902776d3821f4cdc5a039062944469ccc68c6d289d8640f9d05c169c9e94eb53

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff554ecf1bac4bb9036945d2ff4842fa_JaffaCakes118.html
Size

13KB
MD5

ff554ecf1bac4bb9036945d2ff4842fa
SHA1

c371296b65da8f9bf2a74094b89b56afe4c42958
SHA256

902776d3821f4cdc5a039062944469ccc68c6d289d8640f9d05c169c9e94eb53
SHA512

3f3bd2c7daf6b0ac92193e6f21e476b5d6d248e35207cf12a96d6f5309ffc0048837b4de46680119f81b850fa7f90dcf3b587d3067ff10f058203987576b2ffa
SSDEEP

384:o0zg5gBMHFHiOFj0yk00e0kseDepleWP8zdMRk0yk00e0ksezel:jCRXFj0yk00e0kseDepleWP8zdMRk0ym

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f5cf31b312db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48C435C1-7EA6-11EF-8F1B-EAF933E40231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000ccccb19bde10d97322c7c4894e77ae5295877b137dafb7022704013d025fecee000000000e80000000020000200000000d4670d50be99efb94946d6e01dc45520a2b68fd6359d49d4c6c21c22d9b8a8290000000015260b099f3e335f4fa215507a24ab48d66ba5fdb005d90db4aa8f03a3bd64ea16eec78fef1855f633232c1a3ea298feb15a4b063d9a8604e0142361faab67373bf6d4e61cf506babb753be15a99e3fde6cb0035cff533e0575e5605787e0c312c1e57ebed7678d6e2e9079005ea4ca9a14c68229e28313dac7a5028fe5951b3239013da57f90e2cb931af106520fcc400000001d041d03219e2dde22fad7a021a2cb89dbaafb238969fcc1af729ef9b9e76f843c9045f555cc9aae4f1206a64ca46b7ad00ee957cd473f61aee54298d507df96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433805680"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000007b4664d860167283e56df0de0baecabf19341a6734b177be1268558436bc66f4000000000e8000000002000020000000d9cab2cd16ffef8802109d2ed727bffbfec80a516695a561f8f340ee926fa2442000000065a146f98931ec836784b94d7ade9065cdef08da26408f79ad9bc4c6118c1de8400000003cee93e6d2777cbf9d7d60595b55305a647c045011cc50dfd010469e0fc55e7988da29f5ce7f3f7f2e19bad17de2ba6587bcd3609a6c670c60d9c34520815bc2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2752	3068	iexplore.exe	30
PID 3068 wrote to memory of 2752	3068	iexplore.exe	30
PID 3068 wrote to memory of 2752	3068	iexplore.exe	30
PID 3068 wrote to memory of 2752	3068	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff554ecf1bac4bb9036945d2ff4842fa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a251596848af710cf4a45846702c6518

SHA1
575e590b4dc8f9eb54bd8e976652439cbfa4cf94

SHA256
d1c5b5804d81ab60e4e96d0ffc713b86f2196d88b7e6badb188475a32aa5218a

SHA512
fcb5cf5b138b26485b8582ff9771ba4568d7dad1d1eb2c43b053dd71fcb2746d37b8fa602eac0bcdcfcdc6f1f0b844cd8ed8b6e6160d6239bb8d6f2ec214a361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
639fb2cc48443ba4e0a656f14bef5544

SHA1
b0aeda6f2e02bb83aed914c72d63852f73cafb5f

SHA256
3af0fa726ce7c50ca09bb94bb5482af3177cf02d2b47727b9d35b4e310644301

SHA512
c9acee9975675365c018409dba7fdb2eb74e6f2ebdbc01a135badd5a7b56123810e74e70989cf1312d31d16aa54c34097a925566a9166d2020992388b71d544e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eea7e544b6347ca032cbf5ab17e2dda3

SHA1
b7b0a9d8577a13ccebf835f565d06a52d2b39b36

SHA256
296dff9cd9ff6ccf7433267708caaddcc912258079241896b02e680dcb6a3bc2

SHA512
3094dc8a3a813b4b0d0d3afd2f6ca574a06ae03513c6406f7a937625018af50952175bb6780a1206aeafd4a3194fe1c58b0c3747554c57086447b1265769381c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67d7e6227392b1b95f6812bc1395454e

SHA1
0c86ad72a6fdd26f3b1383e11f926ca621ceb4cc

SHA256
ad39ee20f72cb01978c9f31deb782eac94f08a75c91a124ff2ef3c9776bca213

SHA512
4df95a63ac2cfb4f659ec4fbe7ceb2a28a1da2705d60814d053bf84437e38e003a82d1a41fae94260295eaab9f40fbafad1674b5edee768992e82cb7beca4ebb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f79781e52dce8456586798e37a18aa72

SHA1
f68195b6990ae9bd69bc5feb637377b0319b1f07

SHA256
2691ffbbdfa4b12c6358314f2404765772f1b384dc36ba534e5a0dfd9916f99c

SHA512
365d666b635c2ba30ff36d7adda272e008341da55ff5c5c8013f8984d4c45051afe3f6c86a1e99ebd85057a44f72f0515602638355bbf3bdd666f1dbbad5afb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f278d4f5b0494fc989eb6d91754f1f4

SHA1
e2b25f7006b7e6f15cbdabd8f5d947e85755069d

SHA256
5d4983bff5e5eff0392d9a05e90cc0ff73cdf4dd0106823dedc25e65ba88184b

SHA512
9f74dfbaa9eacd4c64910db3e0d22eda57181a166b2d8f3b18f99b76368fcafc746dae3e1371293846d039f2b7d2d776932b6801c895f238919e2fef1673241f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25e72e0b7410870e5477a966708bfc94

SHA1
41a53c9736fb4e473c1fcbe413b7e6982ed211f6

SHA256
9312cc1569bca55ac402d3c84e12e411f0d289f53d329ce4c41bc6d742f5b558

SHA512
6787bfd2215ae7041e6c609b7f51e4c5077756d9fed1e5c105c9e2010717170d4a0beec5409c5bc392cbf413d5f50162c82be6113b4fb569d8b0d0df48b6ccfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64d91ced7d877491770c6027e20ccaeb

SHA1
113214a97d860f559fa8ba7b91c416c1863604d7

SHA256
35c9679f2822cd44bdbefbbf505feb8fc93246e8633107bf13af1410efdebc49

SHA512
3839a428c8cfb59868f846f2581abf7c4b29141892b4e18723bda08e648ca8970f75c065a0605fc42b168ce869859460f19423a5d9bccc3443650761128a7fc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa50c47d045b7ee262e9e283e9aa0bf2

SHA1
347f7a156ac775e32eadf2e9e93f64adf1269071

SHA256
5987ae8377827ffed2722e745733019d325dd0f55f51111ffa502ce48f2faa9f

SHA512
06eab5ec3685d2119a4f3d804985b9abf25b540b42fb37bd130eefbc008ed058d7d2b700ddd737534bba23562404eb97951a68f9ff7307e8b8bff4d8007b9662

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f5c1c777e38f86752530df24574ba50

SHA1
56190e0a3d745ff13ae808f22eb94977f75e4367

SHA256
fc93bb29cd37a17017b0bb9c6fa554bb6114b3dd0e01e419f61198ff07537b24

SHA512
9de18fcb5c110009323c795db565b97c4fac2b02d0c2c0fa9d2bea6a6aa526ff0e03e807cfaf661f23ff1f0f2e68d22dcf4dcc1472c63d7b0ff5c1e235ee2f78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2916aedd6ab48ee62256b5ee0e38f79

SHA1
385156d3ac8c2c265c39a5d1c9398ea612ad74f7

SHA256
fdd9b21eb01cb17920e152960d9dd92e169636a9b9c4e96dc22c5542e9469a46

SHA512
a4fa090cfa3057cf2dba1d7fd5536e64dac34793999ec170bbd82e437b9a2fbb3ba40f74c5b154d8122356cb890ebf98a3774e7b7ec6bc969159b44177917096

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B8E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8C2F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit