ce5d1f1ae9da528a5143d45ea5d271f69d8ce0f5a2dafa01d8395590a7682f8a

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe4d0afa467942f3c5b18ccb54180489_JaffaCakes118.html
Size

73KB
MD5

fe4d0afa467942f3c5b18ccb54180489
SHA1

a74a395427d1ca0f11eb02607aa6a46c75e0a202
SHA256

ce5d1f1ae9da528a5143d45ea5d271f69d8ce0f5a2dafa01d8395590a7682f8a
SHA512

06f8415f22a23287d129e6aa1f8f0ad1eb87d5546a6c3897f125fc46ded44d96bce94facca60b7e7a41e1767680c06fbf52e7d64fbdc6d94accaed6911a36a62
SSDEEP

768:JiLgcMiR3sI2PDDnX0g6s06jFEBxjoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:JvpTzNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3D63191-7E4A-11EF-B1BD-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000469f00da2b8d1fe00b9cbaf01d5bb240d761ae1b70336cd7f48d410006d97d52000000000e80000000020000200000001f861d94e2feb727cf799a8737ea9f00909d835e9f19eddd8271e7744992b2e720000000b7373df4a123d78cfb015f4c524259b4297952a1ad4d0c4c9bfaf4dfaecf1ba240000000dcc91673a4d7615625259424120437bf52394d77d8158488e75db1d778a7ccd234837989f0675156243509415d9cb3ae452953fc88571a57f67417bd00f82d2c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433766320"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7071087a5712db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000048a0f8f9cee0b97902568cfad746db0079614c6b2c4612e8d75509ffb1f44039000000000e80000000020000200000002edd767cff7a22a8204d2809d1ae4aae5f16c560abc23efea079127b7eee17ac9000000049750161c9131e88efc53fdb58450f2fbc56d4238c5f13edfd2ede9863cedaebdf2b07d5e0ebf62d02b5c2a51edf058bc3f6cb6107616d181ef3fece8c27ff3fcfec240bb126e73d85f0782d45f94dc97e794d63b0de8414ad3ae9c02332acb5aa01387ce90ae3ab1e654286c8bf803a41cbd2e5fcb707d7e9cdb000ecf4e3a2f89da159e7de1eba94e69778768ce0e140000000db282f59baefaa2ecd04b82335078c9fcde9d1814aa37c890837f5d4730d9b507e3900ba844236df32b5e43725faeb9a757e43434215ba3986c1e16a0a3779e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2500	2972	iexplore.exe	30
PID 2972 wrote to memory of 2500	2972	iexplore.exe	30
PID 2972 wrote to memory of 2500	2972	iexplore.exe	30
PID 2972 wrote to memory of 2500	2972	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe4d0afa467942f3c5b18ccb54180489_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
087fe29158d654f9d6739e7a8e709cb9

SHA1
633f923100fdbeb00e8a7ea36b72640660a79c3c

SHA256
0da5aeca95fc89d3c68f0a0cb37957dc7c40d21c983e4601706deb942358bc26

SHA512
3e466d3c17c06b64d6ff29a2d72599d3c860d170fb7aaf5ee6e2dc050b81dedb295f6f3c610981072f8fc29f32fabf6cb33b583f6a5d17c60356f65de977b6d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00a020dec931a32dfec32fda637ef089

SHA1
2222a47469567cdb1078359a22affc62ed207e73

SHA256
1cab94bdf44d299c0d457d72ea756f6537733a58af6aec0fbdbd71ad12474c1d

SHA512
ae84d75f86fbdb15ab509b8d54f3fd75a372b14b89be9e4ec13b34a15def15aac24494d519508e0243ae2f79c7e1e11870774f7a0e5a0edf5de48d4beb85031b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ed24a1ad570f1c6ce1a798c1e833451

SHA1
32ab220c58a506d87a55cb7705b381f3d74fde97

SHA256
67c4d0f44145b8ae79c498f9e927c9afb84ee4f7e430bcc088f8f61278496975

SHA512
3241c2c1b5d54ebfdc40b5067c7a19e2563c888b55bd8c60bbda1cfc635d5361105f214384c81efeb3017eea424022cf1cd3851e75fe024573488db7b9ee8e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
694f81757b52b1326da2481f589fade6

SHA1
2c4ce0e09060c711f499383c05fb8d4a1d7f136e

SHA256
d47890413b85a9c5e5a05a02fb11fa7195f044b94581f4b4ab6f47d10a7f382e

SHA512
dc5af3847bae6d108829895270317a16d44d2b5117688e611528dca610a51b7889a3330e9741712eb5cc903bb78289bf18bbe3d14e918051e1549a7946537363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
782c0e982b96f54510424e75e9209dd6

SHA1
ed5734b92817cb3c1001ffe4635feb3f901dde9d

SHA256
c862636fdb46e6c8a770d2f098e3488227a9f00bab3f110b10368fea5f8e802f

SHA512
4ce60e77fe79051ef2fc89c44ca0a55101f4732bd233a3a63eacebe7c00c4fd12a6a402affccdfaee3c4c38ff4b5aff6a00593e67f889846b2c9b7b24f8e1ea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78afaec68befb1a2329f1d0db5e209c6

SHA1
9986bc80481c0f868e61315498712f9dc085d048

SHA256
cf993616cdc39da6e28621a65025e112ce4effb0b72ac3b1867ae835613541f1

SHA512
a27e78a798a2008a14f4b6349cfda6e100e3045035b75f5cb72365ce2041f3bbd323521c588bd88389bb53df1d3aea754e97faa10525546a43876a1152d0e5cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8c4b70e718067073df489bf05f489c8

SHA1
9d28704d4db64c957b7db6468290a27563e26d14

SHA256
80239650d0c2f9dccdc687a8dc11ac0c48b6062746b89dafabf95c719ec7050c

SHA512
07eeeababb0339a639725d9f2f5bcfd3a91068c41e8508ce13a89aab4349a79e9b18ba701177765940a3dd8602a68704bef12e7b37cf1dfce77ae4425edcbddb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c829eafc2318e73babb777b4173d4d7

SHA1
b32daa0289497445d6ffe40c088bd51283877c01

SHA256
5a27ab43e1d91b1a994f5707ada2affc7c102ea0c961f7aa02c871926ed1e0ba

SHA512
29f2978f56ffb4d957eff98adc0496c0f6d0644b2020d6a4074d89398a05b27985962d604acf940aa404d717e9e91bfe92a4a4adf91b0b7feff13457d0965222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50028b9d1098982c8024f06d08a639bf

SHA1
18f065b840f512b3468308163c417236afe0490e

SHA256
d0f32e475b25081eb0f295eafdab64b9a5d4ae17360ec3dc9c02b05f4d0d2f44

SHA512
c935c9b6dce04996735048481cf1fe3468437d2d5ec87ba776ec55e43120b2c712956fb8629d98a19056465e0f16afaf59cd55b5a9e48dbac3cffd87db72812b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81506fdcc2a4cb9d4b16c0b3742be088

SHA1
4248298568647091bef47ed73834e0dbc94e71b5

SHA256
9c56b81310cfea7e65b0e32ba7dc03c75fff6492b2b281c1b8a8c6204c05397f

SHA512
dc70d2c1cd6833d2715a234556faf210cb03cdb36a0eef5d5b6e907d0b5f53ff809d1f8af127697b819583843592458804721cdb9ff82624a85a057bdb7c2d29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd26ed9d81001bcda79ca996a92a1dd7

SHA1
9d46faa181013a44c2ef7777b44a500d7091fa6d

SHA256
e310a46060149d853cefa601fdbe6dde507c5042a59f880f9cc1ce884fc4d012

SHA512
5d9ddfe1f840e5ce920eed57a50d6ccaee789dd662df8aac0bcc80805b8dddcf458f728b73bc4c5a46c67a6e20c3e7ee7e385ffd5080e68a5baf0a8c3e625a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acf02c7e127865db8bca8d37c6422e7a

SHA1
bfbaa111b73377fee2538baeb89a582596eea465

SHA256
df620985c73aa0cc68136f03a46465469837af2a59ce32aac15c5ca8b36f66c1

SHA512
f9a6aa8624a60157b1ceadaa426a56226c51b4399c3b91633461046b0802578543e2ba59470c3fdbe855cbf2041d5601a75304b7650ae6819c9e676984fd2806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94dff07a6d6f1c90e3c4739991250add

SHA1
53a8a374c15cf0e06f0331bc3fca26baa33c2187

SHA256
86f8984329cc3b5a3af8ba8bdafa403f1940a346e36a077f02a1b687a88d626b

SHA512
02eff73c6fc97e6dd72d779783bf8da4133abee4cfde41154145a4e44f0a6923bbbcff4231b2da0be0f24ea348748afe1be082f9bf2b2fa19911de673891e6e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f52336a4ac77e69ea1011b91f578bed0

SHA1
90f44ade46cc6aec69dc6f1f1675101c751d9a05

SHA256
4ee4c9363e231c2cdfe3e56655d57ce717789cefebd0c11be5c48c7bdad3e824

SHA512
b715c521144e222337824124804a9448f299c9e2986323c3d89d3cb9005c947eec0254c7719d76d901bdd4f07143db8c2a81610eda37479819446495d3069144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a95795a8d2378887ba71bb9b9a6e5d59

SHA1
6d6cc5dfc80b7f01438a3d8854298a0544cf373e

SHA256
acfc747833db36a09f1252d650c23594d4a1122b0620939f9dc7c5ecaaede620

SHA512
bbad7a50e8cd3f66ce2af43d1b114b117cc3a47deb01e092fdd089cc80ebaea7a4d161b7b6c4387a7c22b1beb113380dec474d6487f8c10ea0018001f425f6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCA73.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCB12.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit