f9ea8aa2fb4a47766ea4023cba546e38e16d2c4a4193e8f122e5421dfa56de5c

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41c9f68d75e7decd7af077b56cb4b1eb_JaffaCakes118.html
Size

138KB
MD5

41c9f68d75e7decd7af077b56cb4b1eb
SHA1

5610bdddaf37b5bc2e3146c384c4c094831842be
SHA256

f9ea8aa2fb4a47766ea4023cba546e38e16d2c4a4193e8f122e5421dfa56de5c
SHA512

df96d82eac6997da00cd23a81d90bd48b2acafbfcb75575dd6c661caa4dee8597f14e1b7ac549882e0cc8f2cc48bb36542fe452ef072249403de8fec2a9ab4aa
SSDEEP

1536:SPfOxemlPDkyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SPtcDkyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000c03e840745123c7c8f1f69732b9cc09f7ba4c2f7e5e81d33650a6e04ffcafdb2000000000e800000000200002000000092af57e70e2dcd5be13ebaeaa13586dfae22e8a06a87031dd319cd379f952a0390000000dada3457764caa52b7179623452d147aeb99b73a5f95ac26b9c06c0c72ddb53a988db6bad27c25e69bbc702feac57abdc3a7db7b40d333e4ceca8f9ea4f19e5cf74d26fd470c9ffc13f672e5f49f0f8582e0270590ae098843b9ee2f28a17b77e029c1ee38335f5ea9bea563e8ae65247dcf801f1f044f910d2719a606ee9c3f0131c3d97affd90cf715109602ef18ec400000005def87e59592b86ca974323ff2dde13951a6e79b9b50dfd230d70faffd7f454fc4a1dcf8dc02fbea5681ebb6f955cffa7c0d6abdf52cbd59cc39b5bc790f1092	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000b5d967873880280d20b02a2a3e07fcaa29a8cfc45eed32e85d678d9304e97b83000000000e8000000002000020000000d67d4a5e8679ce0ca8dc24bb3b21e99e579e21daa5c00b9b41e843f2736e80272000000000910e7b03e1b9f711fb735f16f285ff4787ebe58a8bdfd3980dc8ebdc803ba240000000b5e2bcbab81834307631e7c7ce916f76229448f6b5b67048d8a6b5c193914d94d55d4920269dd165097e73c48179e8f169db7aeab9e17dcefa40172350ba1bbf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53592A71-899D-11EF-B686-FA59FB4FA467} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435011299"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201e9069aa1ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2780	2384	iexplore.exe	30
PID 2384 wrote to memory of 2780	2384	iexplore.exe	30
PID 2384 wrote to memory of 2780	2384	iexplore.exe	30
PID 2384 wrote to memory of 2780	2384	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41c9f68d75e7decd7af077b56cb4b1eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f73b558852ef9c1962a8b2c5f926d9ef

SHA1
9752bcd812660c10ad8536334a43fc2644cdfd10

SHA256
a7171213a0157fae543d9121acb83397fc80efdb399ace9ef0a5dc2dfef72b56

SHA512
b481b1b8d7070b0f55b9dbe2e9ef63dc507a601bfcdef100bf797c7e935a70181f83fe76db08b37272ba5c3014d5cea7eedcacc00297d70ec874debbc93a0158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0688f377241aaff12c5f97ab4dc7331

SHA1
f8f2dadc07d1efa664b650d722c0922c19259caa

SHA256
5cf1c1624717ccb650c6b910f6e35f76eed184ec7648879c1ae18a856d94f85a

SHA512
05062f9e60dff15004e128dbf73c4703cdd6a6670e1a0cd4fd528a447313e6d533362496652c2b50d37c5c876b2376fcacac5a7d5948a4e6f467912bac2e9097

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
885e0a6ccabb8c9c75eb1c71b1ef1f96

SHA1
f397289bf6a86ed5113fefc9adf6901d458e5fc6

SHA256
bcced816e53ce7d22381cab309fc7c2df86249584601078e83c4714a4a9c38d3

SHA512
f29fc5834a7401d883554112c163d4a73b05121a0da71a248a5e1ccf9e52a0e2af969b88383e8964b5cf4741272e2fa67ff4562549debc4916e26ab58c590de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eede8110b3b67190df5d5d5aa25a94ff

SHA1
9a786eecfeb6f8c84823e61bb865cc514ad89ce1

SHA256
79e4576f04924256757b1abcd9a06ebc65e1119a13e3f5501b792d19382bf49c

SHA512
51d55cb0feff1a3225917f76013d0be273bde94c0fadd14f3c6e4f0d54903d418e2562abef84a1ffb4dd7be3cf165369db22ccbfa3d020f01f5b82e29285f10b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ba10dce0c1bc25d637ab25e43fc09b3

SHA1
39e287739e32107e75c67f153ccd873ea4475686

SHA256
02c43fdef1e2cfe3751c5c816feca788e65d2640d228b330d628ef23c0464dcb

SHA512
ea291b11a2272f6f3c4ab2a306df9d1d537618fbdd0e6c7ce4b2408e4076461d2e4186f878416d3ae3cc8f104431a9001f367ce746e638a3926f91b766f97c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46c9ae67393fef81186156ffe9c88ba4

SHA1
d6720932ada76e34332bc2f2102d5aa9ba52c335

SHA256
0a58ba0ab9dfc1c82e0153d6b931400f604f08a4f1c82d47555fdfd69932960e

SHA512
ab65ddadafc1b6819ed8faa05d02b9ddf0e8ce1d3aca2ec99452e416f4b84d2637097e552750aa8748e179f1a06da7d9a646c6e09a924dc33ce12707c13b16cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f997ed943e2a90652517706f65eaf621

SHA1
125de7fbb65a04c959dc29b4fea49ad47dacb9f2

SHA256
e00d48699506cf029cf93460294a63b90615901c76ed12094243104bb7373da1

SHA512
d7418a8eb321a80b64d4767e3a3dd640cc7bfcda83fa8c6813660c495fbf5eba5a15c63d6eb68235b3b5579ddc14605e1c44d80590c821471c22b1bad501fc57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
671a715c4a4cee3ebc25858c9b0af04c

SHA1
5c02ae98291102825540a87ac0038d4c68798752

SHA256
051b9a1ec0973edfd1fd1089b9eec67228f6a8f28915ac517732cdf6eaecde8a

SHA512
2173698fd387a57f39e26775621f28a00e2edf367cacda71e82bf4d7e4d5dc10eee543446a499ab88903ce6d29dbdfa983236179127f959b55d71525a4790493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00482002fe75adff778d67f2a435b207

SHA1
c6e8a9715dadb6e5546d495f137952c0437f4f0d

SHA256
37ee670943f4d870a2d8277e997722dd54bacec03c7e48ba7173ea0cb623c346

SHA512
349116bdf80b80244be7887e2a44769c218f07d89cd95d9f8658d1be0e9118bf4a11ea1be131e998c44c11daf17dd903e0fc8757a7cc5bf410ed7e60f54af473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bb97aa12fe2a0f2a1172e00004591d7

SHA1
6411b3823a84063a7ceb60c12c2ed30a024af331

SHA256
0941526bf990073950bc395826f1e8ac9822ed0c90dc14c8dc5fc01008094982

SHA512
cc56e6a35b4a1a3a0865a9015e4e50af0670e17109e7044971e4dcf7c5902c01c7dac6cc0dfee3c8471395b04666be54c55d04dd769896c53c237472abe0ddf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e3d19693549fad06eef0af5ac2c0294

SHA1
47c4ce8bc1d3d09e988192973fc77b9e14e0a1d2

SHA256
41e9bbe37a2f706908041b596edb81ac1ebe75cb79966b4a4b561f0b0a9abf34

SHA512
6b1e2048298b6444ca1d27c98ad74cf25aaaa671d3e914b8f6bd206b40fb60b87c78b31f324e2923ff9c8c6c10ba2bf8e2230cf81b3c19ea4a0a59dd49db1baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f2b15fe20e9ba084dd13fdebb57a6e8

SHA1
011528fdd90f3d6b7c19c251a8a8075594987a9e

SHA256
f3555471f62d5cff78aff4698ab879c68dade2cca2c233743477460dee68d5fd

SHA512
69e515bbffcf02491bea6b2f1dba45de04cd1bc06e34bb7f97f406af8844b5bf054fcc3ed2671e76468614e68e1777c2c3dae0be9bb40f0c985f5f4d51684a7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24b55bd2d16df41b550e31c527b165b6

SHA1
22006dd27b1feed52ebeddf2482c6085f29ee6b7

SHA256
5d66cc8439cc2d38caef75d405a61f89403a2f5965a98d92799833407d80951e

SHA512
2c34ca959a4f23444853bfb69fe624ed8ecaa2a6797e8eb0abfbefbfab0cd8f22290a6ca9a52623c036905fdf823e729b234b46b1b478b46f827ddc4d53721df

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEEF3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF53.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit