7fcc6e3acc37c59f1ab6f82f91876be6c2b170115af5bc7dfa992c2c9e4d58db

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

826fdca13acc13efb9da5b4a738630d8_JaffaCakes118.html
Size

6KB
MD5

826fdca13acc13efb9da5b4a738630d8
SHA1

2fcb9d5cdaa0478e5b917b9dca6d747d24af84d3
SHA256

7fcc6e3acc37c59f1ab6f82f91876be6c2b170115af5bc7dfa992c2c9e4d58db
SHA512

e89fd6c75c895bf17bec37cb123c3ddef5f5833ad088877803f448ebd66e9c0e7a77ac134cb0b389d8cacabc86d356b3c7d22a7dde994fba069276043b5b79ed
SSDEEP

96:uzVs+ux71FLLY1k9o84d12ef7CSTU6t/6/NcEZ7ru7f:csz71FAYS/p4Nb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08F2E7E1-9763-11EF-B666-DEF96DC0BBD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b13190000000002000000000010660000000100002000000027c609317c3b0269b204b40f3d8985ce9140b4a1b3495b888eef316f55288c10000000000e80000000020000200000006c09794bf50b4feb9edbf97f20ad65ddcd2a872c1e1b534874a4de6278b4e53a20000000c844e8d2f335c3c14ecf509d45b18343ad745d5c5decb624579e35536bb5f71f400000002498a0280cc56514d75e806078d430dde91de8308529cc125feef398c74ead1860f9d58324d8b50e02a8a9a11aeb612b25ea314b06a94049c5b8dee02cfb375a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04d66f86f2bdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b13190000000002000000000010660000000100002000000067428d86f6d5f973553dc60b2cb44690b68e8ec336f6de1a6211b828eb95b1cc000000000e80000000020000200000004bd016c13389dbd940a059c1e7fcbda557909c2abfbf5ab6f31b92e91395a9e890000000f3a128bc0ad088a15381b6490ca690c3335e8668b8e73f8d97812b1b74e0f16864401f31e0cbad9acbde3fdb52a93b63e85997bf1af4c897798e920ee28b96b023831abc31e88a9aec6fe469c35eece6a6326cb151167a27a5933c9eddb1f6810d3392fbd52d6f5e95b9db98b92275f5ff16f5b56c6a067176a63b92a2373d1cb0e9b10e4a5afa8212f6369e5e816e304000000003048014d352647dee5878a0dc50e003ab73369cab76eb7ea103a5cce9b2e68654ac92b9c4e26236e65ebd57c45017c073cfe2b02dc23cc47fc2583b70b33566	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436525577"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2092	2580	iexplore.exe	31
PID 2580 wrote to memory of 2092	2580	iexplore.exe	31
PID 2580 wrote to memory of 2092	2580	iexplore.exe	31
PID 2580 wrote to memory of 2092	2580	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\826fdca13acc13efb9da5b4a738630d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a700c8f74c4664d4813989fbc63f75c0

SHA1
61833930dd76bd33d1670409bcd7b0db8dbb4499

SHA256
5f6d3e141965113b96f4edb1810c0a54e2c69511445b610d479d13a1956726ea

SHA512
73a0dd0189f022ef19d0f1c6591153bcbde5ebc990257ac57dbbdd5571bbb3c83a99788b21e6c3bd2c675d0be0f3f460978b6db60f8b9c1a17f29bae76caa667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bebd29bdd714df3d2b0362802ce768c

SHA1
3c5970e403eaaf15ea3cf70acf1814b4d4cc4303

SHA256
4a01ce81ea1f129c904dc4e3ab40da2bd52a1a4b316888dd4ce65bf0294e86c3

SHA512
6883b3cc9a181a703625d74dad10d4c430400cb28b76e893b0f3541c176fd58d09136a72210569211b65108d3d5272e0211f2918600fdcb6f07057b346736db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26bb67821f2ae11cc3884731875e379d

SHA1
b4ddd9aa136f86e47616ffd4a944b9300b43e766

SHA256
3e0c477b7d709d9a77068c5a35b3145bbf0beff09e73f6a5594039349b89431c

SHA512
7ce49313494f3b0d603ded09cf7611639e6640247c7b51545e54636cfb5b3a9f64e29b648c3f8b6ab69c54261a85ccb88d9a078a18bd0c6b74d9fa788cd1abf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af7b7aeffbffc4df9ded7876137e4388

SHA1
ae7c85630468c70b2eda49a59a3397dde0ce80ea

SHA256
872592e65c66a784bdaa0b7119aa34b31a8a46099e4a702e498a1f048c5a3f8c

SHA512
d3c5795eea209cee56fdaa6cfda4ac9337fe8a4e72daa2805e658e186d9f675891b86fbacb0eb34f71403c21ff305cb28f8e1b556d4cb018aac36cf1c2d083e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c59285748b718617d618c66a074763a5

SHA1
f4c801cd75ebdd447d57361ddec38cee5eb17cb5

SHA256
084b5b8c54d5d2a5ad193b0ca6f4e88eb1eefb23c8ca752cbbb4b46fbcd45429

SHA512
d0bd5614cf9b4293de28a7e7b5a065c0c9c8e922aa13bec82783f0cdc6bcdcc6494209ad030ce49b202df11ac6d760b8232be1b4cb7ddc248e6d09ec636ba700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94b0b17c9c344a87abbef73086e7558d

SHA1
4e4e90e3141f8fa6bd66de43e2bca2cd252b63ba

SHA256
af3059242cfb6b94a2995a210a59eed0658912f50077d6fcec60930ffe1c507d

SHA512
3c6315daa92814c926064edea35e8975a6f8a3c2ca4b5623039c7a5057189aee53794ad6a95f1e8a1ec3713e93ef067e3243d080694f04dbeae75fadceb45b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
917192757810f70f3fd1b9d8da7d645e

SHA1
43676cacbb71a8725ab71325dcd534d2aae78618

SHA256
c4e1d3337254845985529e515b0755c39ac8676063eafb6ea83ee5eb6b797751

SHA512
154c0453449d40809b44d3222db03291779d58da1f6600ab68da0a9aaf103cdda85fcd6590f8972f6b57549c497e4bd7133d99280e3eff187fd1643dc8ec4275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
724e78668f4209abf754d4fd0a524a47

SHA1
0968e2b0a41a5903fd069ef1a238649f0f38277a

SHA256
850d4dd6f1eb3e6a3b8ad26446c9e6fb0cf9d147abd645e858c402ab398ba0e2

SHA512
f255230ba1364566a0cfc10dc16c12af5ea0c244515bfa9f853f1ac4106c4ca9783b95e8c3784b5b159b62ad5c9bb5642a8d35c4862b650d85cb941738fcfd8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2d11d2b4d3844fca03d008e625857fe

SHA1
f74fae46db9c160eac24813442707045c791456c

SHA256
48d5c07d4c33f1270aa2a470e299f88bbd413bb1d505b1f4e0d126c6d8907a64

SHA512
7afc0668bad05a0320261f2febb487f301f8f6b87dfca832a1967d51c51c9e6d0d17b36b2666fac903682df7db406f2b52e99d8db5fa1867ea42d175361ddc4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25922ff9241cc6669c15f1c3c513004b

SHA1
0aca8cb0914ad2b3aa658a70ff2eda01dfeb1b5b

SHA256
09f1d27d466546916bc3f285afe9bfff772b3c33a44ec3dc0307615bba84463e

SHA512
352bd51ea7fa751dbf5a84190ab166f5c0363ea097a87b3ca2ca792efd6e04b5f6ea89cb53061b939395bb2f25dcac80118e14ae5cae58fbb4619b9c2e7b1cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75a179b1b07c5e9593e26cdeff31bc1d

SHA1
f496c7da5f711ce4cda41f663fb14600ec89bdda

SHA256
66386d90b39a7771210cd4682b54406114ef6aa8df8ac13ef72acf3a3a4b9cef

SHA512
0f5c704a52c674ab5b2b6c60798de656eb9e34af7ea2e5db39464cec7fb4cd4d5b01b5ac9b7e80b3139f271e3590fa36fd315e82ebc78b7deb3da6aa55fe2893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
338c363d8a8b501c85aa719da8e5c66c

SHA1
01542d7d94fcbb2451d2fb7d97e423be0b98e4ec

SHA256
de7770e25702bd6558c82bba760312d11a415bd20c627197df8a312302651537

SHA512
90c977d3af69ef3c3e700dd6bb7c20f1997b12d29eeb31b6725a15941afa68f4e826b5f482a6b67bcc3fc5095bf3bcf16c6e9af83762cc7f79e81b5b8d4aecd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5647c8e36e888855a7c2d20532f503c

SHA1
6c195f50e7f7898be0f05b18294f070fb9f96f77

SHA256
94819bc6ac51e867bfe4c40f6d70f39a69963cae25847f468e58d9e3b102e509

SHA512
d9c64ea74bddc83b3bf3b05b87a8c785232df1d01f7e036e75b69d4c0c0990f7a401f4e677f412eaae7ae058dd0fdc1394e6c29daadbf8759f9fc8202f750410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9207495770073d22bd6220c9ea21703a

SHA1
d2d73f4cbf92c91a5e5b0520cfd487f7ff758436

SHA256
9e0117dd74b6672b0a67ab6173e275d98e5ccc74c92e5de9ca0a547a42c64b67

SHA512
cc4e2f8bd7863b8c2ce08f24e24ce23fa395084023a774e469d5baa26baef6890f0603bef6495d953b6a3b29863d1984285de7571d65c0193e51832c1fbef41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bde94c7f61f982088233010ce4572f88

SHA1
154ece46d24dbc1ab822d2541392026dfe3b07bf

SHA256
a7ccd50e9057e5fe15b68bd0900e81217f520c36378fb3fdd24544e09a3ecb0f

SHA512
d32681be2b8d2af967d63d89d0579bd627da3a0febf3b043d6bbfc9c63efc54a7555366b1bb4cf09a785072265fdaba86bdc388fd1b6e48cfa9d7d3291c19f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB9E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACAA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit