39732855ff16a59da2129a9598df06c502c1b63534d1ba6c0715d23be365fc34

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcde74eaedfa1fbb78368ec3a66a817f_JaffaCakes118.html
Size

52KB
MD5

fcde74eaedfa1fbb78368ec3a66a817f
SHA1

7625ded18c89b1b4f6c8fcaebb969fc40b2b901c
SHA256

39732855ff16a59da2129a9598df06c502c1b63534d1ba6c0715d23be365fc34
SHA512

7f8a63ce89051ae6871c5ca60fe9b9b318219b749c9c6cc4ab5e0c0ab10a06d689b4919c97c4cebf3a3e1f64b26985fc37aad735894adee9eaa3f0edd1e08d2b
SSDEEP

768:NZFY8jGyp+x54/HNA79xOGfNIE1bguMPG:9Y8ayR/HNA7ME1bguMO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B0D39D1-7DC5-11EF-B913-D2C9064578DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0632621d211db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000b4b4c7d913cd550101578429cacc7f87128772fd39462a614b510e626bbf6d55000000000e8000000002000020000000e7aebd731df1bc9813a0973cb9b223f3c3514b2ec42c9781cb6698dc46fe54a790000000e2a56068bdf7932589697d648402429b332b295455e3ddf16a29944bf2c202ed8afa69bb6e58b112bb9df5037552e9430ce1ff36a1f6fb8d1fbe6b71e280722681106208b7e3decc10e65e5591205424b2110902137d2257488e0bfa08604d292d353e5e7cbaca025556d60690314edeb0506f8b3537500a792831185cea8a6f7195d2c4ad11327f064ccdf4fec1a474400000000a081780dd3e142c6b0fee13fdbba88bf271dc610272cc655731176deedade9501aa9a5f76c8d0b6f8ddf29c05011ca377590759f3cc7233f98747f88078c40d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d8114927e91de2bd572ce0c99d2661e0ded9f52a5ddc4c31aad484142e934a2b000000000e80000000020000200000002bd287c4c1a9937124abfaf736170213e367deb01705e4cf989abed823b57ca220000000bef4c00b10b184a8bda3a61b20f769c8c63e279e424ccbb58c7cef88bdf7f244400000006849d75e325675372936bf51b1e06c2ab2f50561a840739f8e5ed4b093867b9b834b78aa6e20a89a38d124be47cce399f86ef65b3e61c39332fbb0c7e640ca5b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433709047"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1872	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2516	iexplore.exe
2516	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1872	2516	iexplore.exe	30
PID 2516 wrote to memory of 1872	2516	iexplore.exe	30
PID 2516 wrote to memory of 1872	2516	iexplore.exe	30
PID 2516 wrote to memory of 1872	2516	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fcde74eaedfa1fbb78368ec3a66a817f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d43a45f2c4e28fa42d901397f759eb4f

SHA1
86fd063c4acfbacac1417de632502231feb5eb4e

SHA256
faacbeb9782a47a9490fee9c8dc7d3374eb36246e3a7d4bb32f07c61dac62bbb

SHA512
67683329bf589822d2c93a862a6ca0f7d912d33230c1e8fe5fe8df42315a1b2a34281d3989ffc3d1f9abec8c599556f5767cf72f28cb6a40fe66c33383b78987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f968d9e1cbfc6c7f9915f2331224fc9

SHA1
ab5d0c8e63a0868e90d989ed202d9f39aa341acd

SHA256
65de009251f9caf444e09d1d9497bc2bda40d3c53180a68b9e3cb316ad15c605

SHA512
381ee9f5f1e14f166ce548fb62c0b1f3f7728b54eee5913a6b5c61b37d0aa5c1024065c87c3166c29d4c9552f8c8eaed5bdeb6b341549c7171c8f76f3e588ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb27165e4ab436d7989641006c2c5575

SHA1
ed6a4ca3505202ccc6e74a74e4de8850ab8e0c9e

SHA256
caf81d60c1dcf436a92f1e6033088bb0919340cb5d9c7952e928e32925e66599

SHA512
f3f0bbce6443df15bf654ca8dee714cf78244d99325894896741fdc303a8f5aa2b5e704d4085ba982a7c8d3d4aea1554d296d167f40ba789ea21352d4c00c9a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40d701d0f3c4f29b943bc3e72a6a2adf

SHA1
cd3933fa3332743ebe2f7bae7ac6a448bd88a29d

SHA256
a81164fc81212779b15f413d6e971eae5392ae263d5fd22833800ba421da246d

SHA512
5fc1cb2662491b33f6063571d8d53ef5f4531ba1bf17a4f58c606f7278f02fe3c43f6c396d6046724a5bed6fbe6adf86e90c5da87469a92d980aa77281b36a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9450ee071368a02692b408ddf9de51e

SHA1
489b9b8dba8e07b98ca7d8346a751b459798d364

SHA256
2f83c145a2ba3bb00c851148ef52496c13e7c72ceeeff4ead40ec30d98b57cc0

SHA512
a5bd7606b5da9163e52b45a0e1176fb2424812e33656f2227033a5eb78e9c2b94a6fa17d2223707e91a68dc2f2e6463fda0b3dc7f74ab68b4d6c273aef8b9c67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58ccf61308589c59b01036e92b4c959c

SHA1
3fcb8b9ecd0e42a0740b86db350cafb805d7c96e

SHA256
2052e4d56cc354e70a9f61bd7c796ab3f4c48682bad20a3121b2fb66bd28c5e3

SHA512
3eb46a43c3c29eec0f8ec6d4fc851bac9ca630f324a56225fd5d80891b90d950a67fcf1b03505eb3e2a35af0e1a1e8d729a51051614c2bb6316e81f300c3ca8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7094a929d8cb790c544401507c9b059e

SHA1
460de6671bc42a7c1ab327002f1e80e1016217cf

SHA256
b7fe520170183ac9b3b9722425059af15b0304f23f30c3a65cafae22f34da6b3

SHA512
36a967c1391e27cd358413e2528f5683fce0407752c8bef6375275d21de30452eff3c09a68c4afdd16295424b100e33ef42e9766d55963830cf49451fb307a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b76995fd8462b06e46e84617a5e9157

SHA1
ef89134dfa34d7879d561d6f2d6aee588628d818

SHA256
2564073500a36e52ff9874318c6b6186e39053cd9195d28f1672992ff68b0877

SHA512
1af568748bcfb6f3eb99edabd177248dede141582e695c50e7c71769a9270645b234378de0d1a6e6a633bae3997931665159b5a9768d8be16ef2fbbd8e14906d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c56d1da189a5bd47da2f1a09b1879713

SHA1
faa4a0c6826bd42a2d0b0bccb2563b221073ce8b

SHA256
eaac27c548ce2f8246b900caf9ab60dac21bc9d56d9dd434a38a2fb9dc475bef

SHA512
f01b33f17d284767f4582fce1e115d6efa8ed245fa2dfb9d10328b71b49e31a549239d3bc2f05dc7066372312750bc0d3641646ea061b436800d400f9bfd2fac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b1cc27b65f38fe8678553b7d412b489

SHA1
189109cb7b6e8a8ac98aa8df58f55840417bdc74

SHA256
d9537b9c13bcf72c5ab83472b9b0c54f32303b1dd58b78410d6961d33bd0103d

SHA512
0786d3354e270cc90c4b788ef97b2d657c0215b840b70fb237986a78ae7660b929fc0bea08465282ab6f4a70c373729c5330e5f4ef6dc7c70853fcfced3a3d93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e948aa9d50c0ac3f3d736e28c6479db8

SHA1
5c59c97b66d98c995acfb5299ef682d24b92136e

SHA256
2042a348922094641c651c74663ebf7966a88c9fc3edbc7f7addd4899ba3844b

SHA512
e1369a5341e3d878bb94c1e66da68b5c05ed13156e7eb45bf18f104e14873dc32f3c3e82b6161602c854973ad092092da9576a80f688d3ba6645f0f23408d4b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8c6e9a46c5760b8fa38694b7f4ff817

SHA1
579487483d45ae4baec043e3881eceb9a23e7f5c

SHA256
94b0ebde7bbaa80f75a0197a9021fabdaf9c86112cf55992e6ab1f8ca308400b

SHA512
26f1931df8f858a863a1107889c4cd2160b862a7b9377f90e244ef744280636bbb8e3ce2d312a6ffb8685cfef15e798dac1ad217413c7cd8b1c44a7c73ae5aae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6de3eca615570cbbab974fa97def599

SHA1
d1ad477ce8c261f83d6ce5b975feb5c1420ff13f

SHA256
84049ebe310494ef807dc753c1b01df24850621862f179bff5e943e2c71ec37d

SHA512
34d90f93dfdab82bbd8d7b8a327d6a365ca7272b1ee802b207bd9196546125303e13c524766f3cfa73331c954a5084dcf2700cec2891c7a496aebd6ef70d6e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6E2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD6F4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit