c137d2c0f6ccf9f54af0c1cd9cfa3bf20515092a28e424bb528d9101c8b19a5e

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8452935f60adaa2be9fe4071c8a236c0_JaffaCakes118.html
Size

6KB
MD5

8452935f60adaa2be9fe4071c8a236c0
SHA1

1bbc40a8c160376b23f1f92a1beea0ab99c9e48d
SHA256

c137d2c0f6ccf9f54af0c1cd9cfa3bf20515092a28e424bb528d9101c8b19a5e
SHA512

857f10f046c90ae560bd3c99f1e7e6579d3263936d3d7448b3b8a0d267883805b0ad57c8453acae0afd6c25d534718303d4448a3cb3d1b0cc6b6f718387ae81d
SSDEEP

96:uzVs+ux7cKKLLY1k9o84d12ef7CSTUiOcEZ7ru7f:csz7dKAYS/Cb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b6eac8480c89b011e685f2cbff6836f1211bb49a1b6e64c43046c8c31daadb52000000000e800000000200002000000054db2a523f2851822e7000a9f58ce47f4b3ec27c9f33f6cee69fc1a694d7ee33900000009a70b0b18ec6f862e3f8b0b32b9e01d8d83150c6223af80aba36ab09b2f6f1d377bfcc0511d95f3e715933922a5732bf7a680d3f6c7ee735dd068465b211594c2791da602dc0dda09b52965455fd9458984594966c3795bffce5ac55cfb16dbc978ec85485187779cb241126e109ea0787e5234d8052a49c02c3d16978ad80a08630f45e2bafda65e573675d7018f04040000000a94fc386f8c2738778e0a0d9ba6730cdfe1be8b67c3d5f7cf0be93fd3277892436c7f8d56bb4c2f3863214995574173aee12913c5482a4d07440c21dab438c54	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a099146bc5eada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429415494"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000924f64014bc5e7ef5390dddcf9eb05d826ea5d2483aa73c0c242429466800cf3000000000e8000000002000020000000018d73b3e470e911e9660853319b32a6414f5abe209fd33fdae29b5b55b5870f200000005e7bff5f6e0c601727a19e47ce81197060781f51699d066bd3c271fadab6dc83400000009da63102c1c99a883f29b275863300d10165ae177353458789255eb612a9aa334b021a36ee8f8aa1937509310989ab06abda21db51e807c5d2d92f2d38093f4c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96051771-56B8-11EF-9FF1-E28DDE128E91} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2408	2036	iexplore.exe	30
PID 2036 wrote to memory of 2408	2036	iexplore.exe	30
PID 2036 wrote to memory of 2408	2036	iexplore.exe	30
PID 2036 wrote to memory of 2408	2036	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8452935f60adaa2be9fe4071c8a236c0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1f843f30863421ee970c9e971ff6e56

SHA1
9dba7367adecfe5833df89212c4e2fcef385ec4e

SHA256
7da5dfbb7d5f2fbcbc0ef77d49c1458b72ce8d44b0a4949f92d497655409fc77

SHA512
14ce9c244bfb8313658e63460abd4432475ee7eb252c5c1173572e3c117e3b481e1401366d3fa2766d1126e37e721de4a09c6f10d3ac1bb0aa228035e9064404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
962988b5f922935b0895c1fbe7b70eef

SHA1
049ef2ecd03d4a9660bcdcae8c43a96f8963820e

SHA256
ca0bb5b07fd04a8a98fc73ed97f81d5f642a439758b2a07432b754b3e712e3bb

SHA512
db2b01e9c97650313bf1bab22e9376d99a88e8ac1ca001f26ca2e7e56ae6b574394014b81f72cb1a28a4540c768bc483bfcfd62a9a2fdb89599054c168db0974

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
130c92ce86d969d48caf0ffb7b557a52

SHA1
934330bb8609f2f8117aee52101dcea6b7a375bb

SHA256
429e52bc41f1d63556e861981aaac1c46706c206c93cde565815354efb73d91d

SHA512
ec4ab39105840bd5be0e4a6cbd8c70b5ea23e3fafcd07ca7180a96b898881300f195e162db7e18910029b9209c2b97f1a0407016703ef1f22b9396c6e2280c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74f2390e6856663e28d337a02d2a9eb5

SHA1
1f81e75f5ae4a483874f214524726510d2f984db

SHA256
a0a9cd898fb1b1ec039d110a18c481ca06c30be21a7798b3dc7d8026aa4ff8bd

SHA512
a30f6cf83b8e3b53314cc33e650fcd4d58162797563b177052fd3dbdbad1190df0311d830604370a923cf8fb79193e1713c715a83fd595ee944971970a8009be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b7a5348e8aaa4ffbcd18c361a6681d6

SHA1
d6d4e0ca56228537d3ec10ae3d55834f99acd70b

SHA256
5f44aa93ea78fabb0d5578afa7f8703b909b95e35282d9d69d6bfa27d1464e22

SHA512
b3eb3ed27d7c2a383d9e25c4f34da20131fb50111ac9566f64b773fdf33371e693cfb925761956a1aa0d8a4e93cc0c6fdcbf094bbd626d31ae7fb5865cb98e45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b895c61ce052a948abcb90be67e84f6f

SHA1
6e6a44bd326779c76d00c03013f7e53f69bff605

SHA256
cbd77ba9e40c4ebc3c91cc3a03c9657a2554891940377f12694efd39716c930b

SHA512
36975bab9ffc63aab3e281e46850e9c003d73fa5fb7489b97f19dc3c258914cc34133e8801d490810ab873342e60dbb50e3178d6089196056fbcca9c27a59845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07b2475a744fab647d610e3ae1091995

SHA1
f4a531afd0a830f94b5e72a4fceb8ad7c3473161

SHA256
adddced42bc2206ef391b08d64c190ffd30613377024721ccce43928f03e2800

SHA512
85279e2f59ad0499450613f91bb752e783703823223c3b822ca1924c14261a45ce54bbe6353cf719c494982f4230a365fe2569cd21c013949ecee61f1757a1cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51f771fbfcb671bfdf616e70909f6dff

SHA1
17034b7642a9482cf22da5cb15dc0467c25c7d33

SHA256
77f3b3ee7475d0850080ae3f5b59efc40b742b12c241e64e679ef5ede4a3bda8

SHA512
46cbbd59ef4f6186dff9ed1add3284a055b6415659e411b0912a3a48bb2a9580679a12946ac66410ff2212be802df082125e364c1a16a6b400085c13bfd9a613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09f1cf7a8e5afdf0506538ba9d121186

SHA1
1bf069009d5d5d46bad34242ee77c89ef94cf163

SHA256
33ca449f838daa59d433a31f1ffdcece05fc854d4efb51bc1dd5f8f82fdc01bb

SHA512
01e69c57206bf8accd130c9f59f1cd337702ef083dd0fc48cb40ddbcef9164e8e0babbbdb531b3d3fc9e8051825e0cd2a015b31d694fd5352cfe619f2cbc1f94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02e72985cb7b7e6ecc702aa3c4a90c10

SHA1
93f7392b4a4557bd5b4497033304d77344ddd4dc

SHA256
134f3cd2d4bdcea96e8d367a9e0ec89de46342f09e8ee840513b4c2d9c3e0a86

SHA512
68d6c06fa401829e2ed0d807e5902e41924082bd6bdb4c330a4db39d90f792077563a5c161c42eea7f6d33dba09ffd05e9265b9a90dfa2cf74abff5a3568ae1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e498d81e6c663c3ace84b7f414f613d5

SHA1
cc1388c5be7e3b94ab74097997a1105a46c15d6f

SHA256
cee07d4eea63c5bec613e0764c6ac6dbc3be86d31d017a5650c5f420e07af428

SHA512
ed8da8faee69a197fc5ddeb3fc2add708184be6057cef8c1a8fa81ff56cb6f80ac9d409373992e5501e3453410303daaaee2858cf87dcae21d847f16b1a9aa91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71bbde221617559cec7491db75d3f66c

SHA1
789a4d466e842f0e4063021381c71e2f3542a444

SHA256
f7b2fbc20c2e03c86eb486ab9417a162db5f2194f396c0a373540bb83ac48e04

SHA512
bdf2f85d7045dc8945ee1e7687e3f55fefbce4430e14f9586bce7f47cc8aed36610e99b4cc01688bfab9b158ce635573066691d9db5be7f7dbef2111f4828765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78a8bc31c1ae0264f3946e16771e95b9

SHA1
22c81c0a9b9e85e37640e3b684203c5cda667153

SHA256
9625f61d9c43f0967b75377c962c81495e779209a2b11179fb92fc0cd6a39508

SHA512
7d1ce605d91dff88999bdebe50be903d2581fd4596750d649ea0f23827b0cbafdb73de51037f5cf36ba4100c2212e578936b6f2fbf368bdf1eb18a6b51b45b5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
014935f3454f309436df43203626239b

SHA1
f9e0415f14fb5adbcf57cc62f9230fdf95bff082

SHA256
ccfd2c6799d8a66bb2459012a4174fd0bb9f55281b019a3cb7106da6d219b39f

SHA512
d9aa1ac2ce23a2cbe3b4a902cf1e94cad23053a0ad5004001de00a7c7314445be3d980ea1352942e95fe4aa666d786a7d5e081122861d40c11ef608b4f7106fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab205F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar24B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit