d5a9135aed30eeddc02ca06c09857543cf04bcfcc18825ecb289c8a3aa7bd3ee

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

feb15f8c5c63243ea60726748fe9355b_JaffaCakes118.html
Size

11KB
MD5

feb15f8c5c63243ea60726748fe9355b
SHA1

9d81ab88e7b689a66900c4e8413bc34b662f018e
SHA256

d5a9135aed30eeddc02ca06c09857543cf04bcfcc18825ecb289c8a3aa7bd3ee
SHA512

b803c09e64b239fe451228c1600596f684ba08ae3b5813f149272a42a7804a2501160e6af0ee72122333d5b1107091d9769ea8e9844bcff12cc02e82b2c2cb51
SSDEEP

192:UdoLW0/eq/ptfOGAgH5o4LwSnJVNvALoS9NcR2C537r:Ud90/eUptfO4/wSnpIdNFC537r

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000009e83f634ff9c9d90d369c3a8862f0f637f94c8aa266eaeb819994ac422798e8000000000e80000000020000200000006c1d013ec862374ccaf89e2e5977c9b0716a4c30de46dccbd2db6173fdb0e176200000001c9ee3bf0c46352556d9ec8a1b48b76788312812179f464b462bec86c9690d3e40000000a2dbdd57dcae2a4fa1ceedfbb3c5e4361430a833ba1686f9308503ee66ac30fcb6c9db7452b7113ee5dda8e45a5adcfd3135867acff7ad6df70b87d9090e3444	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900215777912db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000d0b4cbeb58e1b71f779ee0cbb1a007fa315a2fc2548a6850e723bbbda90fb49c000000000e8000000002000020000000e3353c07e0cf504c760929ed0c51746c29f0901a818b721e9b4ad74de2e58166900000003e826093b7b9e58af4b8f0d44f651493c5ba643490bd6ab274085de6dafd2c651875882993375222503ce51c38e464db6a636587de3c77b9fecdb9f1102f69f5d91d507330d054f1e3e00ffc8c5b780986405f91bd509135f47c36587ebac259b49f0a4213c3771228e7c9afad5d6e871875e2676c6130dae4bcbda3f9d5f49e06307ce10b9f947adcbd183074e5412840000000db097d5b47c8a986b98f5688598f1bf02d713f1bb035a1b85effa7181120bc561d16107ff035807321ec04db18660ad3d2ab0b40bc6a9ceee4d88c416f68b92e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90CE36C1-7E6C-11EF-82CE-E62D5E492327} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433780889"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2992	2980	iexplore.exe	30
PID 2980 wrote to memory of 2992	2980	iexplore.exe	30
PID 2980 wrote to memory of 2992	2980	iexplore.exe	30
PID 2980 wrote to memory of 2992	2980	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\feb15f8c5c63243ea60726748fe9355b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c3358e42c2f511fd985af9ba04546b7

SHA1
ece6d682a91941eb29f0305177c8dc46c978c948

SHA256
309ee5dcad775cd7a734073e036a6363bbbf60c3ee1fad03ef6c213b4cc9938a

SHA512
340a76c30abe475a929f1a7438194ff6f7413c28ae0cc27a8f2bedca9675aeecef01224f757513d391bbb0e30b1878a4612346945c6f4b788f36182c2c82fca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3690fdcb76c9d830fc6e7c49306fe013

SHA1
ef8dbeba894d3f761bd7670af1262093c7b1a0ca

SHA256
6b83a9933a49ec267228d1a92d52d80cf72118b0a07d115c5f27ec5247d20c81

SHA512
724e365584a42574723bcd795ca7f3a7b96c75955fe4f504c09d689ddc576b85c26781a8bcc7559ae0c55337dd2cba5dcf07884bf91d5045377073f617a44332

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3296097865c6d88a6c40ed17a09cae40

SHA1
eeb2fa45b383f99fbf59e9b7d237e7a1db594f60

SHA256
135d83bd5f0d2ca5c329f9a606f0365ce36a421ca5c875587511e46202095a1a

SHA512
29aa07e3515d87d89c3fb1218e492cc6586cd0436f66e6b77fe677080f5023b4242e29e9c3ca8abba752aeadc0b284b8c4cd59fba535ede8cb15d7afd18b7259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bf2aaae9e453153f2bbb2a06516e8a6

SHA1
1a399452f9b3650594d37acaa8020914ccf22773

SHA256
94140a235921f0a398ef819479fbe22dd478252c8d12d3d4988e0a3cc30a710f

SHA512
f4bb3ca63045fdf15ae4232beda69638b3f87543eae0c8ab6855a56398d5d95e2a5a9602f695bfcd91d31738c45c7f3575eae9e96a3cdf7759b2ec9fe9c76b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51608ea51ea1b2f334400196a6ffbbc7

SHA1
d90b590a3290bb9e432960a6524a46ed300fcbcb

SHA256
f3fcf61d34fd2bbf27ce811b746460777eb78cefc9ecb0263c9c3769b7843c0d

SHA512
eacb45768ecdc09825327fc4a2a330150a50c05bf9dc8b8d18c18a6b37ec067c8c2bb159d0d95e9c780a0286b95916e70d863e5f169828d24b835d1af6d33a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
159fb6d65b664044ca0dceb1786eac53

SHA1
088850a30787174841db0b4b9480bbfa2973c9dc

SHA256
8fdc4bdf925fe68928b16cca18f46689f611f8f792e53fae157345e479b228d4

SHA512
6604c60cd037d43e86a95e59ebdc415f3d3100917270faa184e166dcf111f9add4c1327d34c38fd30a8ee7d7a7da9e3ca0c0b8007438f9ffd705205810febde0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
063b275aa68feea693c970330c7c271f

SHA1
67d8812b80d5beab9f5f2f6f2dd2037bf1c9b825

SHA256
f539f9c74bba53cdeb07d43f9c2ffc198f544b14414c37f535a9547cd1874ba1

SHA512
e3d6784d789839e8bdbec76cc1fd73818c648a1b2a68a3efed596c188099edd68a4bd9e39c5002a1d07ebad6efe59e57c293e28be64664fcdd10a4a97a9134b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1625f945014084924d92201c150f7439

SHA1
6b9138c2cd037f63d3a4cc9103e40073b007b1ec

SHA256
372561651e3ad53d3230cabf78edc1efc81da781ba0b48624b3ad566c69c8efe

SHA512
09eb349f3d87e6a19e5188cf5380d7fa2788c13e121bed836fc069c7507e08e55004af45e37d5a188b2b4fd8a5da13235e7c09a3d05e95e5243c47bbbeb84a68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3481bc52d1c552001defdce916c57459

SHA1
71937a21b18e01c865b584f18b3df0539180dc80

SHA256
cf2584bb8c4f376dc4b4b567cff915a4df88fb3bfba887fb6a3e6e23f9658635

SHA512
3302ce677b946164d2f0e1ff31995a599ee445f676ebd6262edb34c5f261c890d068d1b0fb454892d204e6f1fd44dbdc50e80fd7d3683b1264afe7604a2442ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cde4cb144d00fe98db926419209a01e9

SHA1
cc9374964003fa0aea25b9f02bc04e1de274c302

SHA256
b25d59db3e4737d8fc213b3ee18dd4a643b46d472f2f4593da86a43a21ca8323

SHA512
f70dd0da7c0548f79fe533a0df01e446a99bf80e32fe752d0ac89c1bc51695de74cb66cedf2dceb645159a62e138648f80d62d9dbe5138323832bf72b11eb522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0aedd395ce61d40044b27b0ccd973e44

SHA1
df2180389966635ccf17c5acb644ae2d7b6f334d

SHA256
7f64afc199fa4df8f15b73c5265a42d3a8b825c0e521a69a947c7648a7eeb48e

SHA512
0e743e1615491a87757e959f1d50cee83ba0412bcc3c7ac843cd4e8cb27af8d54622f37473260f01c772c120cff3c014a38b6ac0966dc5d5463efc451708b11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5387c7a17a8413ad6e8f483af5bbb6a7

SHA1
b7442daa01dfcf66b3182eab2ce2ae89716557d8

SHA256
f822a4ae0546b0e265aeaf7c2a61b95ad3323015c591e6e8a091e09ac8437328

SHA512
83fb29a189483d3059120e763daa2e0e01e5452632384102c791002e18617d378dd30507ccc995043c61bcc30ac5a2f372de54993a1ebe9628386a12fcc97833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\general[1].htm

Filesize
167B

MD5
0104c301c5e02bd6148b8703d19b3a73

SHA1
7436e0b4b1f8c222c38069890b75fa2baf9ca620

SHA256
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

SHA512
84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BFA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3BF9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit