17fce08f0064a32c0125f106a97f15d660c02078a6975c7f02656de88046088c

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe8788cd4715cd1755d582eeef7fd4a0_JaffaCakes118.html
Size

1KB
MD5

fe8788cd4715cd1755d582eeef7fd4a0
SHA1

3d56b1e4a6954709d0ac8990dddf13a46ecb65cf
SHA256

17fce08f0064a32c0125f106a97f15d660c02078a6975c7f02656de88046088c
SHA512

c0a0f8ff29b75851b4ed90c4cd042ac512b740ee8664d324e721ec711f95fbca086aab1bb714a395f3ae337e1e9dac6433881bfe6b523059315c8f01e76783bd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{932BA781-7E5E-11EF-B954-F2DF7204BD4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000072dc233efdedbc16c93f3b5c971a27aeac3ad7ffb6d075619b779d670467c885000000000e80000000020000200000000cc41e2655c167df172796b3b6eefd194eb06757221c100ead0a7aad26ef908a200000002c574e8aad15011f9c6536e07ea3e51a6c90045835381a9d53af4fea822dac0440000000dbbcd688690a622e99f352eeb2c1bcead157fddff5a13c89154e32e80096ed7103eae539e827fe0d5e003b1a911cd2a09f7b16da951767449ccdcb9fa0387a5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433774882"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ddbf806b12db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000003163930e810540ff9b2f0f7ab2c38df75a17f7472c235ee490b04a2bb5d1e1ad000000000e8000000002000020000000a962aee08e6b56d984770972cd5a6dc9eb972e5d8bbb8fd7aa75b1f2d706a86b90000000722d5098536b84cca11a7856fb1ad878ecae98c90f85c58e1958b0c8bae33b83d77a01977d2fefc65074efe5e87abf88c1e78e27432cc95eb658e5645a44ff6865a6899540a043ddaa85a902f4ba3f0f76a2a9e538d213dd1455c12031316afa34ab505f55ea6be78b3819ce540a0b6aa2c9cfa9b13325a5d7ac8e42e11caeaaecf32892fc4b8e232703a672950b0a9a40000000b15aa6166b256e7f226fe07c6b3ff9e837419900ba2d4a015fe8170f645258edca01131bbab6c4ade745f0de87c6c3e4125e29531850519d200499a8b6795a9f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2832	2148	iexplore.exe	31
PID 2148 wrote to memory of 2832	2148	iexplore.exe	31
PID 2148 wrote to memory of 2832	2148	iexplore.exe	31
PID 2148 wrote to memory of 2832	2148	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe8788cd4715cd1755d582eeef7fd4a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e997aa3accbb35724967e49ab8033cb

SHA1
53e94cd97fbbb1635b2fe9445dbb09dbd112bb35

SHA256
cb301b91af6b26f36eeed63bb9f005c4cbba5327b9413bb4c71c582156ae503e

SHA512
4441ebd9dac1a5e74fa865ead2b7dc6ea53e6451f9f97d4f9315f3790c6ee07b22f9bda492a3720aa856b3c0eb148a5ea989d218bd36de2dcd20feb48eb5bd6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbc3603e6b44e200b2c94b2e4498cd41

SHA1
a493766eac44df065d17c605938c660e408f7ada

SHA256
36e314f8899a980c2a14e2f71d7570fdfaf2fee198c55d0aba7d47f03f3db887

SHA512
6f43175f359ab594c25d64649fe3153d81601fe5b875cd566de501b87a9794e358baf0c3a2473739c80299be932f5ebe38b0847cc4a559293369f74c27fa8f83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b98962f34fda10023833aee4cd811159

SHA1
525335b4501013cc835b2480afe8676739ebaf15

SHA256
f214d4aa466c8dacfea1c8bfcb0dabb08bdd00469dac4d22d0658efbc84dcaf7

SHA512
13ed21038755886e417138d0287f1784d3d68e86531320f3f0d834bccaaf5b8f638a95aa8cccd7373c03611af5cfd49526ba960f350b7903e3247c0b30b66211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2e873ff17da44826b4c3640907b7e76

SHA1
68d79381942d038b048a8c1db15287d97c3680dc

SHA256
b72e3f39561f2ea670f4f78d7a50d6faf98b08f913468a23c65c35e9bed52f15

SHA512
c99e90a1e1008617df7d0054bd57bb323d9491a1634ffa75440fb77bd327981ac4563725e2fc527915a89eb7a29f9bd2d0990d632375335004b75e885706b536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7530381d54582ee72994d4cffaed549d

SHA1
22f499d58f0ede67f43e6b581f1a02ab2dae650a

SHA256
bae6ec22cfd5c13e46c16cf3b1795bebb4aebde871091927aeecb27400e1a3b5

SHA512
d6604f4f2ee94850052952d5680aa4ec401a2adc200e4b64e7f56fa4871b94977c533320d2be369802ce29787b4331bd5bb29678ac3419165f936d76b54d158b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e73e5581b57061927d7b4a5ab7fe542

SHA1
20f1e1f48c8330a7c97ea0c020f16115bff50e19

SHA256
480824f346c1adcc64810d1e20c0247917642dd7f653ad570f8ed8a5cf8587c3

SHA512
2160c245a40a082de5883ea552aa49210da466dcf832aea4a529537dcdd0cdef2eccbf9dc9a3ef22a3e1a9e9d4b5d560653717214aec3dfa1edb3171cd173a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb55e3f58d685fcd59eefdcb3fc2401b

SHA1
1429a1a0437b5ac946df8a0c975d30673e8cb003

SHA256
8b8b8dd119cb00ea87470665164e5472d7366965fb8b0b7a167ed37184ea0f9e

SHA512
f63525998241cb53d6f77d98a6d3d71e2543655d1974180d73b1ce276813f17c9709baa0706dd20045574c7b393338162841708a503cdead6176918d650eb841

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90e516c331450536dc403d2adfed76a1

SHA1
bf1e2a13a45f5eedb24d00033e763b8a00431670

SHA256
75605af57ffdca0df92326de20d3b48e41fab2f8ca0af50a72a8137a68930b18

SHA512
dd7ee0c74b57e18a51fa6056eb43eb21b686adbed7bddb08796752c27603d744408aef385f80201c23814677de9877b4238b6e5d8f48ed5b1a3f1f205872e790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69158b98882582d266d3e0091b011b16

SHA1
bc31f7d3608aad71bdcfa32aad8553ae12cd51df

SHA256
5dedf74ade3ca6bf5735cb92b1829fde4f5fa0be2266609f6a9d37ac5d48ab78

SHA512
f43f33d0ee998130ca8c3ee54f6641ded1223ee2ff2310ed3112fa0cfd837d533dd79d0a52cadf70e604dc33f8ed7787f60919713bcb4c81910a4db6c5bd54ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07db906fc61fe8cf23e12d5b0a487c0f

SHA1
1a9166fa43db23554898cb794f5ee47fa3714f63

SHA256
be3efc75e987781d0272877c1681278b895d0b4e152869738d8793ea61284073

SHA512
fc0b9d14cb1c257ce17277c960ea25003411e94babc8e962ac877a7c92c1c904c271c8d78247002bacceadff2714ba7e1d6ec9dd8b6253b931b663422564e914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dcc5aaef40f5ecdc134b97d5383981d

SHA1
e2e2a952d4d82634b353923520c31986edd4d07a

SHA256
b595dabcf391594f9bf4660eda88ee6b45a3fe6302d2a630de6be76bf85a33e9

SHA512
626f3d0593f7b2be29113ed3d2ae735a10c57ec4bed6335c4aad1e5bf092e76831657dc28c4d46e3ed0b76af3a581cdf5909db4b825d025e3ce117074bd8ab40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9FF9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA0A9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit