e42628a02b313e34b98c754d4a3ee19e7f3fec74161ebf262ccdda2920b6471f

Analysis

max time kernel
135s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fea52811b5ff86921e3d07dfc5e2ee85_JaffaCakes118.html
Size

27KB
MD5

fea52811b5ff86921e3d07dfc5e2ee85
SHA1

e3dc11181543c11001430cef6ddc658d3053023d
SHA256

e42628a02b313e34b98c754d4a3ee19e7f3fec74161ebf262ccdda2920b6471f
SHA512

82dd1e88c3d86c033aa618e0ccea10ea55ef58dcce6d4406180c235189434a4c55e0cd14a78654ddeea1c961530ff526afd38dda32d8bc1fbcffbf557609654d
SSDEEP

768:Ghri29WIbWpLt9A38MhKGzgrBh2UZxahftfWGnimbm2dXd+BCPYqZ4e/dOyQa9i/:rqK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000d5b4fef00d5537465f06336ec66e9311d7185916bc84f30f59ff5d305f7e29b9000000000e8000000002000020000000fbd86064f20aafe373acb37b4945f2b7ed73e567e900123cc513c6e42400bbce20000000ad8f6b52d2e8a10f3f10499b2f53d1731f3c3778fe2ee4634c7898b0f9c8d15340000000f63e6ae78f86def42dfa791a41699d7dbc0c6e2dc8067ed2525925c2b2f8a91c6a995b88d36ce34f446ed98212b094b92236017793f6185b9fcf1e2f254feef0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{611B0CE1-7E68-11EF-A97E-EE9D5ADBD8E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cb5f377512db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433779094"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000e7adf9c0ee0d583f1c2bc79909b817f6bae6d976f28b58cd6e22b23609dff664000000000e80000000020000200000003d259b8d0c144cec5b6a00329220217df6e8dfc92dd9bf5fe0ddf653cdfab1ab90000000e52b125a302415f32bd7e18a1460f17808802f875edcf5392b4b2956475eb748619109fc2a5b5c71a2023e169cc1921f79ef370e4f4de0f702e09972a8785b94c4b9ff5a29130a2d6b7033baa13ede7b2e8f999f956ab696f91577a892080a5a34808f50d3e892d76d726c184edb3165718a5ea73a6332b487bd3c7b310a552603ef5f1ac815b9011d0e70dfa6d1e2de40000000f026da6068ef7cec2339500092ee778b2d4e06a4b441b3582b4e2d1e644acd4334d9a3d7b10dc4bc0fb2283b8cee4af01ef209f56edb278c21ed308cd0f72fc0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2404	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2404	2536	iexplore.exe	30
PID 2536 wrote to memory of 2404	2536	iexplore.exe	30
PID 2536 wrote to memory of 2404	2536	iexplore.exe	30
PID 2536 wrote to memory of 2404	2536	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fea52811b5ff86921e3d07dfc5e2ee85_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8445c9b588d4655a9a6105ae541f2da

SHA1
0ec3e51f7e71502827a6158333a6c719ddf4e07b

SHA256
107ad1c0fe9a08f06d5fa76feac8a627763faf12b9dd46064627a0c780898d6f

SHA512
43e0281370d362acc7de32fa164cd5b932ade2adfdcf9175fee371dd10e30c87e8a772efba8fa38fc92012a374348a28034b2e53b4041b53cb8bad1271f7c6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0858c81266f034ff0d6efccf2247bb6

SHA1
3e5409ce5c513766fff029421a9c1a0c0c9a794f

SHA256
2bc537e315d0641c8244b72c82c8c7a87e4ea5993f9d4a77b896557c9816f6bc

SHA512
3d4239077175fa82462865cd88c98c36da7153996f0a37618e1d1f3dd0040e6e3006b5e3db99a16fe95089ace60bb31703065e1297190ac7275608666193bf10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6455ce8150a1d7136030c2fb5d5d1056

SHA1
a3eafed412f7513018eafb779f21ab96febedce0

SHA256
e0ce6a6b57602bf1a40111dd01e714929702a20a4c69c21fabb21922c8bd068e

SHA512
5df7d4384410c16aea333e12b54515e978a79632c2626581899171926423eb32acc80d9a144f5d468cd21673a57bdde78921c3aa4bac0335b839de92109d085f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb4718c260b33727f9c679ef7c352a94

SHA1
76d3bf6d28d50d2d176ef5036d50573fa9432d76

SHA256
6b4c7e1abd42f3b3f3d27ded7a28cc78de45954496d8dc437f8aea8489a0c46c

SHA512
d1e8164e9300e4b049439e26bf58bd51b2bf06ba2a3011839260e20a81561012803ccf764c658a42a8f93ea844cbef6f8e550ac64c1a3adde86375135eee1829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df012947c335e93d3b627f611ce5b27b

SHA1
3508b01ba38e0dcaa38b1495649d296f4e2fdc4a

SHA256
006b30562974ca0c873c28dfe2edb1054fed0e320fa130f4fb09441a128910a4

SHA512
b34a93c92fa010d0c999c237f9663d197dc32866a772ab366421e9b33a972d037742cd9874b5a79e70e304107ddd3a01fb2011297c87d27b95b6bbe8da92dd2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
636d563b04140fe1e96368fdaafeb404

SHA1
6738b9152d510fecd7b9d90cc2f11d4cf69a5fa7

SHA256
48b151bdf85b325cf5b213cfce41012a34521f76010319668790c3e449707c4f

SHA512
92c4a5828c467287974b7dc001d80b6df95b608482bc8ac963075eb26e11936113cc0e1aab9cf258ef6381dd1aa7ec50f33be1e1ce9480dca032b8dc7ba2ae6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b40e5e1aef0a84c5f15a842bffbab035

SHA1
b27ff6692a806d52f6d7dc09b091fed1c89d2996

SHA256
05ca0d269c5b568dc8f7b4abed87944f389d68aee29a37b8a27c7313959cad71

SHA512
a4d117cd32a5d70c12d9a08297c76f64c175751c19f4012a10f4f7125f3c3c83863f74ec6b0aaca3e8fd4f373a637005a6f5e301eda95f7c8e211e2fe9cf9f5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39b53dbf2ea6afa6eea0d12198cb1aac

SHA1
67894e8260878878df7f9646ba0240d194a88d5e

SHA256
12df2d59e09f92294c837478abaad4854dfe9d29f7dbafc8d93f7831cb7d3e92

SHA512
bd437028dc78ae4843368416814dd3f093bbda16947cbce70550a9246c1bb9de45f211660ee941c88f5e2adf5c6644685b525a572ff8896e36b5c0746cf20270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07e757a3e88277ac409c19083066b4c6

SHA1
f1e2de531938914173392c222bf18aa1e79537b4

SHA256
f628ec4a84d8132900cc079a076efb54509859dc98f1446b2db08c9698c314e3

SHA512
fc67e28eac7db664bb22970ded694965c2473379a3b23c0efd12ed7bfc3d84bf9dba0876fe7f1c6e1059959a764ba6b3043dc0960c59a579d47d2f987c94dc9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00b9f6843857b4eeae957b0d6c59bd6c

SHA1
1f8a6715dc7be8a83ac902a48232a884eb4f811a

SHA256
47570fb1dc6de50e859d0ae0cc5aae94a76d0c18221b27ff303067e79bf52558

SHA512
ec16fd105045b3462779cf9deb092576d82a1954232fb98afaef4e8a8a4a112d3cffbac73e0de8191f58c40c03620d82159630503a7cc4f24d00d4f34a74c492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b0576208d09f5a85b02ac41d28429f7

SHA1
f584d5061fdefcd0e14cd676d072ce435f68bed5

SHA256
374f8842a153458744e7ac982a39c6a4050a55d1bc0d4612a121e6569b1be927

SHA512
3833a60e90c97035c728d1e5237f25ad576152ef0ca0ed136e437cbbf45ca6a9232029f0b19435c5e9e4284b0f807a43b966a2332560dca94e19446c7270128e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC76.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCD44.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit