3269afb74f2fdcb51a3b55586d48334f5828cb6e7bb7a43f056ae5cee436e2bd

Analysis

max time kernel
133s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe879fc8ecd584d66c0cf7ad5e19f625_JaffaCakes118.html
Size

66KB
MD5

fe879fc8ecd584d66c0cf7ad5e19f625
SHA1

715ffbc698c6878ffb71cdcbbbdd4f27fe001f44
SHA256

3269afb74f2fdcb51a3b55586d48334f5828cb6e7bb7a43f056ae5cee436e2bd
SHA512

9016ba5c26bd40db75bc3ad2121f8b75c87c00cd2c16653a9c2b3fc27b45f8226e1d7c573b83bbae66e05704fa3d94384d476f027312808d8f4c6a3d4978cc96
SSDEEP

768:Ji+gcM0St8tN99OIskqLjLx+jwoTyOqhCZkoTnMdtbBnfBgN8/oycc8QFVG8sP/i:J0+GUJTIgec0tbrgaCcFNnzAC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000006c98d46c054356cca575e5380ebee5fde1dc862beec6b1a1e51df9500b86072b000000000e8000000002000020000000fc5e39ceebc3cdef837c6e8bef65294b3ecf3802b18dfdd31478956747d6bd5190000000df07c1545161becfcfe477fa8c3d7840967887fe2db7695de0d6042d700a903bd662798d85f8a47ba682fce4460c318523d1f261a6acd3dddc2a585b2fbcf0498e09313cd943650d6e29875fc74a7bdf9ff7524a1d0e6de4ae4dc0c791103c15f10f87ddc7b312ac2fc399851118baaf8f5bf6c91afe7a1455d7beb32076a0aae9f307af1e003753f0a9c14d5e096a6e40000000be4570d366883121d1ab8753c4edbf17e48967df7ca278d0a9e9922adfc291fd587d1209807cc6e0597d9cfb98334137f9a82ac0076f35cca2a025b90b4a468c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433774891"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004d3d7a6b12db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{991D13E1-7E5E-11EF-9917-D686196AC2C0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000e0eba578105ba50be7f963d7d86ce32be3de6c86dd06de41c28cd5535db9b363000000000e80000000020000200000000779ac080e4342270404c63a53bf43556cb8eed6c8058df1c2475a4a47c2334520000000b915ea4a938adfdf3926570904b13dd7d78c5ea4458bb32d5e354a255e573d71400000005a99e710c260cfc43f48dd163900d55637ceb89632950d778cfcb0e48658db4b70a6199d7318646ea3c1d8c118bf4f7833af1abe601fd43567a90ea59738b22e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2848	2192	iexplore.exe	30
PID 2192 wrote to memory of 2848	2192	iexplore.exe	30
PID 2192 wrote to memory of 2848	2192	iexplore.exe	30
PID 2192 wrote to memory of 2848	2192	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe879fc8ecd584d66c0cf7ad5e19f625_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
140ef0c5d4283cebc0d31156916625fe

SHA1
559a41b4504ca2885c116e71fdc427f0d6671a8d

SHA256
e09c6f51342c685d3daa2c2dc34473ee7c56727293fdf4c129d9d13c063d4b7e

SHA512
2c88ce960295211d6985ae7a3591365e820f9901ad0e8f25e03e9d8328b2ca63b565f03d3c8a3793edd9721d95f33cf4112e6b94be0697bebc2c4fa9b19b34ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57eb9e9f175811bf0bbe8d7468ccf491

SHA1
d4f0a94b6c6fcd3a532cd13bdb87c7d6be3fe4a8

SHA256
140eadc9fe8fa1aefb141ee58c55b9d712fc289f563467bb077f22bd123cc375

SHA512
205a758e7bb370fd7b2e05f2204156e46e3fcae8f7623c18dd4a14a0ab936bac9a84d9e068ad94a9fe5edd566bda571a6673cf4e3e5bcaafff6a64dd4070496f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ad3e513b1aef5899397810743bfbfb1

SHA1
b0720e0fbb6f46870da5ec02058f944aeee96030

SHA256
9c9f9ddea1b1a2ddcc1aae416bd69943a9492b73697376efba6c71f29e7fd2a2

SHA512
ef96d55f414386f71ce05370d039498cc0c69cd0345c11802cdb862eab0d95efe99494a0bff2c975c265828644895aaa2f9e0f709faa8b34cdca72e4d39d6ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7ee9509bcecbee3e3975db6b5999b81

SHA1
9d3e3610d34b7089240871ed28520f058fff4a58

SHA256
d7af50146a8b045094c0ef2d6a69cdb514e6910cabd56a0534ec598304329bde

SHA512
f91dbbfdb8fbccd412f2f42625a9a19ef87fdf4c351b4d5c05a9637be4a7c0553408da853cb93faa3518f962a6b6ecb7e94488824600032d3e84165864f15d2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bc03169d8c16914e72582fdc4a3f52a

SHA1
3057134a3da53001ec5d6d776b3de9c5bd01d963

SHA256
fc53833c68a047384a78243c41a8f6b719e8a01988d68a27563e09734d400fa6

SHA512
92e28ab326d06892c51463a6f026bb1b09a9e755caf4a285e3338a84bf9e1304cd8c90c33a65c20f26337cab0a16a649d50edfff7751f56d22594143a2361fc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d13505681b3446eee8a27e640ea50098

SHA1
b9ec9ab52334084219a858893de049ad0de8c138

SHA256
5bcff5f3f8abbff6102b7f1b638bdb7b1545e0e222edc34605c9446ab7935dfd

SHA512
5cb515fc71001f5dbcd615c0106845c76bfd3018a352b854838b6aacedb5acc699813df75455aace00d5110f052bc7cd8b8b7a1a995673dd61b83885c07f09fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
192a744f9542f75650f331db559eca92

SHA1
34af67dff6d7506e9bd4c8c496d962b8c12f534b

SHA256
038912a433d16c7f7681ffb34455ff30c54b3357e263cef4c159cbf6794867d1

SHA512
32cd1140a29914cb0e30e4dbb9a2c8a2f91159421e6c026dbc0c988a4bb5730ee1ddbcf0c9bf00eba0a953e305943f572d77e4acfd71ea92ee186d80c6105956

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f581f998c672be658a798b8b542ba71

SHA1
9fa043171b207312345c0ec97b1a3df1f4f3cff1

SHA256
36d8a396d0882ca44ba86d7373e2d99f86b7baf5094f19087a0e2ecce936a950

SHA512
cb236c0cc70ca3311fc26aecd6f9535d957f705dd735e755239cfeb7d4913833ecd7ca609121e0f6017d6c41b3687813b181279074de0d06246948b71892fe94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f9a0dbf50fd1a8c2a627bb2400065cd

SHA1
389e8ad12dfad527605cffe93afaebfb17e8b3f2

SHA256
e7af0ee0053cfc082a84d9391d9e2ddb7cd39f421bef0788dc7650655947045d

SHA512
6b3dba9383baf6e8a23f6fbd8a4f63d9b8cdf10f8af5e8e1c476caeefd00b98ca51d11be6357814294c8f4ae1e21bea9456313f1d23acf95780963ad496924c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cd479c014558f8319b5004fecdc8684

SHA1
01861b805f203bb040c79d7ce39de348884eb415

SHA256
fe3ddb2f078940aabc50a0c433a135fcf66237cbbe720a524de20e6720ec9d6a

SHA512
dd9e158faa3b72d5a09edd20bee3fcb5b5664ee7711024f2007083e8315e6078581dea9903c8175d7aeef6a800c69214316351ed8284f94221a21426150b54fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
769bac1dd8b65425540eae2657432709

SHA1
1a41daa9967f8929bce8631d9ef38f7de283704d

SHA256
d25c5776d3eead6cacac9ecc77cc6ec365b4c34c1b635ecac01d2e4a34002890

SHA512
799800ca94868f55baf6017f64c7171bd2b15bed44bdea73c2d24ab7006e202a5485f9b66127f42c93f4f31765911e04a7765a67b8f9353e830272de23f93623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c109163472b4dab0f21aaf8bb14b55f

SHA1
0f7a9c1dbf3237023207a8bb3f8e17b6d8188ebd

SHA256
effa3ccf9d8b83059fe52a38a17aed5218bf421e652a186168407daefe8ad6a3

SHA512
925ebb3943590ee9fea0b76888dad2360b16444aa43e843f510369e379bb66e6063fad9152e2ae2700d061a0add95b01163a0e2cee1d262507184bbceadef37b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDE41.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDFCB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit