9c09805151c9631e9765f69f1cd2ace337faf7fef55bfeaa9e45ca1e92e38243

Analysis

max time kernel
122s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54a29cc615ced922a0811fe168242b05_JaffaCakes118.html
Size

6KB
MD5

54a29cc615ced922a0811fe168242b05
SHA1

42bf60e73a99ac428bdb9f998918d20783f0a487
SHA256

9c09805151c9631e9765f69f1cd2ace337faf7fef55bfeaa9e45ca1e92e38243
SHA512

ee50baf507efe62c64eefe4ae047ffc79b1c68299e963acf7e981cfe3fd26117dbf0f7750680cd17f67caa5f0256cf002c10c5a04689cace6c5be396fb1b2a45
SSDEEP

96:uzVs+ux7E3/LLY1k9o84d12ef7CSTUHR/6/NcEZ7ru7f:csz7C/AYS/K4Nb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000002d00efc35001ca89e3cb1df4953e7a07a043c35bf7d3b92d4e86c65e36e31f5d000000000e8000000002000020000000921defa58906c6d018208c0e1997a921505439d1290704655d92752b6bd3a22f200000005aebdee46be04f953cf5ffbf18becd252c0683e8a44204b3ee82958f30869d2840000000a6865a9cd39ff208cf47259fe070c798d8e47b5073e30f757e6b62a0bb530dc9976622416afb5f59ff88ec6f8b5fbcd3e4fbde27ae3fe801025d73404a663c21	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34CB9631-8CED-11EF-BBB7-C6DA928D33CD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0eaf823fa20db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435375461"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000d831eecc350212ab9ce0e39b6aa88f5400df746d7523b4272f1f98e9f51a1038000000000e8000000002000020000000d013a742b14802f42d35f91207d9135fc654f6a0f975da3cc3625257abe245dd90000000b857b9aa7d97b5807883326c8921ef95647a0fa6cdf053c9ac3dc2078c02312886b2712595b73eab93dd183e6dcd753ea1a7bd55612ea11cefbd399f5f6c176b0a96c15c09951b83001ec05d2d268b5f9cba2573fe4cde8f207cdd9229ccfdf0f21a5f1ca0ecd2fe3e7ce119e7c25beee2a1ff119b120b76dc5498fb32fa973e5837b55a4f9bea60e22aaf0ad36fec3440000000680a68a668e8267a9ddf6820fbfa3364075f6010833ad0ef9e8bd06781c3f295c2d930cfc27453a7a07f19dc1e2a222b78219741eef9717d6acd7f92765f1962	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
276	iexplore.exe
276	iexplore.exe
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 276 wrote to memory of 1704	276	iexplore.exe	31
PID 276 wrote to memory of 1704	276	iexplore.exe	31
PID 276 wrote to memory of 1704	276	iexplore.exe	31
PID 276 wrote to memory of 1704	276	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\54a29cc615ced922a0811fe168242b05_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:276 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fdad6c0c41f4d2869ec14bf4c2e54d0

SHA1
7847b1907869fb0a35dfcb089caa919e4ceb544f

SHA256
5e68c095551cfb75a486f846d74e8c8d0ce3f0fd7fd9147d204e9a5943804ad9

SHA512
c51206f793126a0a889e92b4f559f2bb421fad736fa4c3c7920f8c0d3bc06ea2b8f2c757239f767f0ae964512c007bc448aa347a1a14df4267e85b4f2c92b95d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0626ab697864fedb259d583935a3564c

SHA1
688e5276e3a688dfd5c8660b48b79ad932d9bb3c

SHA256
20156bf6bd66d3908e919e7b8b213914203694856a94fde260d611a949d1fe13

SHA512
fd6e59cfd61a4bb7df5da5710a6b49ecb21c737cb8fe6e9cb115554aea47d7e22c490eb85317522b6f619b26cdf624b4351a4de4ffd6c63a06ec2b55c47197af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1da5eb86b7d6defc60135fac863072ff

SHA1
6d9fc02e4a76ea5f7d529845e7447286f4fdb310

SHA256
f8d4e7f75623142a747bdeb5844fe607d606521b97e813c23a3ca4d8e2bbd7bc

SHA512
7cd2c44aee6d173ae3f4bc23049ebe51139832f119744fdcf22a61f2591428cbb41927e3482d2b4f15d5112039ccf52d2ecaa8702a60823c0cc67c60779732b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acc180cc3576b72c9df1e9a4f1d788a0

SHA1
bf782ff53005a020c45ca2800b3ebb67016729c2

SHA256
ea77828ac3551d0f23558740cec11a961a96ad017a1733e3bc2aa3a1c75b7e83

SHA512
6c95b997269046bd4187899fe6fbcdb471ab7621df357cdff8fa47d6e88dd7b68f8697278283c3f52c1fe974500d9f4b137ae6385c559666ca5557064bffe650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f06dda1cb23157004f05c5cae2461164

SHA1
d458da514291b7f7b82a6337990d275fb4674e92

SHA256
abcb9e944aa565b7178fe27c822b40155bc05994e6f286662b53171a02bf3ecb

SHA512
a6bb4cb226a10223d3d7b31eaf1d120205182bd4ab0bdbf6a0341a9e53a14709c15015363bcb669e76f8cff8de2a9be65454ca50f6d8140f0896321e973c1b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c75c71797326cb3b85591db3e9a6b0a5

SHA1
8bdab02cab43ed3d77616e53c4f6cf8f3009a794

SHA256
6b9ab4b4a020850de8f4d26ce1a0cc5b7edfc0f435728ac50e27467003dfc612

SHA512
9419d3934fc40c68e7301eeb94037c900532d8217f9945256b20901ab847cc87db75a1825b07ac174bcf032acaf9356fe15ee85bd66e663317dab74bcd92491c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8b2fd125da25cb8e51d4d9e2af854d8

SHA1
42e51ce8500b0c97d80d1cfba0a41c4dd8c04aa7

SHA256
7ced2bf1fa0309793a6ee58088d83b82acea9e80db923a7bd0cbeda6d5b4e7b0

SHA512
7d2245d1cf4f87837aa839a4b5992746fa861be7225ca4394a15775b70b12c782fa8b3f1fe49108e43df1e16ce685859d2e18da53e1f711f8f8f84b23924c0e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bfba6c99da589e9b93558f9d729fe9a

SHA1
c18b47897f2e8bf36afd4309d7ce1e89626ee738

SHA256
94d68b35761df573a35434e8ea307553cd6e0e87b2615045639e7582d5f48ed4

SHA512
44394ba772a78d1a10ccdebe5230605c2a021c6bb0b5260d564c9f1d350b584e0b9543c11dfbf9d5af77228534fc393e437322ff9cdc9013224fbf6668b001a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4113e7514749b283d5fb742b695ffbed

SHA1
b9c0292802add49527e4651aa0e256f67634085b

SHA256
367743e4cd37a7a87316885af194ee908ab5c04be9f8310e779d60e90b5401f3

SHA512
faeb74a127cdef6faea91277bf76776db864853a6303218b730e42c5123e77945d6d7b4b924dd9e72bd47591a0991edb5ef5a8b4945fc0b565d5007856d71592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe251c9bc61c3eb4df1373283ff8c842

SHA1
188e5e0eec3cefc3a20a7a4500e8780407f6e38c

SHA256
893703d1b5bc15ee7d577022c137af54e36e38ab7310ed7a4e5267ea5993d20e

SHA512
221923387c2eaa3d31c0480b2ec4cb12d318db6ded50c33b029d0a149a73b28d8b1281a5e81ea6584b2937c9316be2affa6319b402081374848bef76894e3223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
722e284779a86e6a9ade2039f1597a89

SHA1
f9b8a609961ff311f62221898269aedd80418929

SHA256
4eb999fb030fe7506e3996cf8375f89aa48a9dcbd24bfb151e866a9093d14231

SHA512
46aaee8302e52b0ae182383dedf137af0a489bfa4ba4d90bcdaa736f49103aeb2b7d570729288aa28e131e800b95b12542ea77742916604d7a5ef7e99d866025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae913d101a59162704cd74f59715c063

SHA1
11c9c7e6365d5af95ccc74047a024c70cc07452f

SHA256
bc8293deda1b43cb67e2ac1f58fb92dd27da6bd3b885c7e660c58bc64ee32a01

SHA512
5767fd6e554cfe2c81ffb29d4901facfe3b4cbbca18c88a96234ded24090e82120b62876dd2a3817aa4d0dd0af92e86c3d9ea8bf11cbe8eb7619ef79139a7896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b683dc16fa5338aa6b1e32f67edc0db8

SHA1
ca728877146f1e9fd2299526ec04524c199d9890

SHA256
493d5ebb6cf1838d14a00780969e420b22d2231be4998e7b9d1fd528f6356315

SHA512
3d3b6a2955f41cf37eb857e78a61c5721d92d9c2772f3bf51579a2932c1e5263b8f0ed3a80c2fd0e219e236379f94874418a52a1f1e206bead6feb93eb774c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a692cd76bf0bb7bcaf561a4fed60cb46

SHA1
bcc01feba36821146c437a9a7cdc52c03e7a8495

SHA256
82f2ae8589c9bb626b9b90d8748dc2a6a275a8ae48a179efe825a99811014208

SHA512
e1c9f1cf343baa69bfe06feec8a808a21dff2d17e2a964ad3b88af88b18a3d73b8dc1d34ebfc01553a23e75f1585c04bd8f5356887656ca08b460e53b8d1963e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c5d7f578f3690fdc1edd35f242d9f3d

SHA1
cfaec21d8d94fb7ed1b94c8381f3da37c33e8e8d

SHA256
54dabff4dafc90bae57c7213db7bd4822358f5a318cafca5f992b5be9eb68a6e

SHA512
720d178fbf9b7e158e7bea7e0ffb515386d54780ae03b5a9782cb30f4cbca2a382f0c3ead36640dbb7da7dc629fb7c5163d0c5234bf4f5073f57562f68669513

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA796.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC3C4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit