c00fab9698bd12b18c37de7444d722dfdf590b5c47de657029f3624fddfcb6ef

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27f068860d0d6d99514717e0940c87e6_JaffaCakes118.html
Size

713B
MD5

27f068860d0d6d99514717e0940c87e6
SHA1

f9e933fe3945fc600a2916455914d53feb78f31e
SHA256

c00fab9698bd12b18c37de7444d722dfdf590b5c47de657029f3624fddfcb6ef
SHA512

c78484aca6e44748d7226f3a88f3816af03aef7ee40df978614d144c3c27d26b2d285707466071a744a93586ee02bd1fdcd57ee17c237b69b12214e8103faf71

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E99407E1-8613-11EF-9DBD-525C7857EE89} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b056acad201adb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434622423"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000009c5303743ebb52326451681802e37a67976e9cede3b2c04d777d2fe9734d4086000000000e80000000020000200000004e9deb212e81473d89312dd154c1af14e1f88420c439961467157f0483affe60900000004861a2fbed7f92aeb6dd6e57cca4b79e64b5e182fc498a960e60e77d30b75be7e53554386b0bf73213bbe4d1941e9e3e30a89d6b008fa52352e718690af6c0cf068e161ea70074c1e7015456d0f450293395d6a5cb27d7c5d6d260299f3cea2a85fa666d4cf02eb9457d9582863b74c8bea9672a43239de0326d42130e30511a6a2b2f609489246dddd85e48e7cbe2a04000000028198aeb09496d8b1a161108f98b71d0ec4c9836dbd590011639c7b077f3dbab867ab0d42d0931259f80e678d66f26b4be2a31be5fa347650673891158ebf1ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000b0bff73c0ae245600c35bd49974126cf431d025c1690f803b845aa07ef282ea0000000000e80000000020000200000003f62095dcef5d736dd6ab70959037c61a4c076b997bd4a2c28d1ac25cb85a6662000000003bc6629e931a60d5ea9fcc25bafc0757480241796357ecc4ae985f42a9e9afa40000000f77c59b30f223762d7702673067267f3eec19e92f51c97e91b562b225e73a2d8d60270b307b90c95c001d2e62f3fa7d091345085fbce59d16c61b637698ea740	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
376	iexplore.exe
376	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 2320	376	iexplore.exe	30
PID 376 wrote to memory of 2320	376	iexplore.exe	30
PID 376 wrote to memory of 2320	376	iexplore.exe	30
PID 376 wrote to memory of 2320	376	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27f068860d0d6d99514717e0940c87e6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:376 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea68e281d1771b4a8bbef754cbe56cf4

SHA1
539cd3a0661a4e2c844d1cd5518461d4cb6ce391

SHA256
7419bb988ff475f238f25adf6999912f94c61a9ddfa1c1f7e52fdb43735e79ee

SHA512
317c5a1ba3a2095ca16c4f032f3b9ab82e8db2ea2e1f3b20596ac465c1af2c52ee5dd162cf5c4661d0f2e3b564cda2166eb1de108cf07a51b360a990e7daeeda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbff4256838350381af0b88728b4baee

SHA1
fe6377fcc77e1dbefcfdf3945af01377a143cd7c

SHA256
502977674d7615acc51561adbf325ae758aac2789275371a39415e252dfe61be

SHA512
ef34402a5b80a491309ac874059145b053ebb6565f248791ada296bed2a0368a9b2cab65d97cfa551c6e852649319348e1edac11e31c10a6094116000b538e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d986a39e27fb7018df136f166ae86f1

SHA1
e67c34dac7626a577addb75a7eac6fe1cb5a9e80

SHA256
c88bb2f61106e9d9b13e1b2193676c890457d821a85ebe61a4fe4bb444eca19f

SHA512
0312786fa97a03abd731af02b3c3db390d0eebe80b2bfa8bbde216f397626600da89afc55b32dabf7297b05d7bceb783d81cd5ec284d58329456b3ccd6b5e2c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95cd3adf942be1b72d542f5229289c79

SHA1
61cecb05729af410963edf7a1586ed915b9af65e

SHA256
a029f0edf37e238b99d82ba485c0ca077b20bcb826f93f552ab4e9939ce768f1

SHA512
07891ae8af6276dff4d860acf0e79b6ef78daf00b9cacbae1aed63cb7edbb678faec8bec1a8ce281d9277e0cca1b8ade08f562931a44bca2d0e585aa55214dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69413bfbc473d880797ecd5c6c882625

SHA1
713c2ec0e67f5ef783fed1866a97a8ff86b77faa

SHA256
db4c69e1ed29e8c0061f6cc0214e7fb8734b4f04834dc08b2fa172a95e787d5f

SHA512
4c302e5019991424be4cb2a289bc5294fdd2b576d21d42fde4ff07e2fedfb56777850b12d08ecb4011844b8801d0d1ee2dfd3228c671e2958177510770ff3463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01a18c6537e4cfea4b45ddcdc9fe65c7

SHA1
aa43ea0b276a065b1408ba14ca511949cbb9dd77

SHA256
aec949a3bb3f260315b0239ffc610f74067a7b5c41b9d489d44e69f478722e21

SHA512
edc2b3e5cfd9361e074fbdfefac5e526807dc75ac2a8c6a2eef5f374fb12ed82e4e1d163baa13ddda3e12b736f9f98f7bcfb3561325108759a31785c7d8e531e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90d193d393b473ba1bbf660f7776742b

SHA1
d8b83330602791feeff7186eeb8114ea12e03ac6

SHA256
e97dd8ded90fcfea1acee23d85994c42eace58c6fe84646671f010486725a64a

SHA512
7d22a76b5db345b609e1b8660eb1dd68e797bc863e276b57833e7c08b6677f5a07035529d94130fb5f6540a747f83739e92b369b20cc4e0f8c9535dff5d29e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c9f3da16388f049ba75e7d4d5144bee

SHA1
c29ece44083a8caee323b01578f5698f76a8cb5d

SHA256
de7211c13f1ea3a6b8baf39cec8d4be2d32ff810910da213d15549900023c9f0

SHA512
5e47d191a6584b3cca7db2a530ed2ea41f9760e3d8f35d3d7d843afd4c44dc30e720e5bac2a3a77066e40f94d48401df3a38a17785addae491420118ca25b97c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
586291a6489018a5e375233d7c72d50f

SHA1
19c8198fbcd2a1d28c92d612dcde273dcb987889

SHA256
ce14531e243f9a01f522ef77fb5a3a0f3b434ade95ee013641cf14876947faa5

SHA512
844bea869b9c41dfad08e66f63865b3ed57fc1c8a9853184260c1a326872e99f9d966d89b7808b3b2154241fd53979a4760d1ded5e64fe683c07b8065d0ad872

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca12193df1284aa303afcf7f3a39679c

SHA1
7fabcf4282461414e5a738a3e236a1b926da0935

SHA256
ba1c63414336ad6a8132d6362005b16b98a1f74253e1b158ee9a48d87e1e2aa8

SHA512
64e1174f808b71a08c0c0bdd16ec19c45e48fbe42d1ca8c90f52a7369e57a5958bff2cbe5ae96053fecb2453af3afbb8f08025235df617d99c65378e803b6df5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a60b415550efc3c20fea38adce06f85

SHA1
e14ef878799d6453f6122ac935a4b23c8506e545

SHA256
d61e215c9b37d98feec58cfce1e2748b8e660f3fa00e6ecd0d9656251b46dd70

SHA512
adaa8b2724e27b9ae3237f1b51113d39bc2025b5bf018d4bec26b9710583b4fb98fc28a98ab2a2278c56a95cf81009b0aba678fbdc3d645413dd3e0e57070497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2df01da729157b5ca5a98a48a7e21992

SHA1
22d2583e43d6bc825b99a38465ade4ebb03e3522

SHA256
e70126e02156c596ffa5725dd939bfadac6f3be2305ba99587ac1742cfddf33a

SHA512
109f8bac8a0c9ec144d5cfde91b1f3235d4ba2cb2115a67a1a9c937183de807a68d892dda16812169daa33c77e3d7a4d8950a0a2a655018be7cc057109bae5a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
718d0eb75dc0f53a6de622b375522bba

SHA1
5f7030d3d9b21f568753ccb6500d9ba3574e8537

SHA256
760c100cc3b642eedcffd26e510b1c708ba95ced99b3a92c38da615c1662371a

SHA512
23350fdac504c6b27d9554eeeed300be0db5614821371f627fdb4288d6ac18462c693036583d1f6651472f05aea9af96523e6b228bf739248fdf1cd40195e20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab758E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A25.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit