a5e5816339187637744f37e347c00518e5eeade452ef302f3afd34654587ab55

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fcace218e5f3bf1cb90c617d4b4925c4_JaffaCakes118.html
Size

5KB
MD5

fcace218e5f3bf1cb90c617d4b4925c4
SHA1

a479325571f1b2190f34df445aff2978af627bd3
SHA256

a5e5816339187637744f37e347c00518e5eeade452ef302f3afd34654587ab55
SHA512

a062715a434c8c45118644efc0bd58fb2428013a42f14aa9f7d4792237df5f50698d9c013ed499097418f1c01063bdaad4cb1fbb393b74f1b280d610d56e7d0e
SSDEEP

96:7PlSU63jz8gAztHB6+B+sLeEGKaqcoh9UoiDJAV1wuraOf4:7PQ8HzthfBRLjaqcq9UxD6V1wuraC4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000006cc4ede6e43381b1940a7eb7fc793c1a20ec954f81780d30e8a58a82d0eeb6b6000000000e80000000020000200000003cfe670bf5cbb3bc964467995d9192ed71f5388d1aba750b83da9bbab1bfb2ce20000000342a4de1041590a6e120f8231b9b250691ed613f17ffeb072bbe16c2ac7ce6ca40000000608c20a8a5b31ded886f76431134b7994f48135666c5587313d62c9101e5314a6ba78e9e39cf4e0903e30663a9105e1031159f62024dd4db0294a1ed96fb1b88	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6439221-7DB4-11EF-BBB7-C6DA928D33CD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f046c0d5c111db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000004b046817b87d817b24a37bf2faafd0e08fc291d6cc0f20ed0e345a4d95eae9aa000000000e8000000002000020000000cc9406cb7b314f0b6a4f569d458eaa677508bad73f4ee097f77ba2d293c1c41190000000268834c33de5e26aabfc0a4bd342e3aa4875fd31036b082b1b514dcc32a2e76d57d9544217d49b520a2dac0e08441124924d2586768dcf582b292f9ff3f74ea138e2cae0222b551e2b8964b0c0e9b898f023a143d4e3efa5b16acf14c8f2c39ab592d648f1383475214a5e31d06e9f5085e8366b49f18e4ea71177039f867be4fdddf34ca4e61a580466e2f4f51382f340000000d465405ab9926c563689cf02469f0884c94ba3c3a719c6093a34dfbc9e67fdb228bb13e4f3cd2c6c40ead54f3bcc92d88ea2dc2432349dcd8773cfafea0275d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433702035"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1704	2336	iexplore.exe	31
PID 2336 wrote to memory of 1704	2336	iexplore.exe	31
PID 2336 wrote to memory of 1704	2336	iexplore.exe	31
PID 2336 wrote to memory of 1704	2336	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fcace218e5f3bf1cb90c617d4b4925c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8995cee0408aab082f16e02d5dba3f78

SHA1
01153fccd06b4c277d685ed5e2e4d792b488f6eb

SHA256
334b06490bf53cb73cb07f0acd74e1a0cda76d0d611445d0dc745704412c07c9

SHA512
3b3211a66d4b6a311cfa1311d08b8945cceaeb4f9b9454d0f6f626a8817ebd0416fbe8c470fc3ba7e734ecbcab16de7b48736629e7206f51c5355abde9e8cc22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8207d0ef347cb2bfcb40cbb102093b5

SHA1
3fec5531cd626c6900e431dadfcdd041fa5edfc9

SHA256
3ed9af154e9986d9aac20c559a3c8e9f2bc45e7a8255bd62177266d75a4f7ee3

SHA512
4272550f7e434df0045ad9e4a826f69bd252b92e4ddf32980d482c445d4196823ef4ad39b48376a115f2b62bb202305e22b85c78a624f93cc5322c054ce1e66f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e00049f58cf6ad137909b4eb42751695

SHA1
19cc565e7a93551941ffed673e58801de41a0e24

SHA256
4315a1df724098c173d7b2a9b7752cffb27597a36fb308ce3ede03dc70b1487a

SHA512
690190fb8d5bf7785eb503825a824912460074d372ad1cba600a8dbad51e3de76c6996416baa62ad28562d6b1cead517ed0a32a86c542b162f6884e7847e9728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21fffd6d56fb29977c433c4b2aae71b9

SHA1
91afffca21f433e320dddfa259da0e9890b97a8f

SHA256
a6bb91cc129b48f6debe5f799b04d04e86858992c845efa866422b472ef4f8e2

SHA512
83980b5399ff733e5a3ee7f425bb545f96aa569cc225d8788a8a971a70d71d520647c32ab5cea73e514770992963bd7bb1c731cdc2f413bdabc0b5fa22756a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90e8b88e950de0c9807b8a47a76de9af

SHA1
7f5b6b9fb1c5eb43fed1330dd4bb58bbfb5b83ac

SHA256
6fbfd3ab5c05982a8fa8f611dd3a98e4cf4701f75e01e210d0498c739dd41f41

SHA512
e3bd6d2e5e7bc1009b6dfc841aabee1111bbed95510a1c85a3caef4ccae14a1ed78255844747cdbe88657db83acea480096e83f477b4e0a41505e5083b693646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
705a83dd6c723396d103c6404aaf53f9

SHA1
8ade2a71f845a7092d3a6919533acd5399734243

SHA256
94e90523e4ac7bdb829346d33e2d53e653c3c23ab203040883a2c8fe6f1283c8

SHA512
7c4080d0e406ab6146f2ec8616b23092c783c98206c65a270351d859df60c3f21f2593665be917b51537424e64a5079a8821f7e1b380b41c997e1c14da354b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7541348d207e069545bf0c25f2c731d2

SHA1
78e4bebb4158dbc2278f808b23c7be67a7d7d1c4

SHA256
82b7c4208224c82eeada4c1bbb5506711bd86dc48335eb937c32454442a5cb91

SHA512
31bab35f8efaf046eab2e64050f653d24e0b7315df44bfe8d641001943161eab0051139ade636c46624491f6a0dc63c4ebe4eec5929473bc701cac8d9dc69756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3edc85bde672fc082ac02652b2db3746

SHA1
d6ac827e991465e19b7814bd5540f7fc3e168b66

SHA256
6f0174e9492b1c88486e37d160f9e8f68b63b57fda13e25db343abcb4212dd29

SHA512
5b07d0048de393431a0dac5d6cc167ae4066b99f6a4829838e7ffe19b3b2084a1049936a49f5a3e88bb30826a2955221de3f327af2b25b8b9d0e16da1563ca8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d41debc88e399c653792fff1da81d5b2

SHA1
901d7619354a8ccd55d68931b475adcae4c6d93d

SHA256
6383a5ed783e056f7979039bca53600ba5d2a572ea0880b621a140b2173658e4

SHA512
55c06c00a44b20ca8efaaa4beec4ff74de3c5add5628a0a4c9ed4309e5182514b05a9e1578ade6209934e740e7d3d7cc8fbc7c39c8e20b10d0997c37c3bb04e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
936a6c11b95f4de1959d3cfeb94e9907

SHA1
f4f0e8c9a0401f2680ca9ed83c5677cd0b6b0f30

SHA256
cd5728b3c29b4bd41a145f6136aa1ef6cc8d29db440c97e6aee74d5cab777c61

SHA512
0e111989daa30fe58a6a33f36bcd8065c3665076c8430d5f4b9fe28e0984cf820ad60a7fefcca42e86827beaf22284a1c7373b1983488458ae5a43871ee7d7b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e920880ad69e8702eeeb30981e4062de

SHA1
a39d3acedc92b932b3c6662ce729165850503efd

SHA256
6e0be7bbf05a237b2014aee50b4d65d587a61d0c4df333b3ec54de12ea751c7a

SHA512
6942370843f7b0f5dd1e2a8743fa3bd6af09b9b796036e64b0d9fef3a890fbb4482c65fb53f2c88ce5b00bdabb1977a69536574b76a59930b3107d2563965f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d48f841de7e354afb17c98e3e884fec7

SHA1
67268ade8997b62dbb81476ebce1e663e9300612

SHA256
4b3ce8e43ef912a36f0b416c714ba961b0aa9b5cea7900191821621acc56113f

SHA512
fac547620d0244661f238d4abbae5835b86eb8cd4ddb403114d67ba090af5910b45cb1e79a50c74edbb2435a2582f0b9131046713cf83d771aacc66b6a025f34

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit