85fe216ed58b16165eeab7ff065e5819c08a49ac2f27fc054f3a267b37d2e27f

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcb21a15caf9e8a3ba63a14e882880fb_JaffaCakes118.html
Size

21KB
MD5

fcb21a15caf9e8a3ba63a14e882880fb
SHA1

0f0fb0a7700b6d50c845967f8c4a1783e2a87b08
SHA256

85fe216ed58b16165eeab7ff065e5819c08a49ac2f27fc054f3a267b37d2e27f
SHA512

442323c5d7157856b3deb7481766d3ca79d6ef0eb58c4f338194784f7c68e99829789f610ffa0221294cc9e7c047945c4c488961c4055fc2bb9da412e0229413
SSDEEP

384:0SeHRXXVcPwEpwlWiphzk9hj94VqQOawFWiKypbHwh2fXSn9l/LPT8OqcFbYXnI8:Sk1pwl9phzk9hp4VqQufKypbwh2C/LP0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0810dbfc311db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA7AE851-7DB6-11EF-8DAE-C28ADB222BBA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000031d85c7e8cfb6d649177b74987ee2ef57874820799a2e28f494c045ec7131fbd000000000e80000000020000200000008ed6e02382b6e2bf63d7fa4f1a6ae5b999d0553a316b8d6ad45a54d59d14c983200000005bbe288a8f0090e8c7420464f9ca233e1b216f95e91a78e4847d3a6fb90af414400000006c3727459ae57635d1f97ba92f42e241f201bae8adb135127e0226a9c029fb6004a457ae7d0a9b2c19902f66f3c049f62d98fb44e54d910ae22ba83f5dccd219	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000da5fda0883f2032d3b255fa95f02bb24841fac1aec9fd7479a22bb1768ae5425000000000e8000000002000020000000084f2c513451c2b02954224281eed6efc9969affc3794602bcf58c8f37c4028a90000000873a2880d0c945b735e8006d3370423270c23d9248f36def3e706fcb775dac76c856d09336e7ec75e9ce3c115113ca988c267e1e97cdb7084ea968dd0b51212db669c9b0334cf1e8b994eda5a5ea74198c0b470124de094083ab51b4f7903f83e9261a0a99db2e02f731b9e0b89020948a4c2731efce49024e10ba4c8b3576dc806ab8bb9c4c3d80ed47868a6ab8780b4000000040802dfa4fce900028b5d39dcd2c4f63aacfdb21bf11bf4cb5b1aa98132325b4cd6e4b4572d6236694059fad8f4972be230b73fa0934c7a48c40892b7d40bf4e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433702871"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2748	iexplore.exe
2748	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2960	2748	iexplore.exe	30
PID 2748 wrote to memory of 2960	2748	iexplore.exe	30
PID 2748 wrote to memory of 2960	2748	iexplore.exe	30
PID 2748 wrote to memory of 2960	2748	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fcb21a15caf9e8a3ba63a14e882880fb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fc1c3b7e93ed49f4e1052651174e28a

SHA1
f7d015e68f71a33f63e5d7459f8bd58bb3705b8a

SHA256
0f7a9d5ca33c605a43fc55f8e1a79a4bef3f3443f624e601b97ee5f6a97e349c

SHA512
de96d648ab1ecfdf57072b467735b0636f17ffb6565e19854746fdaf5a51a825d7fa3c70ce4e8a3e463ced128481e982b56aff0ce9b75e4b05f9891de8a9bb33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
792b5ac120e80f3d542944f1ef04dc1a

SHA1
fda7a9d05dc7432fa31435d02094dddc27ca7252

SHA256
c493c10396f94b5c6c175eb0b1949a99b510eade96ece59c50a3c9cced68e54e

SHA512
c9302fb2a0e235d0919c26f0f8a3952bd7ffc0136f93ae569cc2aa6678346e39da1e9dee95544d0a9a356ddb4a206bde91f20634d1c25c33e0ceb119f91a1995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c348a63c1bb20edb9d541ff5b66f6d66

SHA1
3c5fe66c88cb7d64f566af40dfa0a24f97b3a415

SHA256
c7adfef9877e2c6d1c5b4ca69771581bebb94010bb7d15a603f8ab86c4cb98ce

SHA512
e90de1668d2275d17cf5dca7c8a919d39e3d0f36a60479b2f2043af66ed6ccc9301d1b0a0d18fcb0f4b9ac7da3da6e578580394e20b98be002d3cd006989ea72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7b352c312f35bb5338640e5931b0382

SHA1
12fc9c08ed1ed4007e623a2bb77faf354854ef44

SHA256
0866e498a592b848ccc3c03915cde46418970a65e4302098e9d647183025281f

SHA512
a2cf56aff15b27e3d1a6e86f4d933d7391911716da0dd144690d5ee819249b3c52160b0266b616863010385144816809fa52f4ebdd916a3a8b0465f3c3213892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49d45ea15fcf2bd34815de38f9acecbd

SHA1
a2bd68e0e98b2f8706be5877857f1c16fcf753a7

SHA256
b5dff73e318b321cee923250ed96b8e5626c7f52d5c8782d98ebb69117fc4842

SHA512
0a7e97f8976c321ae7908c6c61cc27d028e4346da93748f461ed809acabc9a9fd64ce8128a7e598e9418bb239cd9a84015ff095d454f50bdcf7b24bf6e26e559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
866f78344737edc395572b65abe43e62

SHA1
cf62a8ec10acced6677c6513d0f911cf6a1d2398

SHA256
70327417d038a4a8c3c9728cffc7b392f66678576d5c09c8dce80f14c9f2dfe8

SHA512
a8dcf004e42315c46e7a942d18d24ca1d23240ac512de49fafe0bbf673865430cda9f1695433f33d4956468064d491047a24f3c1a883499f25f27835363bc4c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf754a06ba950ad0989e883fcc4a084f

SHA1
bda6fc096fba30eb85c652e909a34f54de643e3f

SHA256
38de360aeca4e6e1544ddf81702f71d97637d1f075767a8803154b5bf33292b7

SHA512
684181eb90e6cf26d8c255a301e65b5562ed668c38ac1ae4b18e2290957fcc57b3269fe4166b5c4723acee8870206ad4e05987bca5e2245b9b37e8edcc57bd56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebceb6c8f5c96a778763da1d42a7ce38

SHA1
c2d72e8220de2512fd39c3eeec03ab5281a2a57c

SHA256
f90d97968de5c22d0869787e1b328187c83685a2dd7704de7a7894ce6508e155

SHA512
5cdbce4dbf4c20a9929d36e33128bda1c9ebd311759fd08463258128a948468050d2deff82ffa9063ddde4b7d8ca7f12f257d72d685d1735a0175fcc074f1e0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09c04dc7a1455f694f2d945cfc887bfb

SHA1
49e7ae054b1ec3190214ec57da2798faa25ad2cf

SHA256
e43a6d8f9c73433f6119eadc908c9a75ad64bdb255183ccfb34868cf7984a25f

SHA512
58f0cfdc63aa374f9b576c65c1516c7b4845a093758381a0bb4fc107322dbd1cc226764bf816c31b2e0544ffd291b071f6ba3402509abaaa884c497de423db3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56c1c9fac2d59feb87599a6eeea0346e

SHA1
a924c20fab2d118735bf7f4f30b42edace1b311f

SHA256
d7a6b4697120c38cb0a3874948ed2bf22c9c0c5220db3922f033efa55d55a3f8

SHA512
de18ab7c90465de8a542a5fbdaeee1f6e44363dcb808cf06717e6b4782ed72903190242cbb62336e5b5d80448268bfe499e7226fc9c261538e4a690992eb19a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae342861df8e77137bce8dcafc6bf414

SHA1
05b27f7afe032c6a1025f27bf7e764db8a8345f2

SHA256
d7bd7bfa4b99ba324820e3cf54fd8369bb0ca63d07eb1420d64759cf0bb35d87

SHA512
f5bf3e6a35d24af55dc6a96dfb5a8941d694dd4537ad185998ed27514bdad2389e5a1024de33155ec07ea7ce692b63dca077d606ea3c6afcf14bd51563101544

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd9aec22eda802796b8de481147d08c4

SHA1
74e1541ea44f360e7b43910fc6a5dd5140b0477c

SHA256
c6a0b208b636491040d03851cf093363901a20e096f82f4c44417a8a7db10502

SHA512
b627daae3f096d061c0e6469817f2dd3db5c5e7d3d782336e9000ed657eaee8748aa209b31f803ee0ce6547c51d640fa43f25370c6168c718b222ccb439616d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f253ab94abe91a4a0fe39595f77924e

SHA1
dc87f67c41c2f37baa9d1b68fd2d762fd277d9b3

SHA256
7fc2d7e93b91809e55048e0bf1cfafe275ddccc302f5b3159de078080ea698d9

SHA512
a2ba7c8a39541ddc0a520b3760c14ddfc7bbf49b4d17ddbe0790d286b106a97fb5fba0c06a685aba70f2f9fc0a110a648cf2d9e62a2ab87c6b267f727b0259bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e049986b43f93359f5bfc80475d244bf

SHA1
37b74a1193e9cd70938ca0bbe13f32dfa79eb0b9

SHA256
4d1a7589c6ba85c15e23df2b9a7b622fa515690897dc431e99b56f47f061d343

SHA512
8e84da63340931d43092f3f6aa5000f4b3f295072ebf8751c5266d610a4f5bf523e89ae22a86f9d54ac5d04509a8721b3592952bc66b0b0734cabb3103551f59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceb85c39f5a2f510f1fe66d2d7d0e41f

SHA1
5f0c1d63e57f37311b53a509c35528b60ce96ccf

SHA256
a0a6b148102c22b24d0b19ab37bf3a1094263bbf4ed27896068687fc7243eab2

SHA512
8182c9b355ac019dc4328809b1335676d05bf2004f9416130451dcfc165dd5a49d5eec47b6af0b218c4e6aa8e616846b8b8dda978d463ab7fa8db0b0fd9b532a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5AB1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B11.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit