e92ab19adfefd20c3610e42e0ad88b5a617d8babf114253cae0eabf98528a5fb2295435f5d070c7dc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FF16131-7DA3-11EF-AB7C-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000001588e27e12de1c00c959dcda61b7764612afd474d477a6d7654b9375ef7c773b000000000e8000000002000020000000f5c207018fe015573b25a27a76b1d20240cf0c55d68a0e621d15c65ee92286fe90000000f82306dcabd4f2d24cd68d140047b74d3d959925d7124314477b92320ded47b93c75d929229b1c4318d6c155b7bdbd6129066f208708b1807c56df4f59c57f647f4f411c57579283a510d915272ee6d590d60f1c4f0e42b8a5f78b130d57851b07987850b95df46f3b3349751d09330c19e254f4ee00ab03c1fae98af27effed7a79501cbfaf3ea61af7fef476becf6c40000000b501aec36df855741079727fe3aeb452fa74aa49d4cf64f23d17e588039b0371add2bfa9ca83b91b13a1039fc3ed3c43d1c9fdfdb68145344949efd8b172b6e9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0507b68b011db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433694515"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2320	2444	iexplore.exe	30
PID 2444 wrote to memory of 2320	2444	iexplore.exe	30
PID 2444 wrote to memory of 2320	2444	iexplore.exe	30
PID 2444 wrote to memory of 2320	2444	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc772c6416960165aeb0d33aa30fbfa9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eb345ebe18098156e4b8646ef75897c

SHA1
60180277161eef47b0de2446000dbc96884403a2

SHA256
85d2554beecf7da54fce84dd4ccf1722217cad531702c2522e044cac633966e2

SHA512
d36e6a2c9d2d0838bd908c834eee52442c6d8bca782360e0ecc45772a1b307222dbc94ae3e08bedb53df392c4c4f78a4b21590529c87bbb8397693b9a7653a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0964023ae9719a23f460eec26bab5cab

SHA1
898c3d6d43c0efeabd338c4581b8152bcea3bd48

SHA256
489569d8de75323b93507243099a16b6f4a1ae8d0af7e3fbd5d842ce8db132bc

SHA512
580320d121285715737c5463622b291e318ff025f4e6c60871dc8ea691b09bff9423607ad8251547c49a3458c2d39afee3047500f943d429de24eb0f50e8a3f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f8b34514a8d41e2adb55ab0fd36aef1

SHA1
06af5770a9744843ab447642bf577989d3a1820e

SHA256
245fd313d4f36d2499fd128daf0449c68fed92f73cb43d9f59c668a1db838c9e

SHA512
2149e060e789d6bd761d5bdb58969e0e40dec0f1be3704e0c575fa5d9a5da1ac4ed95e47aa01b92d77ea078687dc11b8feb2a1d0f6e7ac4007d20c5cef0b56f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd4cd0b4c314ca844edcb80c87111c76

SHA1
93dc1266361a3a478fd11f7ea5f02f666d97e38a

SHA256
739dbbb787ab292a238a33abed5fe1fbf8a9ed7b4cc860c3ec6975be5f87fd98

SHA512
9f6b1217c8838b9cc8841d418d9a044d4378d618377c91166dc90c27376be949ebfc4db80c5609e216c867cf91a5bc06f4e6bd30d2f470c995c9a94c50b3c674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32ee7ddb5a98782cc23a75b3e72c1b25

SHA1
7b0e52b194670676c95e2c9e126ca0b49a23125d

SHA256
59462db3305769861e40b2bd4de0714ee04bb292b6a4315d2f2acada2f0aae9d

SHA512
d9dd26de7d5b99e84615b5b88a21a168948780885c8417fb6e6967035442abe99b912153eaf4ab66d3a920858f4ddca83a050f829ab77d131e821d3da096a623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63c96655c8210076cbb96e77ee986e05

SHA1
26be7996ee7c793102f12dd0f685af49ce0cbb2c

SHA256
5d6b41d868fac5a1ee2075194b2510b5bb16d769e357871428ff5e64d7d985b9

SHA512
88fb73f918f40f2e69d67bb75f4fe71857053b67af2b6ea6c68912d3b703a31ecfb77d2104d9a98fee504d06f402491792890729a62fc48dea04c7154d2655f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31b793034730057708484c5dd8843760

SHA1
4573668fa32afd4a2536a0c945f9c0697c492f37

SHA256
2b1b2e7e300d7c59c8d3b7f4dae77a67451b0ebf7ad22033e656167f591dbf54

SHA512
8aa46dec053ec8370faeba7e4edeec992edd2b436f18b2856146ddafc1ee038949da866d6cf8da56cc3fed851bcf7750dc28807aabe57631bf978b2048bb3214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d16619523d2aa1b1991a95fc34b7f841

SHA1
1158cd98b6765e48370912a6aa0008fe9f5c440f

SHA256
94c902039f21d6f439535190844a3cfdbefde5df68febcad328b9a7a6a6f82a2

SHA512
bf7709493ef923b1542f58bf6fc59f7c9b675ddd6b42b0eeec4245e702eb03952c3607ca75d500738d46c66ded24561e6679a7cb60b29175f42fddca994907f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcab43ba19b9e3053083f30f818a4cf7

SHA1
f1439960c376b68b6bbd964e145b49336415b9a5

SHA256
b6c16e771a17c8ef7ea9fc5446f27d1e657c8f70399ab18c3fbd14662595acd9

SHA512
111cf30e893c87c20be46809462251b91f2d2a8b3cc15ecac9c7b18686ab5ca01e8dba1040982a4e53ee4526447c5536b45a57856b118c006051ca748d6dafe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9fc537f3c4a714233679ec2ec9dc7bd

SHA1
715818871b3088f8c26e297ad99ae2715e6e25bb

SHA256
b650aab520e291b3d0ef986ff580aba06dda89c7edda9b16a08dbc70edda924d

SHA512
1de04f66a90ae0a3ff71cabebf3779cf3d1fd7613d8ae232ff5de027f07e6a542bf360efd98267d2e8041e8e2feb5f0467bb76af58eba22d69361f515b5e930a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edb7c9a0da0162107a6a6706aa86cb71

SHA1
8a6c1506843fdd4c10b0dfa14563c8a2097dc9e1

SHA256
1047b72fe7fed992cdda7d3882d536fb3ee79f3f1c850878840eb32636b90b6e

SHA512
d90fc0daa027f4f041285ad8faa9a70ef17e388784d1d20a2d51d622de82e8269f6e8d7860b9b452e41b05666eaa3c1aeeda11b70f1da67091dd194baf73d714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
914dc2fb48c5019744628dcb687befa1

SHA1
429bb77baeb6bf1d8455629646329178f7eab40e

SHA256
f0cb0288551f429c66962604719aba4d0aed2ce3a3058f1376ee07ebb8a42ed9

SHA512
9dc60c09f3834f9b66d98eecfea3066537c42e57932eb2c8c3853da7ec8a29dbf9c09b3e8844804fc373c1234e2678c69154a50088861c5f78bb1ec7d23a2413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a93cfb74d2a76054df20bb25d74f1b17

SHA1
a856dbf58f3f93669d8e8014b59df02e19a575bd

SHA256
f79084659f4d36d4f6d8cc427c8fdf8847050e23e69969862fd4efeaef4160e0

SHA512
88991850171705be63d8c0c46357ff1c7553f6923996bfeb4300262b65f229e7873f0bdb0b2f4c9672562fc1955529fc286e0c08938bf45b5389b17e1eb4c467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba142050c182c120d92dc189c384d0ee

SHA1
893de83460b2d74fcae2544bb2ecdced6ccab707

SHA256
4bb9ed1215b984cdb322f5f852f588f7bbd1549bc8a5e397c35bbe24c54f5541

SHA512
a5feba1da3765d9d1270ff9f4231ba13297987afe2724e1d325372be45a294591b03ab998ae7ac44b5ffe38a0de6956497c5e944f4176a4551e95d520ca12659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7c9b941cda1cad4f85e050ac531af44

SHA1
72c8d02d7a91813c01f302be6e51bd9f79338667

SHA256
96c80bfcebf6558f3377333034d515aeba39b92e56d1edc186c1eeffc3dff267

SHA512
cb264834e43dbc571e3dbf69635cecc21d65c8c08b5d09dc59e8b071257ae7a027ed349bb833ec17dc44c390cdd005750024bce435f71fe6c5f1c51cc82c2439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43ef560cf4850f58380de385ad44c9fe

SHA1
cc2cf7dcdfde83b1281c8e8612ea4f1e4be436af

SHA256
a33f907b1dc147a18e1894e01f59acca5436d68eb529c32e87822d9db8df32b7

SHA512
61849f7b4c8beed4edaae8d9da343ad64f6fb00a1b494a59fcc6aeb648a540c3e2c1edef7ead2c98b951e7e2512268902069752974bdaf91258ade20dcda8b0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB8B7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB917.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit