dc9a87697ec0b12a8a5cd18ae838dcd03d1c14afe9bbd567902bc377a7f7714a

Analysis

max time kernel
136s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fca18c7a7c0be3c350898ee5e62623c1_JaffaCakes118.html
Size

19KB
MD5

fca18c7a7c0be3c350898ee5e62623c1
SHA1

c401dfb607d74da4758912df37c6533dbc2ce2cd
SHA256

dc9a87697ec0b12a8a5cd18ae838dcd03d1c14afe9bbd567902bc377a7f7714a
SHA512

de5b91a7651ae23629439d323d2d0957e5ba37a5caa0b01ac47f81d933e99dcdc95c149e9abdcf12f7bdad43289ae5265283cfe4b9e50ecc11405f2be6d5abcb
SSDEEP

192:uw7qb5nr49SonQjxn5Q/vnQieWNnonQOkEnt1pnQTbn5nQmSgHMB2qnYnQ5bNnl8:G1Q/VqVLc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000d57d5d12f9070a428ab6da358e178f2d11ec008e7f4eae16fddfcb9e72ac68cf000000000e8000000002000020000000524dec7761ab66cb48b6eb5822504c46d74d9baa18d526bc99b25cf852e02f1b9000000045f56fb718bc4def5d6b4d80ae48f55d8eafd3317e6f4f097b80d6547adcc6e8f4e4b83f145ff877b564d57f512484845902d823f683615eae0c6f26c0c636bd69843c77dae219622c26e4ff9b4270f8cf8396a12134c82adddc195d98203f9dc5edb59739c1c1d6f680edfce50388ecbb75b04ffac7c2052ce584dd2e7467b59aba0fe538370f489d667e8aa531c16740000000762930a9718fcefa8416048edb1619e1f3a99d29d712882c39c6802c7d2df871796a6655c803aa59ff4961ed1850ba3782f2e622c775a66f3a0cc28ef5959582	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d0ac63be11db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DCA2F81-7DB1-11EF-A7B5-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000056e4a7c040b3cd63ac90a1ed042bd2744ca333910ea915284504cbc9842de41a000000000e8000000002000020000000817e8c92674d0eb42de5f9e6038db2ab4b8c68f562ca2c822c76b0c60dc122e4200000009f47a1a0697ef683809aacc90d7260576d74db5a4bb37e51fca9a0b09760a8c8400000008ad33541c8203933bd9b4565cc099c9dfaef0ffea5f7beddbaf47496f74589c84cd59f40f9de6b7d48b9d838b03cfb1cfadd111f2eda441d5e4d7ace780023d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433700570"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1960	1992	iexplore.exe	30
PID 1992 wrote to memory of 1960	1992	iexplore.exe	30
PID 1992 wrote to memory of 1960	1992	iexplore.exe	30
PID 1992 wrote to memory of 1960	1992	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fca18c7a7c0be3c350898ee5e62623c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c7807fd8595147d96efe44993dea5f7

SHA1
5d5e10e104ace48b11636802dc6f529ba46d30b8

SHA256
83f663f266ac3c1ca58d09364f95b9e84c2153e9aa456ed7f2738dac1a188a8a

SHA512
43374a03a4bc31bc7ce1b90bda1dc2148b62062855a3ec4532f655b8de985ce78bdaebf79d3f2aa26fd9cb66be2a1a3a7d02a893bc22d83a68d7d699c903ee8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de0c4aed70c140b4bfed8b6e75fc6433

SHA1
c2ed105f3eac524a76c8cb78da471463874574b7

SHA256
7e63f50409ce369056141a66e1c4c84277ffad42dd80e696abc23d7ffa65f4c6

SHA512
2e0f97a30324e9ebc915e3175c28eaa053cde1b257f03562152efef157cf144ce481496fe60aa7820114f22b87c3c497d5c536a90a2e45c516519d3957d3acde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59258dbd44206783b45be3092beb35ff

SHA1
55dd14ae025ae224c601e55bb4a3c2d5d56e83db

SHA256
34e63a873ca740a7f160ac052279775c332cba38323a66d55abe92cd0419841a

SHA512
dcad6b9a9e83cec6c88e2fbb7383ec773091968f9f50dcbdb4995d34ee069541f1afd4d9f0a3a656bde4536daf7321b3feab527be9f9938ab098d782a5d9c912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1efbbabc151471d5d4518af2da635c1d

SHA1
b7c75478fbcc64ff4bfdafde15125420018deebe

SHA256
3e997e6c5eebd510506deaacd96f8ffd382c4ec4f6429ce266dd7ed0bdba6987

SHA512
6b4ea6267689864e97dd1decead66f31b70f39ece203d1af47dddff4875158255a3322dfa6af25395101a2a75d49e96c2c0c0fb4b8817df4fcccf04ff6e7d9bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5252c4e6e6a4f66dd908a26932c062df

SHA1
fd3eb2f9a30ad89dfb8fbf892d4d1b0a650d88db

SHA256
d1343dac56f5fe120fd06e7a14af4544f508a68ad2b7246055a5377503dd85c4

SHA512
86b0d5cf4955775cacd39b2330fe728bc99816e6ef046d22157f4925bcafc8ed2f3e83f65bc42b54ca612e5eb132d0fd9c7d329d9cbcfbbf2fde7aee3c57841e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f6d2a789b3190c4e5203522483f554d

SHA1
d53f528d88ffd0c1e9b30c883ec263078604a2ff

SHA256
8637708a3f588c548001d265184c60784d0bc2001be328a3f0767bf21362ba93

SHA512
f105c1f0cbdd873eb2512569d052cd352d7c94030f1fa2486f4dc30b1a588edffaca0bc756337164c1999d3a1190831e08cb63132438534e542246254c4980ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3836acabf2e2caa0b22c6425ab141eb

SHA1
5ef72181e0f57a50f8368ebe69377d2212427ea7

SHA256
ec621a5674a19fc6b6d450a226ed8427adebe4499b60c25277222f8cc810f240

SHA512
6889c41ff534ace0a3194eecb64ed03d678d27862d8db7f47593e2ed8f48fec427fd3652897e52047cbcd6e2c226523ef4c5d2b6d5109922a8f310b0dd9817de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1acd7288d79e192364e85e61650d8fc

SHA1
2cacfd0267fd6494ed2e9f613ca2bcb37d5c2667

SHA256
c947e94a123564cce34c8d2c8e9fdcf8641d2d4669ec5d595f49799f7084bac1

SHA512
58332fe388c8060980b452537b76f23690dccf889a9c98241a68add26fbd429ad85f61e138f279f49599842be69efc8c0e9816b194657d90fde8a1983d10f014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a331f31a2b63485f4a60832aada8fde

SHA1
1bae9eb416b4ebe47de8bfd5e92e305967c6729b

SHA256
3ff49c97a7c98e4b04fb717d4b22eb78befeb2484a74a6a4f16221bdd9817bb9

SHA512
50f0b98226f736dad7f2d47cf6b4005fff8eab47cdca8059012e66acea66ba97b0bf815ee26cde2eaa3080652aa0b940cc980a8a5ab9ae30d99b72931da162c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98bb26c72a70b58e77379442c034ef7e

SHA1
d253f8adb600416cb689ac9da691df6394235543

SHA256
fce6cbc558e60aa7449d922a481ee201b6ecd18e606aa8936db77f98da5253a6

SHA512
cf83a1b79a18cbb4d1672b0f7b1644c9307928165d6c99b4368116bff5261914059eb4a020ef2cb3035502fb1940fabae0e7e07e4c363438b96b0e4ba6ec6ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58c7be9d75c78e15dda4241310bd0302

SHA1
ad5b8597da2f2e75fdc845dbf63923845a88adff

SHA256
b2430bac7d0c15235280ca77b2307217b26000490a38f53ee76216b7eabcb7d0

SHA512
4e4d268b9de2663c1f509e271b17dd3c279cdf3267c62657027da27d2f3b232fe87e168915c04cc2f7aa2bbdc3ec77a667d915964c84b05caf0399e4f42426d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43d6e01f112b33843268f57ec0f03544

SHA1
9338b96d1ed1572096957bce1862f3b88ec43644

SHA256
2423af3290b9307921ab9bdd5c146234d6255c526bc051d073bfbf9c67d9c3c4

SHA512
d73058e67f67d51fbec7521ebfb60b54a0997d77ab153083a7f80879d6d6f81976ad7eccccbbfa9678e72dc2b9490efe0094524dc61be0a2ef3e3ddd153e35d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
717c9cf8905aea6171fb68acb6091acb

SHA1
157a75ce0c97b4738264312586d1d8d9d55baef6

SHA256
4166b3ffd8d9a931d9f3534de28a39241add5e04c4ab51b4debf7587e0af9c5e

SHA512
dea6e47a6c9633d7deabc8293aa9351db1f3b54e9c765a73a0bf67160b919c5d8e3bd9052280c20357c819bbc0121b8c11c0154a1c595c522aeff277f203429c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
766bd1f796aa6124faa00a7496476ed5

SHA1
7c9bd8afea048a2b16fc23a6540806d87eff4f52

SHA256
5085ce410aca3cfd209c5751f67d8d3145e7e104ea0debef7f0c53a8c6e3bbe1

SHA512
d41b7b7094855513d478e10054042f2439948ef6edbbdc410dd59843a01b731d0ad64d9919fde454930ba965139c65434ee0018e83e93fbb9bc9cda7669e602c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB435.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit