5b845257328b8842654ce99f4f9075f5103c76b3500e115e107d91c347cf2236

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcde0dba7c2b56f91802380a39419d7c_JaffaCakes118.html
Size

26KB
MD5

fcde0dba7c2b56f91802380a39419d7c
SHA1

f73706c40433efc71d2886093c2b369ace0099cf
SHA256

5b845257328b8842654ce99f4f9075f5103c76b3500e115e107d91c347cf2236
SHA512

b11c1f748d26e3e6e14de2814fe67cf7ac0721b5a8bf824f1c2c18ff7c37ca557501bf9888ebb77b6957bbaca4368ceea3d734fdab9f96e5c75417fce8697c33
SSDEEP

768:nzuH/C4DPG61unz7Pq9uQf+Klarmc+4Nd+K5rG53awaWtqYVxnlsx:nH7x

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000020fd49d732eeb3b2ce64a4ea444be7bb1c2ef2685cbecce13934e8d1712495e2000000000e8000000002000020000000996b36b065976af9b6250a51af299dc4744a8e63329b4d73e87dd4e42b3e84cc200000006efacc3acc7bc51c5f8747600e780cf01296775c6de7f2152e2529c0d725c2e740000000aae7d59dfcf0399d7fa602d1d5aeba977d8ca464332c600347de12991252f85a76682a24991f881bf1c73c8eebcbe2fbf257e3849245f96ae03be1576b8bebc6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a74ffbd111db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000eeccdbf26f560573db3a85f309e7795183210a7fa1d34b9af4439f6bb307e681000000000e8000000002000020000000cd9bb722133d591f809e9e46caec5c18e8d2243987772fec1ae0cf6b89bf7f1690000000138f306435c321dfc5eef58fafff4f7953937b6da119c1337ab78ad5abe64a04818c290dce8aeb6ae04c1d540c6178fd828db00bf486f53ba3f692a515a78245f293e187bba7e8f7bc8dad27359a17cc81d9e39f5e32b071ac232f4a76d11fea038f4d66462eaf1cdc5e03ced11175891763dd698dc1fef625d82a6f3bba394e1f585fd33f74fdfc86f5a194b246da8c4000000007f0f645567a446ac363ab0b4a0cc38e734cb9c842c26dd47e318cd31078cffc79fe63bdd7fd8985705f3b74f55c9a3acf08602accf0e0cafb4676935f8b75be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26B37091-7DC5-11EF-8DAE-C28ADB222BBA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433709011"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2756	iexplore.exe
2756	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2564	2756	iexplore.exe	30
PID 2756 wrote to memory of 2564	2756	iexplore.exe	30
PID 2756 wrote to memory of 2564	2756	iexplore.exe	30
PID 2756 wrote to memory of 2564	2756	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fcde0dba7c2b56f91802380a39419d7c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4133ceb328d0c52ed01ab6bb9751f7b0

SHA1
e3f9cc8ac8dfb9448af6ba78a1fbbd13e3203d23

SHA256
3b0129834f2ad200dc2fb4e463cac93cc27bccb7243626761c2f786b492ad1f9

SHA512
616cff7ab51d178eda7a85d333eb39a9f61a2b3b69a44bc8d7519a2fa3576a209711630d2858f81d79682ee72d1cc064259184d82077348ff8e8a09bc2b17326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d17703108373fd9755e90f226f164edd

SHA1
f1e0d81a09ac9e21ecd8b062bb7d8b6b1348922a

SHA256
130a61397300fafbec1965a7d0695de43414824a53b87aef4c439fb82c0d2d02

SHA512
7dd793d830119dac7c37381e1493215f3af9e401431a628aa70796618d712037d29b4365201e0e6b13e82944891d0e4eb9b21ad78ddb5ad3f7e07f60120f0ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
593645d7ac190f1587476203bfae452c

SHA1
3f3ff0a4fbc1a604c9ee13e56492480241df0d2a

SHA256
3c92576a7cf08ab829f43e0ee5da5d83dab49a79112558b291d404c9b2717d38

SHA512
602a1a1994d5ede20073b041ac919700ff8514cdb44641f8fc9a1a1e8cc9857f9d50bd2c7c622cceeee541ad75d470f761c42cd978baca51b571e6f8b18fdc94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d80bc79ee36cf4333610b7864bccc068

SHA1
1d3f2c6b0a3e8e069e916d05a742f45b1c619f12

SHA256
3af65aed906d3e0150d6951c923ed3ee7cc0a13ac38f8fe28310d64d2e9da4f0

SHA512
3b5691fd9d126cb3adcb61c1ede24b3dad8bce34aa05eacc08ad0c9bf987bbe44ca2bc1410206ac7164a157fb47a963dded8eb49cce88af6314cf2e23ee2a68c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80985c9717dc89ab8637ba84310030ad

SHA1
07d3618085b588118c35e4ec1b593d37c1735fce

SHA256
73b11266280702a4d262d615cffa4544e03383c59e979c33af8337264bfc93b7

SHA512
9b0310a4e10c3f07d4f668378d77764938e4d172b8c8f4cbb0db7565ed0c552fd43f605723036a95fe15c5e8a06a576081e39628577e610c01b3fa3c9f00dd56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfb80343bac3d1c24e759991472abed3

SHA1
2e0fde9bfad83142b19b097e9b4a10480fbd1ba1

SHA256
f2be7aa37a6a2d857cf9174d317a6d7c896cc59af71f08ff0d9c7d403839ad5e

SHA512
eddc5b00ac9074bad8c5571dcf87a9b2801895fd8c6c0d65312c48f90e21aead9ae46f03f18c394d60de2de2563423242149b69f09df55ddc3762c1851c3f513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
034b951a3cad311cf70e10c75749e8ff

SHA1
e2954c1cbdef59556ab26287caeeda4675a5cfb0

SHA256
8893fd6aba4453da7389b2a5c72c8469cce24fb92092e76594381aba3951f9db

SHA512
017bac8b5a24a99d49faffeaccdf6259ff9e91faeda20c90193a6350c82d13eece153425d087381b2f1cff24ba9ea000d01190e3f12dc71420dc0d9e6f8fe456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e84e2bbaeb3eea50a641c6afe4027811

SHA1
cc8b948882b59dcf2530821fa15d68aa1c0e706b

SHA256
45fd2ae4bb90fb15fda48c66a256c5df8f8a2f5ad50929fb5ce263654cd1acba

SHA512
aa102f37623c43a292b18b721bbb4ff4c1b237d8d2544a715b2d7e02bb605ad559002167bd96f9a18a47e624a1bcfa2548dc4da5c3d8e5c68464987be22c05f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
722b7d9601b0b6770d710c9bb0782de9

SHA1
84574dec0900e5249c9b5228fe8182e00c91859c

SHA256
fa1e87e7e35a5df8a2de973e8f557e8ae43cbd7b967e37a56858b1e2b6dfac49

SHA512
4bfb11d1d3f3eb76f263a2feb9574e8ce82114ce7687cc0f6cf21ac5f244f083643a51e2c90981f44930e2328374791128caabf8abbcf11c8904961655cde307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32ed4b300a338e2e03e104e68bca666f

SHA1
2a9ceb209cc832367535bb62069513fa3896ca32

SHA256
4266d83669abfbda4983330a502bb13e9b44955487f82020b8587f3e3ae56b28

SHA512
dec8f2fe237dad8df40b5700bcfc8b3fba31d9823f6384335fac0c36b2611ee04492df72047d38ac17c1ddaf6fee3323c9726e3bcc03d5a2cdff88df6b8c3706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86e2340923a97e4c252cac714cb152a3

SHA1
7fde2827be543e89d4a9aa6d49d24cd6e2fc1627

SHA256
127680c0ee656e620ad97233be6bb6e441ac97a3edbd56de34c6367d60bcd3c3

SHA512
45b36c55f0dab625f66b1b373c0d8fff9002fb0b50d78c417943b1034e7c9a2e97232e8468b917a4455298248dc9b5296d063c02c78a6f6c18f437e9741c33cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ce3cdf49b5721f81e41652a0f86dd69

SHA1
2dea898d431f4c262e4752f65d06ea1c4b33c6a2

SHA256
db201d757380505ad8d91cb260a141263f5454d517ca6ea860da5098895cae60

SHA512
8c70c64d620a7afba7b533d39111f39da6c577946933abc391475da5e06436c9df41ca00055f8c4a38d892b9c90b8f52bb71ca0e9dacede0f7e3c1b712cf9756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76b4f0014bb6512ef70a6421030187a3

SHA1
519e55901e41e560b538f114039bc7740a702403

SHA256
cc32b0cd8a703f651ccc63a02464d27f5b8d5278504a7a3d87c3a2d26a726e69

SHA512
e66aca7f1783c7869681440fbc6d30ca290c08d55054e607290d53759d182d9d4febf6ba0a1cdf5f9b2c3e133ac48833f8b94f16128cff803f15823deb7cd5e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a943de0ab1030f77e3bb9ae852276db0

SHA1
87bd084a4eada89289725138ddf6297a4bb80b78

SHA256
05fc4211b6602733bd893e6564b7949e0033977ba4c730414fb8fce861469f16

SHA512
42b0ccb6dffcb32a5ca8f2c911c26c298b891c9ef2ed866a3ecdce43eff911d8ec2ac3ff48396d530804325608f528e96f6e716b653b09d53b0d86ac494479df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ab82aba12e02be61170df08b13678ae

SHA1
62fdcf3983bf439e4ce5d9d60e39bb68585cf16e

SHA256
fdce71bbc2cb7093ea2816ec720e9318fb62054ceb7875b604424d7107865c29

SHA512
4fd5ae3d7de92687e071f84736ed339fa7b3a5a2b78feaab2345fe36476be3cd387e1b469c594b320eb5df59952e923e88e62d6307e69eb98351ec0c90c03d41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5AA1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B11.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit