45e841c1550ee27b3da04fdff6f373f1cbbfafe58eb2e499066ee3f4393849d3

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8aad835070fd518edd42641d45658e82_JaffaCakes118.html
Size

16KB
MD5

8aad835070fd518edd42641d45658e82
SHA1

a37777097dbe79168f8efa054447125991d43a79
SHA256

45e841c1550ee27b3da04fdff6f373f1cbbfafe58eb2e499066ee3f4393849d3
SHA512

af44fbeda9d0af531f699b64953c9e368950760317594f3fab099f2c6bf4bdf8542d4c2684e931d27d6405524025791afdf555f8552d27e868505cc2eb57c4a8
SSDEEP

384:HI/ZdORe3L6fegWS9C0OOlHSPhaXlyVy48YhPHR:o/ZdOA3eQ0OOU5aXEU48Yh5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b0e8c1f8ebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000030f8f02f91cfd3632308de16953917e579c38e626e6e15f3c0b965281d42a900000000000e800000000200002000000049ebb77d2b191b8111276569320b0257253b794deeddc7e09dcbdd179a28c569200000000c164b1451eb288fcb3978658583a3b369b5776c782ae2b6ea4fd706a1672e45400000001c7549ad612507f817fca7d64793b322a9254aef614dd7aabcc97378edc0da5d038a19e602e810b4ed516ee671acad5d2e286c7cdc03c7a99850402d5125feec	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED655191-57EB-11EF-9DBD-525C7857EE89} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000006542dbca2ebc5fb20ec6f692a91aac8f96155922585bacb7381927efb45b4f54000000000e80000000020000200000000c243479ad15b505ddc68dd71bf757a1a4af3fcbd504f447ee433ac6140337ed90000000206dd6b95996a892132918a1963d20fb3b2a6e409ffbd3a3c63b7b5ef515e10b7cb24cb21efa72004aa42cd125af7c69e1843c0c7ea1fc2abab48191f739713f745e23d42c84590c7ee22d75f845abd888ede25ac93fc4f4fe7d01cc4180ae5e679e3693f8e2cf9a3a6632385d2727c931dd80f04e3d08c4936dcb84608df2aaa97c4e936ecd520a88376dbdec9d6c074000000037721c0e8072bb2c0bcbc249d2aefdb15250cd8c1c0813eb8dec20bfa3cead3879d12a165890cda5a17aa9457963fbf34999c048521ac9374ef97d802fab928f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429547499"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
568	iexplore.exe
568	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 2884	568	iexplore.exe	30
PID 568 wrote to memory of 2884	568	iexplore.exe	30
PID 568 wrote to memory of 2884	568	iexplore.exe	30
PID 568 wrote to memory of 2884	568	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8aad835070fd518edd42641d45658e82_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:568 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf038d989b101321e1816ddeb7a83839

SHA1
256e6d6612beaa242d49b4e7667495992d206ff1

SHA256
4176121b760abd48bcda6795df680f1188e076a28ae5da165a7c4019df1ad908

SHA512
6d06261b0baf2657804cc19c16efdbed0a649843d35f8988d1ff7d167bea9a46306b91015fd6c8a03c6aac7d2b3b7b6a7ecc9e0e592a227fbf793b0a38a3583a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7cdfbb620cb00efc6f358c4c4cf1664

SHA1
662e1c376c402435bf6428243671dcb83b847a89

SHA256
d4fb3ddf2970588e87654b772cf9258965d3087075c5e62a5ff1924a3329dea7

SHA512
ee625b97e242f3986a692f8185c041d29a3132ad109d311dc8f40c73f9c6ba22dd92948a9168cc62615010f070fd32fc45e74c75c0cff91a53da8257ca2ce437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d50f3cf6de7e6c0832ba0b5b79e7c71

SHA1
1a8cc4166f54bb3ac5270add585514ae77dbea3e

SHA256
519c5671ed48822696c894e0165e465eb5227854654c97b62054975dbcaa680f

SHA512
f22a2a89518ade11b5e5577e2850dd4cd5df56859c39005629108e19564871b3cc394368e3e489e5e42ea39789970809108728bfcf29fe11b3799dd997362efd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e04a1874e1a151b9b13314839ed684d

SHA1
1aecfa0c09c067bed479f94e2b259f97ca3af527

SHA256
c388192ae94e32aceec6abc38f6efcffc9cb91acf1b235ff20eb475a9de63d3d

SHA512
7cf5c24efba59dcefa7cde29240e432d807dcb5d6c538437c4d5b9540a28ade6453ac5e2e5f398a4f357b4c7046b65f6ee82b2dcd0b0544cf040c2661c8d401b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6beb251023b309f8d3071a368e80c9ca

SHA1
8251498ab411f5ada8df0f7473e2aee70bd76004

SHA256
f2b4266bed5d4546ff96070dd463d43c335ad53b451e26440a47c7ba6693083b

SHA512
0ac27fbe8c16f040a5c19785d867076db3c3342c2dd3b31e8c26ebfd4477730f31ab9df9e5e2d63b7195df1a736bc05501a15fc049489cede16ac99f09f278d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27e4d38ba48fe81173f71920d5ed49c5

SHA1
4ed72fce6c4d75b5f76a98ab31b75f366561bcb6

SHA256
d7f84501c907b9feaaa6c77e44c2263a1f4aba14741c0fc90af7a404fa649699

SHA512
e381bb36083c1bb6160d3575506ba2b025206b1be3ba3e2a72ba453545b8c5fb82d3d6967eeabe0d55abc64f2897338de9164d9c23868df9265c466b116bf7ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5da48ac29f0b93a2060696c0daff6dc7

SHA1
dd92b172a49af7094f6446e39525cd911e678dff

SHA256
1f5b3526424323224d92f091ab8475497741cbebce5cab47e11e52e48a0de716

SHA512
b278c5ad1b4baba9942e280f5e1ea35800faff42087986068db5a243602918dce9089f6d60b368eb4eabc89fae718df879e25fceb525834c751e1455292d6369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8933e80423ea06c4ca093f65367c2933

SHA1
c06338b923eae7fff1df8119bb4d1fc41477fdcc

SHA256
f01d9a449437734c6f5add0a12adbd9fbb8273c9ccf7d9231d598055f49905ac

SHA512
129cf8bc507dbb7d574513dd9a1af7fa10f637050f3cac9e2aed29e8717e8a9a5fe1adbc1d097a33be0200ddb98724e4965b434c5c8fc5e06c55966f9fe3bd4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
343c221b76d4c6d2dc6966215da9ffbf

SHA1
18bab88b194434e6f2f93e4af8f318ee3b5c8130

SHA256
f9a2b844cd7ed1dfa04867ece1b697a6d65c1f409f87c35f66f6e24a2e58eff5

SHA512
6f58bcfb04a5799e983f7a48508f1355665db965f03161d3ccd5acea0d9b96a009fbe5437f793a1bb63727b9749b0ee40a46113e4901a244f977822b50a3c830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
125cfd37bcb2b295a4798c48da5e67e9

SHA1
b9fd9ed453a54a0a6689c0022ccefac3b30944e0

SHA256
a5c07c12b44f1cead72de433ddce75443cc1c703902556dac6d8d2104d339f11

SHA512
e3b2fd83e53e5db8c9993e3cc45c057a97857c1b383c53c71a73c87f93771ca0a52f1ad60aba61d667250a15e78a9482b1aee612eab5e0ce8fcf9efcb84c9b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
758733b88d3aedfaec09d464680c92cb

SHA1
670c446458ede3b251c36f61199637abd42a3b05

SHA256
bece147254a11714f9158895846bd410e36b5ef17f547da47eb4058c83fe8ce4

SHA512
eef9efbc0846301113c7b268e5f75d3defdd8ffc1fac0d2be65c8e4a811624f0cf5528846d19046039893f0087c6d87e7ab50d6557a9fcaff7ef7b9e2dfa122d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfb1901128f0b0f09a44374be902f7f8

SHA1
aacdcab8764847cc6fea8976e59a6c4f136168a6

SHA256
7650f1169f16fd3b8dc407c0be58356d1fd4ced49c7192620ed86bbf51af17f3

SHA512
b7f77a1c6e407f616e35b7d2bf6f6a967898ddfefd4fdfaba00065b1baca9bc10917ce22d962c6e6231d20e7a969ff7c14dc05e8278b8a021c5853444c009ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68e64301446d30c77fda049ef322cb57

SHA1
b7b0c3c4777b42ae7c0dfb8949fa71dd470c896d

SHA256
0d68c33fcde599a610182238315d793c283878776426abb53bc4a05f71ed3466

SHA512
5daa622988cd5ff1a042a3e64f1f1924a12d8722bea957b37ba25d36ac6ca27e0ca06c1cbe658ad71b92e5624193066f6537984f212c07f47ef5316ca556327e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b0a455e68af10c5ddebdb1612c40854

SHA1
82eb4c4084154c50287ede28ab93e9775de0a932

SHA256
dd0da5c633668c5bf9481f0b7b251f33ceb75e95cba799b538a947c5f4c06e7d

SHA512
9b2ba83f3e54bc3ae5c483929472eeecff6a5995952c851e9bdf80b948fedfa458124e96d381cf5d42227c92c384f9e2f5fd88634a1ccd404a0484f2b72fea7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
949b9a3a444cfe2936c6c400c10f6582

SHA1
04c4be193fbbedcabe92ddb90eb08790c0bd5b92

SHA256
13e230412792cc8863ec25ebdbe27f86092c2a0469c01c2acbb1a47d0672e1e5

SHA512
6e616938db77e2d5ce282710fc6e293faef0765537ea9e70006396fda4a86a7cb77af9f57a5beb50188f7117c04aa113b9a6992945a6148905da1d2e5f76599d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e7ce597bdf1940b8e89624ac76c1507

SHA1
8c87b656cc40188b44cd2256df4f065dff9db09a

SHA256
4cd16f1026b3cab0ef80f93364146c00c1e803c3dc31db711006d40e0878a238

SHA512
a7df60860fb34b1cf216e73968677805de92cec054e1309e9f07854b2eb395c5248fe36a0f022d740661acc16305fe6b6d181016fff7a5a1d81c8d500bacc3dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab760B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar768D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit