19baa11cc0ee8614205b0feba57972be27f4d0230c5d33515dba10c845bb3755

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcf16c661fc7d4c38f8952fc1aeb27c3_JaffaCakes118.html
Size

68KB
MD5

fcf16c661fc7d4c38f8952fc1aeb27c3
SHA1

108acc505ef671c39da6cf9444eb129970eb0097
SHA256

19baa11cc0ee8614205b0feba57972be27f4d0230c5d33515dba10c845bb3755
SHA512

81904e5be0b9d0e26ca6ffb05452b715d4e48660ccc4f821b90e3bedd121a4519aea4c35eef190ce326c8a6799232cfdb6d351924ea2903599d148be5f71775e
SSDEEP

768:JiPgcMiR3sI2PDDnX0g6F5fUHoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8sM:JjuUITcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c32775d811db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000001f9ea482be79a950afc829346011a1cc699bed0546ca5969e68dc4d1b67d6dff000000000e80000000020000200000001082042835b5f343abce851e2e954fdc46be6561e728866b017c56ec78863d7190000000112f91c3050c678356c3a76264614b18b8291aa8055c87af9dd0d8ddc13c1393ecd5756901dddf2ed65837c2ae01a2693fcef8afdf93a98d4b389b12a6c210659f9c12614db8fd5fcc4c77f1fa96550e627d05bad827c40e8ebe4c388cb8ee043042194efce79630c0b346b528877d70911ef056a4dc4f64cfa0be8d5f0e6034e831f032159a030471a0a34f9e1c64f140000000b2104b976569b3e8732567c73daf0ae241078aab7d2e79d12bd3f5d625480d8408c884b6cab775758bded471f9d2e4b74141d766195a0c9fe0ab457c59b80092	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FB93961-7DCB-11EF-91A4-527E38F5B48B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433711767"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000f198d1d7ce5bc79fb350de0d2e6145e7459b0dfd8bac79db0066b6b37b9d3c55000000000e800000000200002000000034c54b5620d25b85beea42dcde0e071e68d1401bf8aa41a124abe6dc745ddaac20000000b0c085750a7b1a15a5f92ec1e7e50b0410d0c90986ddd3056ac547484e0a61da400000005db8e4898adfe7fb465ca461d09e8f2a2cc79d3184386745e0b1bd3e51a13ef68393371e87d71fb7758fa686e89b6d71cc147351e6fa45853f479831bc62b287	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2648	2784	iexplore.exe	30
PID 2784 wrote to memory of 2648	2784	iexplore.exe	30
PID 2784 wrote to memory of 2648	2784	iexplore.exe	30
PID 2784 wrote to memory of 2648	2784	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fcf16c661fc7d4c38f8952fc1aeb27c3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c2c234e176c3a7f4e1b203b018d1fc2

SHA1
f097400f7fff4d9ebdeec7de5ad694746b7e9db4

SHA256
40ca358ae9ea489a263bf9de394e6c235aacfe75b020ee8cc7884ebc885ee0bc

SHA512
625a02625acfe7a77fe614abb38560f8bff0053eceb34fa7930389d2b0963b82732762902ec23d2f8f632ec923da6233363cc8fe0f7aee3de56822752d12254a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f051ed3c749afd4e8426609dd539f3c2

SHA1
689d9a54d47f41887716ae5e4b29f2a7a153964f

SHA256
7b7dc22774887fe82c6ed957b42f1239ce73c7dae35418dfe888f21e6eae3b4d

SHA512
9f1a3595cd48cec1c17f61ef3f0e107b941b3bc9ddd6df9e778a7f669bb9deeca3ce9bfbeb99a885312a31665de139c0a7b64baaa56ee219a9063e1d49715547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
699d344e520c3962b87d9552f4e8578a

SHA1
4d267f76c69a1bd84a7d19400e5a484752119a71

SHA256
5ada349427be921a0d91f947df0c2e0360f9b170f36e5ed6ee47e1045d057808

SHA512
23bd36f8ad7c06c1d07ded21567ab5807a1a08fca006d7740ed1eb2684c1553b4f7d6a46c2ab833217763343341559d5a5068273b13c23f345841ecdbb60732c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08ea38879046c721683bcd5ca1aec8a8

SHA1
ffe0e7ca5d5508ddbb5207ddcf963f5c51a2432a

SHA256
e7096401af17aa624de568784efa9e8216137e194c29debcb14c68a0da62b88b

SHA512
b83adcac94b59c7f752531e6ab5be6db5d8856ba1862e458ec52c7129f69b5cbc2fc91b50c86b7c340d021a68a4bd3264c46deb28a32870e32d0c44b609e479f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
213627e3eb84240c59cefcb5f2dbb166

SHA1
d0766bb226f4159bc9a64375bc791e37d30f5674

SHA256
0ebd866cfdacfd1927e28f0a905ece614d4987753e19a19611eef59f101730f4

SHA512
dbd73949a276b8ec0f3cd4d078ffc5455d5353463c5d586f24919d3cdd985c0a506ccb2ebc21930c3f3e7b9c38e7b66d400e5d440c635311d5507e25d74bf148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7378e6ccf68c860fc6e839c6f87f2bc7

SHA1
5ab254edf9c75fec7dc8bae7997959f00c43a38a

SHA256
a7ffca3da5668e11d16b4defc884794d89d3e8892d40d7a8f607c45f244f910e

SHA512
61433b46abb8f1898a52a3e22f2f3ab2e157eaaa691575311676ba2f2ccba143c4dd5fb31064065e45dde94f7ce51a24c3ecde6d678333c69636ac93b2d4fdca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b80ab25d963bbbb3de122d836c5eb56

SHA1
7f0ba4b8afcfad1b59c027c4828a571377f3af37

SHA256
144674cca96de4802b58c56c2f0241038f1824adaa37911e7195cf3d924da172

SHA512
b1e93f662ddb457b036474c2bfcd656bfaec91c1e6233a5bb07dafd0d4c67b2956bb1216226312468cb2f7b6df6f93c02f5f94f1aa149218a00d24b87a156b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb287819d5eb8147ce3e775a651ea7b4

SHA1
8c54c718326e619d769e62b3960a978af4fd375a

SHA256
4ef6035be35e894a89bf0c0e4ffd69f356b2e51843f09dce0828ab84f4e0eeea

SHA512
8440d9104fe622569c28685b5a69c78b295f364bbdf999b411b06c6a471763ab98678a479157deb3617a40335792b1321ea9c480edb536a0bb9059908e57e444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caf6068d72b0a246dc1168e92e60fdf9

SHA1
be3f8ce650313b2307c4f7b60f02f9d1407cb831

SHA256
183a20bd24d38ef8a5ca2ee6d95f33bdbbd40b8b8a855c6e17024eff731f2ef6

SHA512
d247b702d98cbbbabe751fde2f6690b3d511e560dc9fb7d7f5d4009eea9ee6aebb545a1aa278f805968552c11dbde7d8e6523cf353158a637082ac4f1994297e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99b34f80e43ca49d762c361db24333d6

SHA1
b08fa8c5ecaaabc16713dca6253a41b1258c7b84

SHA256
82354b86e3af797b243bb5995257267d35e3262b049218c8ba48a9bbab184a6d

SHA512
341a147e76d3ac161ea30ef0b6a08589fe89197a0f2931e438f98dc9579cbc8eb850ab4e58ac3aea176c5e1937739a5c6f082f6f04f9c3352ff37d18e839524b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9738dcdc6bb9438c05a217e516786cb6

SHA1
da4d4d8f7ba9ca6e70185f447b15d448c9885d5a

SHA256
23d62475b6667bd1eea8946ec3d02010ad85f652ddb59ee674ac5ea63d18d250

SHA512
97399fdb4552be1913623989ee7c2486330b3c03a8d273e323e6da8806992353a36686841cf42e533df1cb3f64d4a8aa8746cf43944c7bffb916b693edf4a3f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54E7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar55C4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit