596daa83734b791473c00df2d9e5774060f7173fbf59e861a8efafdacf9838b0

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fca4501c008103081a7ec43e455678ff_JaffaCakes118.html
Size

65KB
MD5

fca4501c008103081a7ec43e455678ff
SHA1

8a6aa2e91b73775276c777788816919f2f55f0fc
SHA256

596daa83734b791473c00df2d9e5774060f7173fbf59e861a8efafdacf9838b0
SHA512

155e75d56464efa80ada3cbac0636064f20d3b393b9455609332d91ecb4c139b753e26cf08058125448619075d768f4eceaa16a33047ae5049be9cb445a51aac
SSDEEP

384:nxuhxY+7xo+X6J4Byhgg34GQtvDdQubo/eCsDNAIv+8+RKdYRypMMbXPOH2VuuHY:8pnQDP0jF0sb2iS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000054a3cef57a51a3c74e15752b29ccd1b5601e25132b21a567e81ec42ef7916757000000000e80000000020000200000002c0d21e7419076df45cfb408e14a9a5f251cea823a215339db55e22650260d8220000000379cfc1044855cbcc583eda13dddabd890826b6ee2126ab9e01055f709df1b54400000002beea740f82869e600a814c9eafb9f99f56ddc0315ce0061169547942326226884a9397360f85e0bb317f5ef2d0686cb7136ba2cfe595d5734b9ee1bb8d2a1b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{439510A1-7DB2-11EF-BDBD-E62D5E492327} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433700877"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50095a1cbf11db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000004582a5e3668cd57773d9ab0918da59d8d2fa7c69573f8f3a2df8eec2098e115d000000000e8000000002000020000000f898556ff721d4664e5837f6b9724403ca0b3c3632f1f065ecd7ef383ec4b80b90000000ca5111821c8c54972ca6620b9f0ac839c2af00656645d6b01e7fe5fc34bb616201b028ec5d36d5d8327841288613ad6fa9ff51f0f98d51b156300204e26cd60281cb310f9dd4feceae6f2dfe6acb49ce16622fcccfab4dba05e942cfb763562587acb23ca04c6de64b5dfabfcb063bb68eccba75ea41ee16c4b7c7acbcc16d1b17567e37f95a6480de3780577a9aa24940000000e2b308c7424b4bd24192a3baf91ceb6eb4e5fc927041bf1f152d5d71c300efd4dff96dd147ddf433c16a2c58e67a30180fb4e88383d6d85f08fdf5661efce7f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2452	2336	iexplore.exe	30
PID 2336 wrote to memory of 2452	2336	iexplore.exe	30
PID 2336 wrote to memory of 2452	2336	iexplore.exe	30
PID 2336 wrote to memory of 2452	2336	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fca4501c008103081a7ec43e455678ff_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30468cb5fb8d2fa1c3c61b517bba5ca1

SHA1
c9ca90459be1628a1d00a3a3d60f02556cc5c7e6

SHA256
092b3dc2f8c1464bc5af36ebde2f8e22dbcdfa3b677128e815d8882875913ffa

SHA512
73f72ff65fffaa3e58095b56af8add793127e185a20021aa84a61623972e9445aa5299e2cad3f5bd7169b8d43df3e0e0ae85912d11a0eb0d4ed5a9ef1d3a3b4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cad9a5030d7d706d8a10a0c78012807c

SHA1
0be2e0f2a0ef582cfdb5c7e8ea241e2f2388c61b

SHA256
8bd8b99aad88de3e021178539028dbb46d11e49662cda693f00b09235e9f6b09

SHA512
3153256fd57ee6fb6befde8a29eb43ac274316d00e0bd4c10e8a2bce6d7962124e8be1fa0221322a70482957f3f7fe8548726e67047de1341bfdb3dc5a50cb21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1709e8929c6eeaae39c31b32a55aed22

SHA1
5c04a865ed5c92737f595b0d0fd0c4fb284dbee3

SHA256
f147612713b02eeb5aaf26cfa289ff1262269323e89cef94e670caa4346b7a45

SHA512
5ef29075641fed0616c683fc12a192f7f403ff8bedc9403e1ff24f925a17e02ab5cc2dc3ba790afd298c02562206fe0edae69166962be8383e22bbbb0d49a008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d0307f6decbf4072994a076d6d4994e

SHA1
e653fe4c9ab72a1085398c21116bc318aa6e0ff7

SHA256
38020df14f62190b7e97d78f852a799cdf31828a7a9c35224334091139f0433b

SHA512
ef452746c6e8f7b72e5ed092b7c44baf1a739613ebea3bd9d7f7fc01fc6a73e0d6b992760a54b536cce682dda13cdd6da5585e6a5fef7dd87cba5a780e872b37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a96cc8df72c7994a2f9d9c458108a1b

SHA1
18a0d3611c4742ba0cd7fd12bd9a1cc1c909f559

SHA256
0472cbd152b8a6fe2c6b4717ce02e4f4e717d27d6e28b2ea5531442b077722c9

SHA512
2fc4c392a773695858fff3c4919180c85abbbf515a39a183bf877e5be8a3758888ffcbddcf9f0af83bffc3fb09fff6823f571ef67635bf537c7bb0b94d8d8ae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed03a980378eccaf94ff7b5ca02db240

SHA1
00af2061ea108857acf35b9af6f4012b6d177f8a

SHA256
9125b0702c9a7655911a00025550836add250e401a4e928c04fc5d08dc90bde5

SHA512
6fe68245a048907bd35c3f37df6d9a85413b2e82dd40764b00f7431f2caa414ef0534144e361fe8b81c9cea9ccc7224607a5cc27cef2158b4a702bb23cdeba55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49944ed38b6b5c207ceca7973aa8b519

SHA1
c26276f90bd73b9cddcc4d993398215f7d052c86

SHA256
b76c62757a400d2184722de9d2313390e53a4057a4b4ed5c4c77f24aaa34733a

SHA512
8b1356ba4a5f6c098c20b74f6570af7bfd756ab1510d46c1840e30445dab92cb28379dcba2fe194aa308936153ca87144ebf13484deb892f0676c851c5f4edd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4244c42595e3a5d9ee11066d5d4c58ec

SHA1
5973b565b595bc50c57a9106011a4ce1c5c4b362

SHA256
d991301efc3fc764cae8f1e08ae203924c63333182f703cdd4e8f57dfd6612a1

SHA512
ce67067be01f606cc0358235058d519712865d3dd5b4aaaa4e8b6941fe57d3a1365c39244e199b7c3e63daa533dca13a180c48ce9d2dfdd9919568e8c91fe8a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ed564811c6cbb82dfa269b764be611a

SHA1
e3f9d5aa476e1146295b0b95cb82106ff68a048f

SHA256
bd9eadc2ddfb488f7644a346a7d42290d6c396a356d471e1a963fbcb7f1f7bba

SHA512
eb83d226e5571ce713719a675f00475047ad4dc3a0b2072acb9ecf210c13b2c118e3d707bcffb4b088a2fa870e023bdb3574270ad5d4593ad8dd9871a8fdd7a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b68a0b7af893ca55df193534a3524ea

SHA1
3c026a428a40acb42fde27eafab3368c895e6700

SHA256
20a61d06d317e99c164e7f8b22a82e4269fdddbd4df328f35a6d683eed68f1d9

SHA512
f0e24c4ef198dba34d669aeaf6dac4e53b467035160e97416909c63d1fb0893f9a1200030467f0ce865813f1db6f1663546824fbed10d142fb05c525718a721a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
100ec0131890923aee83b0b867d1d6f1

SHA1
5bf5fc8345300ba567585823963081ad1665e32c

SHA256
cb5f444bf4dfa8c5548b9d79a846153c0a2a9a2846bd579db4e64d3f03129eb7

SHA512
d59ad8fa4bc1bc8004571ddd54b6d0fda636d7739ea394b0729d1d9a1122474c4ac9e442a96dda28bb6ee8648ab6e8b1951ec452b74455a5f5b8860943cd13c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0959bae3284706617d385ab9b7c88313

SHA1
88aebed6b40af132caf1a8f2bd718c729f70feb9

SHA256
8017f266625f83da4b1da3e06c1256e06c76769c24b991f4e75e1bd08e58720d

SHA512
7a13539b9de7ec7bfa03e7e8769530971ccbb6cda7822f09b86856e0697d087e2cae8bbdf4ef2aca92c2acf88c479524a4ec3265c0f555276b10851d2afbfc71

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE2A4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE353.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit