661e3ec52dbe0a11156a48bd91cb247395c79ff00f6d336e6bd0b3180b678ba9

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

feb6e53e1afb1f4b364b84df2845da85_JaffaCakes118.html
Size

71KB
MD5

feb6e53e1afb1f4b364b84df2845da85
SHA1

fe233ce3ab40489bfb4904674c1d9ce22926862c
SHA256

661e3ec52dbe0a11156a48bd91cb247395c79ff00f6d336e6bd0b3180b678ba9
SHA512

49cd31cc9a4b4563d010180a2be7217ae84025c0497ea86fffc3ba378e70d4f89048bf133ba663c355ae19557d9d82a54ff57e1eda399585b515447ea6c9776b
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcVFLHAhuELYsqZcZPuaMKp:sq87Lia

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e3998a7b12db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B8CB171-7E6E-11EF-9982-5A85C185DB3E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000dd684b988af7284fef1cee7f7088f739a3e2b22797ce2896681bfb925073f1dd000000000e8000000002000020000000307503161cdf8958b57cd2b4ecc06d10684243ad29637dc454fb2b00815b4b67900000003ff433b9092d189c4e9d6324356e947c8f2f4ad4b4a8c9b6b401d72e198d254abca0dfaf8fd489736506346bed55cb6e2de57696ff27849d95c38c1e4c404b0cbb4f755d136cdc0cb75a3d6e39e8e43ef8335ccfe6f00883a435a9d0f27bf0404887f372608e9a30c526c042176d9e0f06557282b06302f3f6fcfa69bf7b85e2dc24d56eb20170bc963fd78cd7d5449b40000000d786897a0496cb7c6896309bda3e7517ec62c991a48801c4076a13fe3acedca2e196f8d5d4a7fac27f487d43b0b0f30d1534fc821603f28faf43f8a587cac3ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433781766"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000e15d628fad8903f6be4d8499d7559f04e159bb6daeb451d939a986ce310375e6000000000e800000000200002000000020b39f23671d71dc7d3a938a323da673029d36812dccbdfe5101cf8143e32561200000008396827f86f088c021b4932964358a6112fef9266674f1bc0f955d5ac4a9899640000000300c3e12144599388ba99b15f4ce429b984539fb44bd492c2b35c1a28889b37ce3417b3b3d9a3c2bdbc37f686b09c6f85af938a7996da42ae8ebc6aa77e53acb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2060	2536	iexplore.exe	30
PID 2536 wrote to memory of 2060	2536	iexplore.exe	30
PID 2536 wrote to memory of 2060	2536	iexplore.exe	30
PID 2536 wrote to memory of 2060	2536	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\feb6e53e1afb1f4b364b84df2845da85_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
782cc16d0bb2bb5f7abc4f2c75252258

SHA1
b2a3f6e6582c2e3a439d139813d0d47548020c83

SHA256
cbb1db62526204d761c002697260c2351bc97ed72bdd7c1ad985825301b3c95d

SHA512
448669c28d365b114b933c32702a7240d323dc7e35046695e0fe7aecdf86196bc6f4a905dd1c273ea18aceb0a91be630249f6a1895c0c9ddd0a9d6d89ee1b18c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42542b9c4c8c581c66db4d2e27403e8c

SHA1
c23199fd1b24786b33c6c43818193e037b45a919

SHA256
f50f8579e2e542f78c36e8a258fcfa335e753670f0e8ddc42bd40c8e58a09753

SHA512
2f1a142e17aab675cd62554e66d470e31e92539ec44ab3441c7f7043ed360549db460a85521972c4b23f8c66f0b373908605bbcbd8ba012cb014a989ca143e20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e581e1bed5b36b1aa372e60841ed3349

SHA1
512fb961241f9c2a897b30f1d999d55fee65d502

SHA256
53bb16333751b56fdde5568cbeaab60a5b70dadda97d97dff140374b07b194c6

SHA512
548d89406211fab6a9f760b9e651c42bab22a0cefd460c5572a58695378d6f8c4d3479c9e36bece3f91aae1ebc40e73c59d75a744a0ffcc640b4064354000c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e5dc50764782284c073501147488cfc

SHA1
3a49e84bd5a38f874f5d3cf1079f57a3fdf80631

SHA256
82a6ef944f761d836c9bed2c139035461e10d4343e56722c941c403ab47a1072

SHA512
c1e086355fac038c05f3ea8277c1e19e7759a0d9119a75f9901f64e644f5c8f4c7ccd0248c3155cf4c1a455e7cf0edd70679d9aba2a87753707789bcd35020e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d92f3f46cdf9a47d41c0316a4c35f31

SHA1
f7dbb776582cbffd2743dd873c3ca109074809c8

SHA256
86ddc9bec8d27ba1b1e381b0b2ea4c5a7f68070764606fb4423e5d3f58630bf6

SHA512
e34e6d36294c9ceafe6e24c57cfba35c2b4ab9243076d272d325d8aded432e522f137fc36a751a8d8783fac1c664ca110e5828e4d60df4d6db54d9188462383a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a63b1ddaf4f1a31825494f1b73c1536d

SHA1
95789b1492b2ab80ac7d326c70b59a896f81b170

SHA256
a42415a9ba34f51e1cfe06d65aafea044cd711c7109f296524f3966eba79d4a3

SHA512
128857f4c9d30e1fe1c6435215f5c68cfc7be1056c7335e93f5142a7ada4d849e73e7b1975776f78047c28019a15d08af754eb0d4546d7419bd10401ed63a5bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffe3286e4730bc526069e2216aa14393

SHA1
18203a1d664c053cb41c578b2d9402ec0694266e

SHA256
96e29891d984e3416859e34cb38e61f4b0b5956152b09ca409596b0d2ad76e11

SHA512
dbd78a7db135f6df009c7e954aa150e0b4ebdc585e371ae0b3819a18ed5035ae0611b7cb1536ae9e84c292c907b5f3324054997a10455caecbe7019fcb8529ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60701390d845c7b50facd6fd5d360d09

SHA1
adeea3de8847a3451ec0ed2a18bee208d788f11c

SHA256
017dc957e349e65724ba78c02d56baf9cd44321a3c7a54b9bc2e92b50eeb3768

SHA512
dc6e176cb9c4e8cb97f006abfbbf53d31b2aef6fe74a2be7ac03f616fd67d670a98a018381cb3a05a88e728e10e5891511da46fa49b060b5e6fb1f859e9c6573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fef0a28edba4922d4724d4e4e7bd5790

SHA1
87e1c91bff232404b8d9b9eaf027e869f40cb7ff

SHA256
eb4779cc1eba973de7604e5b5c9a98415a75ebd157af97835c7e7a73af47987b

SHA512
7e9246aa8008aa115bf1f64b21ce12c30d6b13536cb1114f6da56054e6ba0c34aaa4ed2bc614ce72d526909bf7ff7b6269a49b0b91fa19350eeff051cd2e14a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b55d54bb92c9ff7b0f8f70d4407259f

SHA1
3e288e0ae81ac65e04c219e16e32f80efb8cbc5a

SHA256
7d6bbc8d4033ffc0020ffa7e5ecc04afb5069584ddd023d759891bb544056ad7

SHA512
844b6afa1d89325340c4ab78f4b32e30ec4c2f4906436b55e686defb4b36c36167ff5d55814b62db8df6abfb5b7c86fd2560a0c79a0062477d3996ad52cdc839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54c05397bbc7a0eb85de249fc6556044

SHA1
266e9251800b02757a078f0100cb738d74e3dfd1

SHA256
665b8894215e4369e2edea74a6ea74074d83cf59f0b02987ff2f500ac4bf3f82

SHA512
76928a27f8ba7bee404af7992cf57adcd8f424d03d6b4f5e4665e56126db7bbcf5ca5ef1748d5a8952e2a7a0fcee88fc47570fbb26413f2083a8ab24a77f87d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab76B9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar76BA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit