90f516eab4da6a6186d8b47ab482bfeba7bcd6de64e1e86b1eab81c8d9d95d28

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc8260d67156bca7daf41059137abb38_JaffaCakes118.html
Size

79KB
MD5

fc8260d67156bca7daf41059137abb38
SHA1

de968cfe49f6dca877935044176716640000181c
SHA256

90f516eab4da6a6186d8b47ab482bfeba7bcd6de64e1e86b1eab81c8d9d95d28
SHA512

2a15f8c7a3e88386c7639a26fac311f1d22075ecde2fab22a2f3f747c33c84e704eb86b02f6386e4643c7a2360dfcc8fc68a19779ca35b97fe96a234223aee51
SSDEEP

1536:fPOrm46BTzESXJLcoOeWQZLPccaw6E6dDk+Uevc1sVIWlonFnZspee2u6fq9kHXp:CgXOeWCptyyOs5jQ9jWNuI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000056dcb8a325e2513a257c26c7d237bbdaececa9f479da79324d9e2cd98162a170000000000e8000000002000020000000cd6170cad3cda1eebec73fe38e52761048a44cbed9544ebc53b88cfac39ba64f90000000e13401319b3004ef76452fefa37d3cd68731e33563069c0ae539f62cfebc2f61b12dae698f9b8372ed96f626ea05495ff1900ae294f5dbdd0e2a68a1e9559f942498910673716ef31d2b5ddb4449d3b5299b15dee3f0d58e8f0588c00661f2a56a33b3c1715b2d099043510e2311b781d525ef1f84722dc2d905d1034eb783d6fe0cb4f440ffcf22ec583b24f88d03ef400000007f1419843a8719ef43b298c87dd057cc69c3de4be3a9a5752a6dc566aea8959ba66722d438c346d1b51449ad26234e3b1c887728a0d97a50c45f880b2a244d5d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433696208"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000002658cbdfe8460fe92c944b1fcb40e8cb386472e35a5ab969647bbc0013d0fb2000000000e80000000020000200000007434afab5fdb30c4ebb0a0e68af9e3c4a8e98e676446b2260ee0c466cf116cd1200000000110562e66c720791e92747eace94e96d968761a0df6a3f249b0182de1ba32aa40000000e57b30dd27e1d78b9d02d4c434af00b3dfa264c115ef8138056a4f0f5c8181006f92ffd427c444f1db8a1ec6582a9561797fa0b496bf70d60a791793ce926be0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d7ed3bb411db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6705C301-7DA7-11EF-83AF-F2DF7204BD4F} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2784	2432	iexplore.exe	31
PID 2432 wrote to memory of 2784	2432	iexplore.exe	31
PID 2432 wrote to memory of 2784	2432	iexplore.exe	31
PID 2432 wrote to memory of 2784	2432	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc8260d67156bca7daf41059137abb38_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
190e5b6ccfa8326d0dd9561e6df1e041

SHA1
9bb6a7fa0ce5888d885552993fd02d83b2c9463a

SHA256
a130717ea4ef92f472a732109977c14c3cf83d5767bc364f73c83b9d28c95c0b

SHA512
576dfa47bac7beb7b80069975a28de46040cb13f1dae142a10e482ce2a497dba29ff55f6be2f8e1a1fa4edca193f16aefe0f1b4820169efff108e345a902d2f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b4660939b82fa3c60bbf9a943284551

SHA1
acbbaa3dd8f894ea5e4b5b92a982e1cd618fec22

SHA256
77ad215cc18c03f1e5f4d37623967a4cc62c262d0e19d27f07f60bf46f2f75b7

SHA512
7cce8cb72d0f32d48d9b373eb17c151286ba21d8fe71753d3ce40d1c20d4502a3707a3062c5610f080926797576efa5abe4a2f756de22febe48b7fc4ff8fe867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
934038cedc3876a16afecab5b4c812fa

SHA1
ba8acdc624bc676f41223d758d5934169ef655c2

SHA256
0495ca51ff019f446458636b206a20eb99dbf7c082a0637bce848e5c2c041da9

SHA512
653cb8151515dc8129d9d4ffdb07cbf2f2abdab7cf586f133f49d31108af90891ab44de76802e574f57d8212aa014f99566c6071bafcb7bd66803f4fd2a96358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6c980f6e52488aaa5504088288f2e3b

SHA1
21684c1fdbecc9f6f983da956b1f9c55d650a48e

SHA256
6f2ede9a96c2424d4d2c15a9385ece8f8e772abc2d522b01feec7616fb2ee547

SHA512
dd4324ecb78be1466d871019693b65c02d2d9dfccb6780a5c711cb09054cc233c9e6f35d909404852e5bff7e5f8926c247c4f584a8d01588b57ac3c44fa675c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18cd0e6ad1278078540633d5bc2c7037

SHA1
4796f99445a522f482b9e5d610b71a4331d167c8

SHA256
32cf35aae3498ebe42b6c7e0bf9eef2f196fa22a8d286f70d1ca677281c9534b

SHA512
556cb325eb18b776fcc1b894341f8c528007cabf07fd4a8f3e70449209ed988cabd6d73721e1026f708f6bd04827eec48d0a19646aa878c41f358d9c0d381a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47485a1e5ba3e92b32bbba2fd1f4e66a

SHA1
b474298518d787e8de0b7aae9d0180b4c7da0cd5

SHA256
15345cd2f45047cd78e6d0feef1b393fbc52c8ee7e1e73eaf87c16440ce843e0

SHA512
8606e2dd682a3ca0155869b5bb891ec345cd693b3163c2fb9a435067e3c96d093e1ba56bb012642e738d02e2fed4caa29e8743c1f1df7453529fe4ce2c9dc46c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
983b2f25b6e4c4012e17998a7db7dc10

SHA1
9aaf3bc3ca4b82606bdd690d12b13e30791a5546

SHA256
2258c5b543e54943d5cfbe2fd6dca93ed8aa8bb6dada2a5552030c27cb034f3e

SHA512
dec61668a7f89518e369cf73a96dea7d18a738c04a8c95e14a7ad4f9bd1d3d496944032975ed35726cb89a9dfaad6badc0a5d74fbbd00d715dab265361d8f94c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f60edd867c7b5c924728fe034a20947

SHA1
efed5b0c5491535cb2b98991ede233e354764bb5

SHA256
54a8808e740c13553373d9e5073d8a814e2262d31fbe89e603213c43e5b20d35

SHA512
a272db7210c32725bc661d3f3e1828aeee48ce4b1c546b3ac6a05e7ee33d20e6fb85690b378a41bd96038507b06cccff19ab62167cfe742336f83730a1c1ba60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c27abd5910226b9256f2006e753fa09

SHA1
38f548a6a4b04a4e20daf554719f6d74ab08d511

SHA256
64594288f28ac6dfb6468b8033f3280dfb36de1f94b602abc38ee4ed5cdf640d

SHA512
20823e7f6ff788d2be43eb49885da5b241db5770f5e2d7bfbd914180b3b614eda650000d56a653a626bb8b85453806e8e6a37c2a5b31d0b782429dc1c3207e53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43daa248967432920b9d9b978bf03627

SHA1
66c548e41cb04a1dc2bc1ad9ad09d09a84c42a84

SHA256
c03e5342183d472f4e0f26754fc0e79f58991e55f6143d8470d8edd96ba33a1a

SHA512
8f76dbb29358a7c3b183189bd01075c7b74239d0c61ffab2a0bcb9ed410c0b0d050366d86e1a9f7269e4d5d735906fb2c54dbc7e88ab786c0c776602799d6cfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d25946b74ad51edd0ddcfcddb4fef178

SHA1
732899e33c99a4b9d5a85b8ed517ca8485a83210

SHA256
e8e81f1173010be478a32feee8d3702aaef1897568ece9e4d23d1607b19301ab

SHA512
a672123f0f7ebf8b2860181af6fc11637ab1cb2ee6035bf03c43c887709dfea4663755b1052b70bd5e015038aeb9dc64d8063b457e06be28b94b65c28be7320f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar313.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit