5757f1cbfdc37ce70281e06925608c467bc02cb67f0e48f43eedb0de6b01b3b7

Analysis

max time kernel
145s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe01cdc10a171194c2a9f8b46ca5b3ec_JaffaCakes118.html
Size

40KB
MD5

fe01cdc10a171194c2a9f8b46ca5b3ec
SHA1

0f350e28517efc3e604560cfb4f5fb53c0348810
SHA256

5757f1cbfdc37ce70281e06925608c467bc02cb67f0e48f43eedb0de6b01b3b7
SHA512

dc042c6ccdbf02e2edd0dc511e0637c5ee43824372de0f6bc6bf64e2364f266e6709b70a0aaa8bdf0feab75693479023cf7031193071853ba9700ae0a791bbfc
SSDEEP

768:GTKh0ZYyiuUvvZBygVmz7XzM8/PFwCw42ZxfC44bHIgZU4IWz92cmmMhp4rFpRep:G+h0ZYyiuUvvZByfg0uCBHIgZUzWzscC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000d555b1105b4efc2e2be8e9d112e622f8957ca87c1cc07cf74bfbbff80ffc0ac3000000000e80000000020000200000007f00ae144fc0b14a16c4c595176c6332a6a13d85b4f8a1198bd177819bf7d9a020000000864b755103d5aac573159dba0aec2e6d64c81ca8918399d62fa406aaf1dc97734000000004f9b0c0a0e4d03c8c1ea29586b3f927a7b4e17be67322d8b33a1396d2ad260e5a8c0bd20db46a71370e276c71a8a409875dc334ba46af5588305c1d3c5ef1eb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D278F41-7E30-11EF-B439-523A95B0E536} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802bc5033d12db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000005c0160cd01eb98d5488b0373437e57b320384c51cd8d74d6b2575fdfc27d424b000000000e800000000200002000000035b8b4f98dbb11467fdc699236f4819d4ea20e98bb953af5054410f076a739ee900000008576168a2fb692715f211319675061327cc31c000db0ad16cb73ac117f1dfc78e363f6284b6205bed5f8256ce80284c981b5176da585a223de674978f1077d13991504020d9488fca56b82405245a8c7b803b993f799e5a099a94982619d91759a4d150a32a70120e68a548c642eddf2069c9699242e72fed1958b759be192759575947a76235a307113fbe4d24960d540000000e5a954eee6ed95b51a65bf337edd4389732f73bd458e721e76ac0e015d3d608944bf8eaba0f1c3e57fa23fdb208d5eefd508386c92d0a19012ed170b3d652a4e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433754953"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1076	iexplore.exe
1076	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2576	1076	iexplore.exe	30
PID 1076 wrote to memory of 2576	1076	iexplore.exe	30
PID 1076 wrote to memory of 2576	1076	iexplore.exe	30
PID 1076 wrote to memory of 2576	1076	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe01cdc10a171194c2a9f8b46ca5b3ec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
485b264dd5848fb822cd6bcef6bb615f

SHA1
028ec9deadd8d16d70e7b050ea30e7522d6fb8e2

SHA256
f8e096a1a4921a403632daac49f16dbf5ca44fc807acd98c8d25398fb3e89d2f

SHA512
a1f663b05287b58e8aef98a79c8e6a727426d24a0ae2b452f368eb13f3958558e44b84baed26bfcf619125e30ccc10a8e964a2b9fa184ddb1327ae475e6de009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bbf56a32e6a7a2d3509323729b6471b

SHA1
c58a879e186c149a315d356ae771fdb4758662cc

SHA256
7b79f0910772d4b9dd0f2453de02a7a06826bf261035971bee1eeb3fbd095ea4

SHA512
c9a9e3423a0ad25e6c7ecb0e1d58c493d09dd79c4d3e4ed40511757b0ff0dfc65e006ff5ecddeaa8731acb072d0a74629606d49d9c9d52df178e36713a8329ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f112af236e6378a96b1bd114728178b9

SHA1
df7e6bd29041f92e5256270135461bbe14563e18

SHA256
09f4624427396d979f8bebe168a0750082ec75a00ef16d139b348fcfd411b566

SHA512
f38987cef073a08480bc03325d893309ad9cd0f4924eac21dddea0a37dff23d690abe8de03f6c1a346cc79c1956e3b1654e74f8fa8ef7f4f8707832c011e31d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e7783ad9ebd79c0c94e26a0e7687445

SHA1
381aac9aee0028d444dcd3a07f82b6af956aeac3

SHA256
a4bf616e7bb68ee7428a46b23d42a7af2f13ade7c398a84f86328a759e43d997

SHA512
ca39d818728e7c6ce5efcefa7008ed542d75e323b613f5102e4700199de4a74e9d4e51cb0157b6818862ccd80642f96966857fdbc163a5156b6143734a46ac17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8bd7e11e9a17dcdf452d577db6647f5

SHA1
6e1c4e7f4e30ad2d74585cdd6a8d0ba72378722f

SHA256
e1879738d57620613398eab727ad243db9d122afddf148abf001b856d6ef2c31

SHA512
b98ed92c8ef3d9653ea2d632046acb3d645aa79dca0dd71ce0086483b7a01db6ac39f5237ec38ae25e953ce23557862302994a51039e9ae8e1a57ee7832eee9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfe2eec8aa4df713986b9434b9643b16

SHA1
fc125307482ab811d0943a6f7b8ee4f00e2011e8

SHA256
3d8b5564c8bbd736454ef36bdef53389083c7a982d248c14f75cfb33e4135ea3

SHA512
fa64c23fff7e960b5475466c8e37b8cbbb1dcf34156a77a82469f60bbd4e6542aa5eeeaef7f0f726667fb87eaf559412c0eb4c432a59ba35a780f329af8444ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38f834ddda0b4dbaaed575615b5e1a8a

SHA1
3b0c1201340ea7051a5124c6b04cbe8da3c7a124

SHA256
0f456d5a027fbec97b8422664649b67a42e8519acd95b624266ad00531e42afb

SHA512
0e4424931d639ff94edbe178486abfb20d06440fbd59bc4934fa6ec73fc2e537c74f64a9abab713c508eb88322b225880ead4f8fd83fd36a4dbb13a9a2f210d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a235d2819da66d24c613c8deb5d7b6a4

SHA1
3af8ad2a8c09c74ed6f0bbf22ff6ea4f1f63c694

SHA256
970896f255a06b99a3f088f8edd3ca1f9cd24026dcc16745b5551bec65055092

SHA512
cd821d3e727c7c943043c68e1159ebf8329828575f518df549c190dc3dcd7fad2807694f2a3b24f29867093489c6d8e0e09f4141b01fc02385663b675415a0e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffb1fb6e7b82c92c3534d4089c42fbd4

SHA1
6a3f74e6e57876635ca6b5b51f3607f437240a40

SHA256
cb5a0b9a0fb66cccc95d95217a466a04a85ab6b66491768bf91c0568f13aa123

SHA512
f402f7568155f63ea1712768a7bd4957606e18fa90071a5b93c47072e0baf745dabddc3e8e80899d4d058a6c4634c77e4edf146b804aae39d534cf412fcd35fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8352070354db65a57bfc52ee62f320a7

SHA1
7ab45777525c6fd12319b2941638e432e3f3f025

SHA256
03b6fc12f3ddd204ed4f494a062d31e103e6172f4fd476c670037f164b679f6a

SHA512
7cfecfd741602fbca05bbd7d104ee955165e33023c44b6e7ea38a473d17e32214c4343f06cd3f216342d05522a6accd437dd9cb5e77b7088acc761d1d633ba36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e133f6ddff5da75a0b7158196538c8f

SHA1
d7dc4ce2412fc5fc8b144e436ba0d672ad594c6c

SHA256
73b815bbb6ae157b67cf522c0ace86b1b2299a65d28d337f6869b901cea5e681

SHA512
810cf3d195995cee3aaeddc9e7887d1f1e2f5fbf4916795008b9a6c138d3b011453d63d6955284422ebfa72198fb0ce0218cfd911e4366ff9c6e059ec87834a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4e998fbab69204f0f78956c526817a6

SHA1
37b86c5d2599c754013d3c2b0421e45cf1a7e19c

SHA256
2fa6f6e35258a0d6e6acaf9c22e5ec93f2c0083b10024f31f448906824c6fd33

SHA512
9560f25276a0209a841ea9bdd0775b71fcbb86484dd826c01202fdea47e084138fb1cefa2117b5d9ba19279370c48a91cd8768264856cedd5d58cc4c96dc2d2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76b23579d1418a3c33700d3542918980

SHA1
63e4b99fa456c9134e5015f4cade7ab3c8f8dc94

SHA256
f33b95b18cdb0830f1252b8ee5c20a3650177db5a1b129c3ac3bf60afea2263f

SHA512
495b3cbdf77a7524cf4e5c84461a2591669c699d627d5cbe324693e8fb4a46a64afec51cc4388b098c95afc3398f47ab04e6b5087b78907275157cdf9c979e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fc6c30971db9a420b458b88de10d033

SHA1
f33cb31ca8f776ee48175bd2d4622d860e47f84e

SHA256
b79610f96ee82f0ea8bf79458ff2ef7b088ffb5a5d891360bd7078d4dee8dd9c

SHA512
7403c67be907f65e78ee94fe0b6e2996d67171dc1244b14682a5d5fd952e18855fa00185a667772b1db6e4f0433ffed95607c4a433531449c7f69ab4831ee558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baea22f676c72c90dbd25c46b86d994e

SHA1
f2486a9f2bcc2a6a802df24488f013fffc59b5ec

SHA256
12e04c732f17fab1c7e14154f44763b824c578c418c49dfe1ef87f553b83c768

SHA512
86eb65d06f2e683a68534642b1e8aad4b850a16dbc53d63cc3dfde85f036563f2debaaeb638f1812154b818173cfb4a3de25a9f03aa4f21bf2a9c420dc12fa82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72dade754c84a4b0c793be2a398bf227

SHA1
84bdcb3c1a87e9fb422d28981895312bc187a3ac

SHA256
80b0ed841b9d59e1bb61d5481a444da037aeb6d9be34a21fdb3a87503859f7b4

SHA512
0574a9314ee18c0b532ad59588d4babf99c490b7573fb169eba53ab7733c6f413c5e7dda23381fd6a480ddbdb6363c11f094fe87b55c00c4f00b5f1c306c0867

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB359.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB35C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit