a9512482edc7d00044725df47bd933bfef4129fbb772f7aae0f87c986c4d0cd3

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe5884ccfbc5771e32f16bb9f45f541c_JaffaCakes118.html
Size

35KB
MD5

fe5884ccfbc5771e32f16bb9f45f541c
SHA1

b6ad13152ff2b952be43d6d53a7f6e85df1c1d13
SHA256

a9512482edc7d00044725df47bd933bfef4129fbb772f7aae0f87c986c4d0cd3
SHA512

d9905fc0b9370a71782a6a0947c8f1565aacf4842b201269454e5accf1cab62d26d783a16edfae0c69e5c79e15c1df7bbbf67ea1616d76cfd7f4a2bb700cd687
SSDEEP

384:w4s+uO8FI/MHgdgp6kcKvN5B/Ch9s7YJm1FMs0nspesrYRglS48LaAeNN6ZtcbMo:XCFI2p6kcKvN5B/Ch9s/hr5S48LE7XDl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433768036"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A33A7991-7E4E-11EF-B4B0-E62D5E492327} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2940	2416	iexplore.exe	31
PID 2416 wrote to memory of 2940	2416	iexplore.exe	31
PID 2416 wrote to memory of 2940	2416	iexplore.exe	31
PID 2416 wrote to memory of 2940	2416	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe5884ccfbc5771e32f16bb9f45f541c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
170961d8799f1c7c6c02c5d39c42f1df

SHA1
99be0b06f7a93aef655da70a2dd51dabde9f5947

SHA256
1ffa774c91bc568afc665ba349191347223d6525d0f71a55a33f349a76aaf3aa

SHA512
970010f885d6068980eb2e4900ea646ab0b979d44fde15b70b84179d2bbd5b0c94441aad44e86053187b4eb9ca44fe4b96cfbbe5bb797e75b5572dbecfbbc8fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26edb87c52a6fc9358785f0e1305e7cf

SHA1
371b452d68cb9047947e245084fa72e2550b2e2d

SHA256
c0cb12f1920710192439f3fd4b553d28fcf602db24cd012df9684b7264314f4e

SHA512
7ea96128a88a235625299a3fe35ecc1f763c25d16c22d14bc008db56796461e0e6f6c3d56019a7634c0fadb73b2db3e94b6d9bfb7cb460d0ccba021d845b41f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8705ed2a7f0517fd264e1a6402c27771

SHA1
763195fac0036e9755cac7d65f53623b3dc52d08

SHA256
a3775a9df65709dbe90b7dba02c8b8825c539fb29f0551fc92cf823b200a0ba2

SHA512
1752710fde43ecc806c287eb9d0b547129f77e1301cb97ea02b21299eb581cdf660f35b65645b648f656b2b6a7b2c95b0ef5ff268b8bfbbd5ad061d26c106926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48f2e50eaed5e4952eea3f4a65095e2d

SHA1
310eb86b52d588557d4d9c0095bf04f9ed13c182

SHA256
e10d7e7da76cfb433d822edfe0405f2d38b62eaba3452f0e07f0b0a7a99c988a

SHA512
72359f456f785ebb1fb1addfccc7a41e6a13ffd706a3d91f989fb96f65cb69922f529038b6df1004d57d1f40c620e2f94344f622a92fe6939ce0285fe0748ed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21405dc364fedb47c005f5b9121fb160

SHA1
e6ed368a3330a0b8a8ec70221d67f06697b85c31

SHA256
edf0c9f897f864a28fd38ae950d989b36e0d4f30af6db803ca34262f71ccc082

SHA512
afd7ddb015e03bd66ea7b607ff9d0e65e4b9e5b8f28d660dad7040284f16678ec3ef67f7f66594d5ae434210ab27310e01e0749bda2d0ee536d304c8842b6456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65041c83c03726b5d2c17366daa6fcdd

SHA1
17a562b1c0a9b65bb253f572a3a107d5edaeb486

SHA256
b727a30a7a4add4b598003b87753a099d906ff2221e283e6bd1aec437fec5041

SHA512
4156081eccbfca5e93325de6d03f5ffd8c63ec69f0ae3be97d63f533e6075b4d5b9adfda5c61a3d82690bb2fd9ba95e10a66d24955c63607f775bb3d5040c751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b3af4e55c54603094c4283fa6404ac2

SHA1
71ee4c22e32d58a33f5b2fe32b2e73ea5c88b0a5

SHA256
75a6b36ca4e00df44690206e3ef1dd7b36f1a01361d09be06b4f59330f794b4b

SHA512
ea4bc2b20bc9f049953dc69eaa7776ebfe335e6d9e3575cb83590be9fa86281a8bfdbfa127599131540cae7170fff2d193eed95939fbbc628e6c203a59a20d84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24f033c2a3064e3a8dc0b9836a561760

SHA1
68757d63958a42e81ab9f1552426a029850c5cff

SHA256
e6afae0f09ec03c80b0ea3dd75ac2394e55df785f9dab7cb302426828f7fc6a7

SHA512
a8b35c885f617d9931cfdc4b91257e7718d0d45e350e4c9b4b6e706dbac0a4e93e3f595f083b02e0a24ef6cfd9e4988c5b03918516cd22bac14b477e83d4d6d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb76dcb81588404e89ebd343dee757e1

SHA1
9a63594438ffe624bbca2829d1be52a489eff42c

SHA256
f737847c128e5fa55025ae346d24271e9ee835bbc7d71647afc8dc39b053b490

SHA512
f00754d238be1d548aa3b46d3c5c0605605b0b4d1203ff59cfec19312ccf418b68ac163e46c90ca4311760c01b1baa4343a2450546e652d6d85d74b175b235d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f4914e85272a8da509ea8ce64e3c577

SHA1
f5be2760cf11e086d16b3c13b3f65eb2eaeead8d

SHA256
22ec4c9a34e2a1857636e0b8372a6e83c49a578ade5cfee856d61c9874d58b61

SHA512
ac7ab4c9b5dd7bf09eda78333301d05411a29c67af0fbb23d75d521de1ca54b87d64f277c4f60fc8d930d2ec356f1194f6710b1059ada159039a3fab850d9a38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6ca0c434d15270fe673344a2ef1c971

SHA1
84e80b31fa28b96696e33ca42e2f1979acec765c

SHA256
e6629a2cb12335a3dd256e340cb2604359e0d1df50bedbff3467d2d8731131d4

SHA512
62db0e358bea2b5d0bbbf1a05d26037f739c59ce4815601eeb920ba0a5dfae41ba5e4052ab01cd2fd4e69c256ba78fa142c670b81d07de71d40f1b223f344358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5b16b08032a32c5c7a73aa73dc91a70

SHA1
af06b9125675551c89a5ce20d50ea44a9e87ac3a

SHA256
4c66bded687a51e634b95864c5d83537e9124faefd5f4209c70ea63b1e7017b0

SHA512
06645b043efeeea2f522bcc2f98066a5fffa3146e4cdb424fb8977d0dbc89db85ac72d039d66ac1633b2fa34b5fa874f10337be6f993211d895eaf38786f7517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f445e4578f4f670a243a0de48d3ffc7f

SHA1
14e96df62e54d896ce9f7268de09f80b196cc8dd

SHA256
751f710c5b3d1a9f3ae730d9e61053d2497d5a8170b439669006b66700212de6

SHA512
75f7354754b9c5c56bc2bf7ec3887364e614dc1bd807c936c1a4c2178feec3911b1246aabecd5b42c7aec501a81c2708e33b05b203cd6fc33fc0d5d5e6bf1d42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6575ea7c8fd6a3835009315914845eca

SHA1
25e0b0a4593338e540d7ae9faab0361d5850f2c7

SHA256
537ab26efe790c00e505236982b7cd3a98dd1c6b4a0084000edc61378b859cd4

SHA512
a0e2bc5524d04f79003f7e5d30c112c08a291f044e8b15a11744c8638eefba14190b3b2f7118217c9e3e51287151418bcd1e511fa6e8f48f028bae5d45f54b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6073eef3f6239980f6d3e744e91fc1d9

SHA1
8160e26f9f48a39710bf03ae68bbe68e0c7459cb

SHA256
f2b09e16272c437598077248851611cc21c074ad0ef468d9fd79fefdf1a4bab3

SHA512
6a1f9dfd11161748ed7a49f641f97bffa6af3652734b3895e8412abf54820662f5172469250c3786c651716116b58e72c1f93206abedaa9b2120f6261e085212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d8cee48fa3a017b31cab51ec3bbae1c

SHA1
ce8c35839a5f9bb57bf5a66fb404b482a7438ecc

SHA256
8ca3f4689a52842569eeec527fc4d31661c918031fb15633258f5411f8c060c5

SHA512
3cf4a497c2eb3ddbc02664d9b4a09431a4e35d5198c43fd7d12e3fe7c7a02dd2e60c0c55c49edae1b9e1928c042d49281d14055f786382389aa93b3945d05074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e7ec17362a20856b917cdeb2af20f55

SHA1
c0fbf9e016771158afd4076d260ad38709092e84

SHA256
b21fd224858fa4d09d5f203f6d565ab2ecf59c6b31abd077cffe164e785e3f25

SHA512
d3e2014df92e2ae71cae484f281e92a9687d9283f7abbd39b44f680c8d2926bbc76a3f15488b37d5e873aa8b73d3c50bdecf3cd8a4fb0289bdd16d6a355226ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3620d229a8112b7db61e4a76bad1080

SHA1
7e9813bd68e81b8249ca86aa5ab37fffad625733

SHA256
42bee58e523df5f020d3c024e9b0d610c69006408755dd0bf6f09dc317ed4d1d

SHA512
4de7132395b85b570680ccc0e673ac35f409eddc87fde065406a9bbebedd637da781455d2e7b363fed2e24865c03a496376c3f880576f886ddddbb9c9451bcd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD896.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD935.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit