a8789483dfac3bfcb186fcaa5b32a8322b4e3044d43d00d77112c48b2f10455c

Analysis

max time kernel
143s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd8969cbd7704eb09208337862014b17_JaffaCakes118.html
Size

139KB
MD5

fd8969cbd7704eb09208337862014b17
SHA1

0c8c783faee79dc72f9f6f5a03c7d6cda85a7d33
SHA256

a8789483dfac3bfcb186fcaa5b32a8322b4e3044d43d00d77112c48b2f10455c
SHA512

340cf23d616583fb90d30eb93c83244953dd2540a02bc335a2258c3b06d9b544b2bd290b8a3d5b7f18f1b3b574a971ecb211f0a9288097d25385279aa6093329
SSDEEP

1536:S5L3oLlyrIayLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:S585ayfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08b34830f12db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6BA904C1-7E02-11EF-82CE-E62D5E492327} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000057ab5e53f3ea5060b27821327920ffc72bcf6901c6e2b60898c89e328e6ab7aa000000000e80000000020000200000005dde885d86130c127be28e7c879734598bb2070c8d9d643c8416682c123c17e120000000c3868fbb89038c52f1ff150edb7ec5e8759914fd62844ab6e96df4e4d26b542c40000000fef406d72111b9ef98884dffd961485d264a3effc332ec868b51834df35aca23c65b499693b0bdae5c268296fd38c07b62c1e220c43c3a3374829a9bf59665f1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433735301"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000d07721c48e5c609e174ecf23ddbc20192fb24dfa14e61ee3328d57f2de255cf9000000000e80000000020000200000007281bd4acdd5d12f976c85eca08dc058d0ccda7ff28fd5a60b89951eede0142290000000f4a3c6c665581f94fef52a91d5d2f3ccf756e6a7c9cd6e5d0ab61cb04a6ee057239f1d2dec4f2363bff63f289642b9d08e23b27131a2772cd8bd4482c2732b81e3ce76d415aa5e36f809e116a545efd56979263fe2c927dfd25a50198e33d9e973df7e9cba34629998e798aa88c3636922df026e1378c74b7f7432a45f34361ca508915ec80190b72462de15e7785b214000000079a0d7ce8d07b43024121044b3dc99eb6d1d9faf0466b30445e12acdc06136c136445bcd8d8d40e65c55b7fd37edeeb7d5ce0104fa20a456efa0d4211377781b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2992	2976	iexplore.exe	30
PID 2976 wrote to memory of 2992	2976	iexplore.exe	30
PID 2976 wrote to memory of 2992	2976	iexplore.exe	30
PID 2976 wrote to memory of 2992	2976	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fd8969cbd7704eb09208337862014b17_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e05336bcbdf016513d6d0c69c62441db

SHA1
cf9eec4fa202f880a769f395cfdb69d34c408336

SHA256
dbcc3e3f4b9669e2ec43d7b192eb3ccbd7ae4ddee9c5d2ecf65917f275a67cf9

SHA512
a3b19ac9038af968cab89076a6068d8ff6a739537e99391a91a1b68b9cfe4d4b79f3abb88e7f04b76d3c854be07b6daf163f745a03fc489a1df587971d9d57de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd806d8c7c39bb1f62dd5c2284b753c9

SHA1
6ad32e002baa98231ccb42d15fae92e2c23217be

SHA256
1fa10a8445d95fd8dcd796c401808b7fafe6a783585590ee9b3d5a40f72692f0

SHA512
033b52a9f3c2befd9d83f0a0a68322baecf57759de9fcd814fa70973a75ca25b00d8513e8c92ec023b195fa7ef977f8b7910c45c3f34edc996baf27fc11a9738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eeb665fcb06550546c78b6d4d1be2cd

SHA1
9e8f8e5f79490e89ddc6697c3cc330b7c2687dcf

SHA256
fb786e12e4a897acd50dc72624e5adc4ac2a494bf6e98d55146307ee71495246

SHA512
f359ffe5eed240bc67006c4a37c34a1feaef5c25ace1165a1b356a0037c81985c0b5f79dc08612fc1e28d040171941786ed9133ba6eceb5b3f6e0798882dd05f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be63abfca8839576e7e4c0989819f0f7

SHA1
3b3719737b9b4f8d21686516078ddaeacf4fd086

SHA256
71f4372f3232e404a1129666edf7006b311f87a5e67a4043365c766ddd0692c5

SHA512
fba14cc2ecb5f0a2c54806e973e226c799ab69c65e10cb43759b40b2e4eadbb7db56081afb7a8fb536eb913109a64d25d6ba6c259dd77ba27ccfaeb339d14b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16e07a331a97f51b4e29000b8accc9e4

SHA1
642e8e537fc3edbecec4f011fb8154bb2bc7d7c9

SHA256
12c7f21802c92a48429ea2500fd351bbb140f95a936927e2306673918d23cb56

SHA512
505ac0bbd3e738211d3d527e0423bdb1b7b215f317fc247e09f2ad183a1ac61c0d818423c11b092a6015327638a966a524b3fa7601b280b2b4bb024b75d24661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e70d74712f3308d55b6b0b97cc23e552

SHA1
4b5b546448c5c9ca17db3f8e23f7a667006c44d2

SHA256
37f1024e24fb9a4de63adcc4799c47cdf95359cd52742053275810c337fcdef4

SHA512
313d7763a9f9ba2d844113ba1b5529ce496a13fea567450ced9c3e581085f400f8473b5a6df8c909a21d6eece2204e0f81d6ef701af8addec368c622e1ab5cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fffd8a816e0feb67cb22a2e7e4757fd

SHA1
6af113591460e78e205e25d21e5610fef2fbd61b

SHA256
015065d090364c51b4b18cd531dd6cb21f2ae76959c434eb6aa43cf9e5d7b529

SHA512
166bc4bd8f331e3c8db5292da1b910a267dbaa57572c1b0b21af4b24751e4e724af17900a8d5a88278856098f44d890eed55762ccf20b6e9755fc61a2cee67db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44c070393d302fb1925f5898d4225226

SHA1
c6d155cc2daa1c863a9f9de3feb62da32be1d5c3

SHA256
6def53f9845238fbba700a08fabc92ad6411c34b5909820c33ea4c5a83acaf78

SHA512
e3b975559ffc665e9a53061d92dac5a15c2dcc03ef7e11be10ae0822c549a39eb01c8bbe6472770e8591aa20bee3c1c9000ae1103616a2c3497a4d097421709c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b41e92f64417a4ab760fc0f6ab19c84

SHA1
5987fb40b990133a1b449f8d757d064a33c82609

SHA256
2aed624ec4e656516236dedd5d0b84c86b4f920c3a6270d915432bc907420171

SHA512
d8a708548ad9e0724f790e4885f1f2b8c3bec4c34e77685cc097a08fd71a59d7f416a50d85fa104b0fd9b5dd1702d73abe9e1ae3663d4405c4c3bfb4b92afd9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
094803750c7d8f4b7b4d31e5801d712e

SHA1
b344840fd621dde45d6eacd4425dcf62aefdd5a2

SHA256
679f15828817cb34b670577f7076346e9a93b50edc1ed8d7a2b334b6fc766d16

SHA512
4148e8b6ced679f697a9c079399cdbc346861f00f0ce2959ec73ee4dbddef192cae2c821f863705de721f828a0a4b817b9f82e984a509d66313ff53e6ef57e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
638fde355ba103696548069023a8d926

SHA1
4c34301bbc5f011f67c9b924a7b0f8a7a14cdc51

SHA256
5813fc34eb3d9e6d4c482ac674af6cc7d85addb56ad0b84578a6ea5277ea05d4

SHA512
1baa69a0d08f595177a58364d550ea314deda1d1c20a397e78ace2cfd97481192c56ffe47e4dbe687e690e24373807febce3dc1291c3d685aa3599e459edb6af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be89d9efb4a709286f6c0fddf1b86312

SHA1
072d52c08d4e28aef6d175aebe41cdb52b735b68

SHA256
6a5ba308f61aa1bbbc7e45525974a6ea92ac723ad40a2b31cd90b38fe5eaee3b

SHA512
656cd1b81e11c394ba8503065dea5393a6a1060e88ea1d23363a5cf1ae377db20d88a399fd7a72a726d35d27e51ce3ec063cd4443799e0347d13a006260d9fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24dcfd27f2dab612bf89919c8af1f7b2

SHA1
b9643ff91fb891bb18eee9c873cba1bb76053d12

SHA256
bcd81290be9981331c9a8ee996143c5ec59a57ecd28f7c2110ca1d3ee1c2704d

SHA512
ed6dbbd4a88d8f3d7e5535a0dd0be084e030b2c14a8fd3aa6ca21a9130cec3ddf58816fcdb810fef39654dd9c02b4f8db539090dfbb55aa1395184c05fd14391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e01f5fc552bd5b0a842c99a2962536c

SHA1
451f2ca764528df25c1eda664ca3122a1b5d6605

SHA256
d8980a436cd60972a07080e444520df2064d905d8ba7af7cc585bde3e2ad9374

SHA512
0bb7869e67ab19511cfc175f54fe2282a1c605d6bbd869d0fe957c99d7f8ae571a2b246ef1135dfbc8e65144542071c7b4b0e524713419e88365588fc8ed9cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d543909a5c08158779dd43c51b430ae7

SHA1
f88dbb9bd345e817f99db97c6aa26198b2d8e632

SHA256
8cba4b58f72cdbcb50c9e220117084181786a4f5d0d4347bd3c2192607d49848

SHA512
6d1d5567d1783fa0c21f3ab8e8f0b93b17a0ddb5ae13039124a4178736d120073c5f22d34d07be9586b9e192d65a8508a739711a65a48c5f7fee3fc890bead99

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB156.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB1F6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit