394bcdbd374e689a4b5ffcba32ccc02da95410019c1524b5a10d3459d66cf408

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe4dc27fc00c56723bf9908140194ee8_JaffaCakes118.html
Size

71KB
MD5

fe4dc27fc00c56723bf9908140194ee8
SHA1

a57210dd8aaf58ea70b13c32a71c215b9a960621
SHA256

394bcdbd374e689a4b5ffcba32ccc02da95410019c1524b5a10d3459d66cf408
SHA512

90caad23d0d99ee49b0857ccb085d04e10790c7b41b60a2147cdf95edbc483f569b9ec017421e30d66ac8cd9af3c87914ccd2614f35caf02f4df9170c5a7c355
SSDEEP

768:we2rO9udkOkBg0FsZXlI/XWggr2NnABzO9G:wDrO9D9Bg03/Xk6WBzO9G

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433766488"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4017d8de5712db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{092FEEF1-7E4B-11EF-9DBD-525C7857EE89} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000e26c0dea44cc80aea9680ad7c67d8fa94aa8c5c7513d1662ef04646540d9d6ea000000000e8000000002000020000000bf9e31510d9bbaba3304003c7e85517b6864ca2c3d4b05e128fcacaba75017ee90000000463412783ec2c81dd75969568d8d7df3b0ed08b01693dd276ab7475a95e3a52b92535c4b21cfcd3270bace70d6bde3421a7692d05bc1b4ef65a4002140bc7ebee5da1fa5c9a3e2b4c9f06f28574ade7157bd306ca26f057d6badc348a195c60a71cc740c1d023e5ae8b6e41aa88439f14249f2793207aa1d5384bc293dda08cfd9fbccad75f7960ef9e115598ba40ceb400000003da566366fc471615a71e2146e9ca837970237995f7147f9e7681bae8c77a12327679897c7e197ecfd78fd056aa36a015d537ff376fb4a589f6cdfaae08583f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000aad40f31f6cf9ef496baed34e95282d29c7e6b71524c45f8696f11f409aca939000000000e8000000002000020000000fc05ec2ecbe0b68a7c208c01428a7c38d36a26a060ff7512c446aba8d67ba488200000001c782e079f46b93214b882dbdf444df21dba0fea9defc8ef227f028f1640efc540000000118529ea88d24023b0b65d9e942ad87ad0448ff24be3f914d34c98014ef187082a3a0e8fe09df522060c0a3f435db08625894c9e491e293d07cdcad0bcd2065c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
376	iexplore.exe
376	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 2888	376	iexplore.exe	30
PID 376 wrote to memory of 2888	376	iexplore.exe	30
PID 376 wrote to memory of 2888	376	iexplore.exe	30
PID 376 wrote to memory of 2888	376	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe4dc27fc00c56723bf9908140194ee8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:376 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0816a56d30e64429ae82232b49a57d96

SHA1
72325fa7ba85604a7eba3cd638cb57b7d077f0d0

SHA256
a10083202ed27bbf6ff6287864297af7dcdcde5f14854594e2d9fe312a3386e1

SHA512
5ff7d084ee1ba805afe3cf248304e5f724eea978a8a95f26f451638bde0c3c9ed8d1e50e83278f44fa3ca018c6ed0741566c7941c00b32e07e63771140f4b449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2462f789391b1abe3f0204f0d5390b1e

SHA1
69ae7d3fd87e66ed4009baa7e73d5f791c76fc2b

SHA256
cb6a7e680f5c4610ed974db203f26226d2f7c257998c5a76f294a9ac1b55ca3a

SHA512
5470ebfe3025f492236cbcd43f1e223b19b3edb727b1ebcd64531bd2e0528585df80c94f0024e2b6d7de839433faaa3250ea23edf897e4a81b535a41a127fa72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17d50f7bc7f1f68924da88fb58a3b929

SHA1
fd8e43e7fc5a4a8c6ad9fbf8658aa8f17e084fb6

SHA256
1de51662658c87fda61bc05b2de4f8289bf2d55d99485d354fba54cade5c2f39

SHA512
16ed7d0c7331f84f9f63f8a4e7821d7856f606261e589fd03009f1f0fc109de2939b0258acdce2b650c0563a86c9975503f73b73fdde6a616347f3049ec9ec54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
067af84ec887e526cf9ea7a378595a7a

SHA1
4cca6b675557fb995a840b178554ac240ef184d0

SHA256
f2bed60141a0558d8f683b7e6f98aaca5d9e40c4c27e20273b0571b8cd6a7622

SHA512
2fa152e605f6f37c6760bfe29f9545e89b1b1a6f29a3d3759e4b84f7cc93f38aeaa7ca9e72d0fb5fcd08df0ffcfef5cf7d6c9c09cf8344f993f036eae38e2e95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19a8a29e10586c3268592bb84a9fd78f

SHA1
dbb1d726796ec3aff29f5b68f0aaa2a590788743

SHA256
ef77bcf2387f04064db3b1e27c2c31c7b40e602967e89151c2bc94551bcfc55f

SHA512
6aab0b08e20eb00497eaf275697872b057853b20d3befc4a56589cd6059117299960234a1557e64f39273a0197dd9f91db57b518e7a3f4cf27cde6dcd6c393ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34bc60e842e4671f5aac4f64dba61884

SHA1
aa5e0af3fa46521b48b693af289c01c0f090eeac

SHA256
2e7904f999cf7532e855525243766568c7f4b763e09268fb5aae552eb2338850

SHA512
5362ebc4552d6f79d90e31b9a01626efeebb8054b1ca5b433760c996222efafe879fb7aefe6df00634b989dda7e5041d39e792e83460aa2fc640e65677462c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d2186c2b6b26dc78bbe36bb7750b19b

SHA1
58ee29f8962e6b3a257d2571d42e84026ffe8af4

SHA256
4cf59bc46118df09a35cec493f323b1972515e7efdae0a41f428b9b5f389a932

SHA512
2b45ae802fc9d59601bde5a5e6e215610fbb70eb9206558a5980ed632713b41f77475f93442c8359185c4069f26cc167ab1b3fdf255892c6a9f320f54374be75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b9abe0c667c059c3d4a90323b1338ff

SHA1
5a7239f63eeae6da95d5f2b0fe65df5c0714b222

SHA256
80974cfbc64b5bf0c83b7f5f1e0bb8b91e2f17137b9defe72ab7573301c0d914

SHA512
ad8ac00777b21765bedb348665472402f18e8a711ad7c335540a0bfe181d34df4cbee32a6c6f04c109209d0b1a85e8ed293f8313415974daadda88ffaa1b769c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43a9f65db755a496086f87f69fafb557

SHA1
da3ed4bf0625142d293396179b015128e575157f

SHA256
598ba1ecca9bf78b602dd68283a4b20aed04e2fc732e2b033bec4e5630d778dc

SHA512
c67c1641a37618ad53bc8d719413ab66160cac630d5a1af9c4cb5f8e1a42ef7be1af09a7085ad49402c2b9eeab0a8ffc1492cab3fc1dfab995e705678d99512b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c490fca0d1d8685cc0a63b9cea3101b6

SHA1
915f7e9c1ff7aa863ff4cacf5d69574a8ed6c666

SHA256
efc8d29758c1483dba6a86c599a041db0669b06cf3855d13aff831cfb4880038

SHA512
94fa933652c9b3d7019565988f15d0cb084b5819278cfd3c031b6b1be75b53eb5e619954d9ca1721ca96c10179c7e7fa9f9a132c0c6c7ed84698592f2bfc3cda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
79f6cbc4c0bd43d10fd938afd9633466

SHA1
fa185fefc3bf97f9c58aaaf19f154f36a54f8eb7

SHA256
2dd9a1ddf3c35f0a268adced85f7fd5d9c6638c67d9869ec81e0351f4fb69426

SHA512
c0fd6100537df0d3b9d0b32509f544407f7566ebf31542380e6f5f3fb651dea85934fb6d98dee7b11e54a814998288582b572f2bdc233ef82264602716b179e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f7cfee14a69c9867048a6728c4815474

SHA1
413010a355d0c9a5b3a7d6e558fffc04a21d1606

SHA256
0661f6257ba9023f6289ed1ad0a5a7c2311dc3e20ba418bc2a3641b2902aa948

SHA512
9ac633478b265435b5f5373ea3897fa2e4ec6cdd223bcae9422699bd7f728a989e3c90111cdcb8511fd3c1f720bf97d423f515e38d369c20fe279ea6d15ed43b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6307.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7DAA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit