d0a69f10fcec7995203942b8b9866b68bd17bcb2c062d39c6d414b0982a62a2d

Analysis

max time kernel
139s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe67dc11f534a124cd83db5abfcd9c64_JaffaCakes118.html
Size

19KB
MD5

fe67dc11f534a124cd83db5abfcd9c64
SHA1

2a5e8077a05046d93dcd6734ddabbf00c7abc8e4
SHA256

d0a69f10fcec7995203942b8b9866b68bd17bcb2c062d39c6d414b0982a62a2d
SHA512

e0f4159cc78775f9fa71073268c0c4bfd53c82435bd7eb6368b5744fecf69b2412d60b3fe68af83448e306d363101fca20d57b3089e6968aee1b50424ae7c155
SSDEEP

384:4+QfPFd9QZBC7mOdMYctKfpC5IgSnbmFe7ActY64pLAPd:Zcd9QZBC7mOdMY9pC5I9nC4XPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000008fdf440e4eb29c18e028d0d49c33f368a654bd3765eb06d7fca96353635660e4000000000e800000000200002000000080fabc9fd05c45b4a0b836ca57512d1d1d8b99e26f0e4e491b57e311fd5c37e420000000729f7e442f72a5e2b2395dd7b8b8343ce20284bbfb1136a9acad47ecc0c832b340000000b084aba7efdc82883c1664277c1962f135f5ea71cfbe88c65af42232b846004a7a12d5868348af9244accaad653e81968320bc27f8044ffd402d251f0587b931	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5F30801-7E53-11EF-8C8A-62CAC36041A9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a5e7866012db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433770188"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000000f6559378bfbb7a8628a6e29b65522b60b14943309f0abd702ef2345b38f1784000000000e8000000002000020000000c95e4daebec98e3c0d958cd1c9feaca82238e2d0b254261b29115a5c57f198d890000000eadcbbee4e165f3e745e85f732eed28d1a9de1f04e3b7d951c9cfbc656e17264d33777c9f20b57244a49a703d0b5c9904fce219a6cc62d0c4198ab188fe88e79d25b3e89945543c44f69cb02de677f1e623684383838183458d41f0901c93904f8465ddbf0838bca2c27c29c38f6543f12c3a4a9828705b24f7318fbb8a87c8d1a3950c35d95046ccf725c63c35b624740000000c3b6695b551b1f817d6a2f2a08571e92d60ecf0e5d872b0b0303c82acdcfa8bf57aa52c5842fed37472bf0ed8381e35be2f8ec53b5495b1cace8b6ef8a92eb6b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2668	3064	iexplore.exe	30
PID 3064 wrote to memory of 2668	3064	iexplore.exe	30
PID 3064 wrote to memory of 2668	3064	iexplore.exe	30
PID 3064 wrote to memory of 2668	3064	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe67dc11f534a124cd83db5abfcd9c64_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31fcc788e6c9a0c3e7659e031892cd03

SHA1
1856d7b705616afb72253fb13d1afc730bd2fadd

SHA256
a87ec4fcc04870ff7d4306c0aef8fd0ef2cc6b2d1b1466e18b3a497333178d59

SHA512
01146c03b3bfaf95dcc0f8a566f90ac42ef0ce62694c96a208fd13922f946ebcc86d6b6cd2c865be33b57af491921bacf956fc0b1825d59df7159a7bc271643b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00bb4af29705874d94982ba096e28731

SHA1
adb63a0d85f58097bd1c474973e17d7db19e49cf

SHA256
7c6aa57059e420fc40bd76f04e917c05905d527182d3e3867b754cc4b4f71d0e

SHA512
7b00b11cde1513517c022f62d8db9e6add837e39f2cca723f3ba55a452cd7080b758970d9fe75d6d8fc26a49eacc1baf26dd8717bba459d15f915eaa93c7dfae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d150870073515b78e5e99fe5f19d802

SHA1
b73630160ec647746a1bcb7d08a34cdf4fea7f84

SHA256
363e1b73029d31de2a97d0207847ef77270f38132f52c02597ade3e164012c4b

SHA512
c11711d4ae83d7238129c968667412fd929450c4a321abdc8d55745d589e9c762f890fcb9608013b3d2d826dceec0518cfbae798934bbde7086e2b2f29834a3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79d612e67efdfe0157d33fb46aa1e55a

SHA1
150b7f34464fa919b38955c16b4693c4a36e042c

SHA256
aed05a9714058dbf7591535a91af972b9385165d7e75e943d1c7a4c0da2ce7c6

SHA512
392b816ef5503a245209bbbeec370149d857fc5016dabb0bbf92616e69899a4b73fb03825aa4e8bc88b3f28f3116abb658ba9faa22d32396d1848aa900f20546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9145486f7f96981125eb8166c42315e3

SHA1
55a018857f591573c794ee03286e3c8f28c6cecd

SHA256
57d1186470b4ced86b54081a288c2846886182043d2bd72fa19f4b6caac37e63

SHA512
c3e11b1eefaf57e858c0f26ffab03713f74f67c6efddf123483e025a44d7105279ea3c820f067f42c74c702dfef60c0317b4dcb6a38bdf56d76268dedc83568a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
456fa4456236bf71fcd0f1d8368f6230

SHA1
aaf43c386097364c395084cd4474c02ba9ada4d7

SHA256
33bc61d205f2702ece6eac7af719908142d5719d01873493b63963ef9634d8de

SHA512
3857a678b5dab6546ec39b8cfd3bef6438fadf31b2a819406d1ef95ae76775e8008e47416f37ac937771b62a0346a41a4f5ec53396384c8259eb91ebb0e11fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2e127434e35b7dd4e171beda0a24d88

SHA1
14c83a6b6a2c6f9b5d46aef42c96198ac4af0220

SHA256
5d4d0a6ce3079cecdd86cdf813384743b467807ebd779c34aa02382ea07431d1

SHA512
c440292e1505c2481ce40ecd79d2ca8246429699510545785d7ad674a0499fe976eb3430081c4cee140bf2f6c4622d28a5b1f115044f7da199f44c7f330d3399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9f2b2374901f1d20bb3b6058044913f

SHA1
41bda5f1ab7ab73582790ef0787e8ce134d9d88d

SHA256
817554c9dfca19aaadc30146cf778c41dbe9303a2c2fb16fe6f1af1b36d04113

SHA512
de6d8104d3f1e9d5ec02463816dcc9dfc3bc0cd2f88d979d3977047399557a7218aebd66707a76625e5c3d2c834185036c53da6dee3362eddfbe3f86030977ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ad52e4222cd7aebb9cf831f20401a3b

SHA1
4edfd8f6792d96dcccb88ae4c658fe5c579a5649

SHA256
9970fe40a5adbfff6b3ac06840c4516ee94febb750439b8f418cee2634c146b1

SHA512
f1c83c1e7d54eb4e429206507a73ca30ccaf5c155095bcf3024ea5292044babafc46163e893f46f16fa9d5884b674caf4b1d462c72b4de3f860c41c98f42c6ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4806f1e582a340511d0a0f0fe3c98a0b

SHA1
c1852b13ce51e767e1dba2ae91380b46b79f8bd9

SHA256
206a185b38d40c474b931e521620c0b87ac1fd95e9de10854c2895d203c0504d

SHA512
646e785606ffa9bf375bf72219253fb50acf9eb28c2196d119f6098595630603cb3da1104c12b17ff80f6473dacadb362a99555ef93275498e94a43411e28cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f633bb9313f8c639f837396f99e5491

SHA1
143ca8b070ecdc825959ef9c63c95efddc07e441

SHA256
09b360e23081e1557da8a59466750b7d6480b8cb5058b06a4865cafa7c785967

SHA512
0f05d85036e46e3af55e7b919cf56a482bf740929eaf599e4ab211a9d564e084a6253eccdfec236054b1d506b929247c96d3b2d4c0964657ce9878f580eb5b72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab677C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar683B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit