6ae8880f0a5866367678acff8cf870c1fbc9af965196aea9fe2cfe62431c5a68

Analysis

max time kernel
135s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdc7e26bea447f4a150a515027a71e7c_JaffaCakes118.html
Size

747B
MD5

fdc7e26bea447f4a150a515027a71e7c
SHA1

a77fc95ab902151b4d65e9d6603d1513a268d255
SHA256

6ae8880f0a5866367678acff8cf870c1fbc9af965196aea9fe2cfe62431c5a68
SHA512

f175ffdcad7b43d3f68ac0d5886e48ae2c755598eca068eca228d242810ed8bc83b5a7398c64e89c1472b16d39258edc18012141b3c4408b3da624aa0799c13e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433745285"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000c9b230a348a6e34a792fd23f63ab521b5995e74da7d01c1770b5d3f89ced5758000000000e80000000020000200000000cacd3540b3b606a0e720b381e5f41b9d106589d8e29858925f9c706e5e29d8f9000000013a7094a1081879addcb62537cb278757470847d34a5ab24e5ef84670653f8accfad8c9e8c22ab48a5b7ed0fef80ad5c49d21e77f4000bbac0b26488240c5514a4d6abc3d56ad5f48326f77c6bdd327fc4123cc88e32dc179ca651232306509f9510a0987c7373d8960f136c6192337d08d6bda49b67da8f2baa22cd6e41da95f3f00f0dc3343cfb163794e69d156f61400000005f0e25ca35c99509ae874cc167f29bab7dde68abd44e99a5a33e1135119e4e5897586b315df750025f2ce28874015b0f13ff41718e0d690a5eae0e43cb41a142	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000040a64b9ae24bfe7cb7309ed5b92702582e2bd34070255786edf423511f41a458000000000e8000000002000020000000a8a4b52f1257b161dd4589355cb01b4828532e5015699709b81f6ebd9e167fee200000009b4d8f4dd7115d8c3363bd84aff6616c662bb2e7d8c833058147734dfde8331f4000000036af62005b0cefb2f2f172ef079fbf64b825c768afac98a52e6e908bd9451e2bd1f5ab5e4207eb4ddd938e38b42c7970110bbd8ce23fd5956b8567cfd0349ce9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9046046f2612db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9FB0FE1-7E19-11EF-8EE4-42572FC766F9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1504	iexplore.exe
1504	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1884	1504	iexplore.exe	31
PID 1504 wrote to memory of 1884	1504	iexplore.exe	31
PID 1504 wrote to memory of 1884	1504	iexplore.exe	31
PID 1504 wrote to memory of 1884	1504	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fdc7e26bea447f4a150a515027a71e7c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
244a53536fd9c2938aadbfd33c38f821

SHA1
4006620bfe29806504ed7ec31d4e491616dd4fa7

SHA256
8d80659fd5379c46d9cf4c5456cc0e7358c66ec5e0bf7da84e221f8d6362f300

SHA512
c1f5e0aa190b74cb8bf530d4a6f3c53e2c7116eaa1aba42037a2ddf6499c3fb2b36fb86c322348043ccea5807b00206e3dcef44971de4ee31261fc82efd09fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b6c32d23e5c0b927d4cf76f1af12a31

SHA1
c43d7c97125317f31532021c261068078ddb5ec5

SHA256
ee1eeb989a1874bb9407b6b5283171f77fbb3e9ff7ef288596965f65d169ccc2

SHA512
4aaf3422b2938de7719de894be4909ca27cea9be227acefa61b2168b6e16185a27648d2d87a6f445bf82d5cf3ea371c661dd54d9d476801ac680c40282d5bbfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16fd1eceefdfb41b3f3060ff01805f36

SHA1
e8f7411f6ad02c9a4399d99e5895a1ab7f964208

SHA256
a41b5310560715d0282b7f0ce03916f11380f3a9b6924e9eccaa853d225f3b6e

SHA512
4d04950888eddf0c16c324f744070e2e9109d225bd599c34a8df3e67e09d9ed6f87bf1bbfafd83e1ba0a6e46d5c24f117610da907efd647884b4214a5efaddb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37f6a455296142e3d5dfc7341c412ed2

SHA1
868bf4939247ac2ff1b89afb6f246ac825174a23

SHA256
827ff8c7444c21fae693a115d095346c3302dcdc1e41f3f37cf44a7272cf593a

SHA512
7316b6818d27faf27c617b7c50fa994928b404876a64b44b27ff2941e1c4680ceaa67f626145929f4827aa07e57082da460a7660d120dd254bac5e76eec01ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ae58758dd90a590ba2db93b40392b44

SHA1
3a4fd1f13463f0f773ab6c8eb10457d93db7f10c

SHA256
0da3be47db1182aa453f2bd04c0726421e9432d537fff7cec51170be16b77afd

SHA512
2d5992007d92d142f90425353acc5dbc1da35b66d17b9c2d7b7647480217c1f19e3527ff5798fb37e701bcaf321a2024eb4dcccbfaf7fca332c24a42421c614c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd584d7f9e6c8a888b7a9b1dfec213bb

SHA1
e8382c22e88a20f52414e37ab9617cb066389947

SHA256
5c5d8c75c8ae3bf856e30488956afec47cc22938ed77227afc0ef731ecc25035

SHA512
b3f020d6690f22934a7428020b99473aa61df9ebeb9f907ecfcdcb11982428028ea94d081ac1f50d67cdb9f95da3006e30e6b2c407d145893c7f1a99ed9ad116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3f6395ad6fcbafc2fbf094ff479a54b

SHA1
f1dcd37017a270c1015970c516e81c935d7513f5

SHA256
0e7d81ca4792a9d59cb1ae166466d7c1e4375d431d083aa64d2a05a33918dfc7

SHA512
425807b0a90a1ccd8b3e71066ac03ff235a6d0ac880378a7d4940c8d26e5aa6c6ba77c37e291459bf4985c9b449bcc245954e302707285d8b883d1161ee82326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec8a9966431ba58f5bba42815cda3b29

SHA1
308d46b47307ae5fe9916db86d9cb21023c496f1

SHA256
163401af634248b175ee46ddf719ea85b872b034f5b639d6d48c44fd079b128a

SHA512
2f4e1b883a00e24481015dc82910297a5a9644308768b924045a59a98c9f1760e168b308b3978e6ee9b7764928ffbbda758b60eddecdfe7818a24f51b67876a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df6d5996d7ed29b2beed3ec48855211c

SHA1
cc47dd4b1ec6b1673f1ab85f1bf73de9249820d3

SHA256
51288af0ded45c2d32db7ad9a48959c00b735e1c498a69821915da61101522f5

SHA512
4d72ac270bc7144de4e10eca3a7480a48113d2c01d3cfbe98900bc988f41273814171bdfffd6f9b012b52383beed2dc607702992a0415452b57a0f0353ed7b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8907bd49a1ddcc007ddd3f6ccf15bb6d

SHA1
76de56dac324fe673667257c3075c1eea64e59c1

SHA256
7d14784f3d894971c6cf053154ea74ef496709f104ee4b805008c318ece8d405

SHA512
1bb9382a79dd02a1c785a3e41358b9feea4b1c5a04e13d9fcca999b76da6f8f69fc283efee503f7730d29ddd21c26a33ea70ca6bf5d08e239e2ef4802cd2bb3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bf5466718e94e22b876185bb8a66031

SHA1
b57bdb8ef096c9accf414e261addcb07e9bb80f6

SHA256
69a6d84d4eeee2a53d5f3bc4363c58fdebfa4cb950dab04b4567b2180d61a492

SHA512
e9e4eedb122b97e205dc56d4b0c4f9918cc6c19af49c59ea50e66be751d6c575124c47cec1fce1e89bd08dfa2134f344bc5ec714a594f60ee4a5c611fe13b042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2da13d5e72027df721b43b9b37664b9

SHA1
b950d0246b4d4a4709a841a8ea735990551ef161

SHA256
9c62b8febe82f3f26eb4a6984f60dd30846f1c14fbeebc50e8988472f112774a

SHA512
aee52182cca153786aa977127804b5f641a876ecb71c931c6341080a4b0ac2e1a6b19ab2ab954fd8fab7814d233e6ba83d49365311faf2f3048123631293fb75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7c0b4afa065993dbb926f45cde67be1

SHA1
71b6271f8f4774929b6e840f1d2e63ee3db7481d

SHA256
84aab19e48eb4be85ce77df544a5649cec6a53725cf63bc763fe52c71dfe2b36

SHA512
c35e5a76d30c6b081e5c7f2abffba36b25d57a819aa7fe18faf418754a6420dc413f6c64c643d7b77e79f2defe7e9d39577a1528cdc5038e50e4d44af85d0a41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93623f3c4dfa3b25329be0d1764174fc

SHA1
4cb9a0c4d0f05394df847136a0ee730bd3311ec3

SHA256
e9b0070f3476065ed526f927d9d69343ff378c1c04daa4f38208d39a194d4cb4

SHA512
a7afdc1d5d4a721120477bc8cbb3a4eca724a7201b3a1083594ffb3e0626ad174220b0cfa3b3fa97e9b2ab2a39af0dca18ed26500f95365a7f192b3abe7cc425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa433e61d2b1cf5c25d96fad193adf68

SHA1
058f9366c59839b8b3f78477b0422fd4b2aefc94

SHA256
52ffb7ad7d991d161cbb480f86a46c4babfda82c186e1dfc2912ac99bebb7c82

SHA512
7f8be94679d4697dc7272e65cf023b9157fcca1938b3c829931ff0aaa6d7297d8452336991f62d59a7b19a79170d573417e9929ff496ce49b242047ebac73d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7aec5241b43f699bb46eebefa293e34f

SHA1
c61368901c7de771a251d9996d7d253462b2a7b5

SHA256
4c3ea97c041f1c9eef599ced605f68a349c782d718dce580ecc23ff283d08af6

SHA512
c8d535906c8308bb924dad87c46f98ff5ed7816bbc7880e4ff49b2f44a7a6e998d133fc5b9013d1c4f3f50591d96b15b0d0af356d0250fc8472f632c269b11ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b955854305ccecacd2cb4b236191ec2e

SHA1
9d3ab914a37f61ced40b0b88cbbacf7fcc7905d2

SHA256
a7dec4b90fc1b9a95fee67507fa0a343329eccab82ca02ea4bbfae1d8d90503f

SHA512
cf8e1d3ea84d2fd539a4a3de31b98ae07732a7beff038507af17b6ff165a62021e03525cae8fa350705c900a85bb7f6b7bd914f923ae825d8cbc4856b58a9a0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE300.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE363.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit