148492e7bf36ce76f7948d151c3cd2fcb77cb74a16379b3b55e3710b5bb1c494

Analysis

max time kernel
140s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b01c10184ba694ba2ca9c2ff01f0955_JaffaCakes118.html
Size

53KB
MD5

8b01c10184ba694ba2ca9c2ff01f0955
SHA1

a97fc03216e9adf01fcf26f7cbd8066e1f613dff
SHA256

148492e7bf36ce76f7948d151c3cd2fcb77cb74a16379b3b55e3710b5bb1c494
SHA512

2b0f970c9406d13108c273fe21590c3af6043e2a69da576747f839209e562f270d728813044f66a20d2d296db218a148742a0031affa7ca42b0eea67aeaf7843
SSDEEP

1536:CkgUiIakTqGivi+PyUArunlY963Nj+q5VyvR0w2AzTICbbAoy/t9M/dNwIUTDmD0:CkgUiIakTqGivi+PyUArunlY963Nj+qh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E860C801-57FA-11EF-9EEF-FA57F1690589} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000008a62323f90465b23781a0bbf2de6256930fcab0e894bf43f1c7406b48e005855000000000e800000000200002000000078526fde6237a627d2b4940b07793ac51d503829c22ac2a0b1f47704e3c10c432000000013687903b75cd6e33abd5fa56e6b7ffe949bd41e02fce8c73346c027ca2b9a0e400000007b1717fd71c5463977930838061360033159b59d07ff9d8fc2d1404fb88509a6e7be58768915f374f0283e1d43f86f4cd383f2cdf40a2a5e1235413bd0b0f568	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429553934"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000013accef6b6e589d5bfee5c275f00b618af26b9c9bb2567613ef2f3a70e8ee4e7000000000e80000000020000200000002f2a0097efcca3baa45bb8af21383b7d7d88bd2951c84c1830a42cd4c799708d90000000165feb6055f5a90d657c7e0dd6170e3ea7cb5ed5221a717af62723d0623b023c3f19eeb538bd3ee0d57bd98594a99d9deb365c7c7e08d9497f647fb5683ab961c81595be3043935d2211b6d3bdca702ec2366e6b8d082fa1c26b7721c4901fdd8e160feed101cf7887af913009021c14e02090aaaea26814beb7c3c0d6e9d20f43c4ad32913d5467376f8e293d7e030f4000000003c6c14cd61c0e6c001b721a0328b9bd1a61b2358018aede5c36d20f85232f52ca0182327d1b1e70afa438b24fa9d781bf59ebb9f6b4f7fa15204c8534a25d04	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509fcbbf07ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2788	1976	iexplore.exe	30
PID 1976 wrote to memory of 2788	1976	iexplore.exe	30
PID 1976 wrote to memory of 2788	1976	iexplore.exe	30
PID 1976 wrote to memory of 2788	1976	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b01c10184ba694ba2ca9c2ff01f0955_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2699498b2cee84320709709365150a90

SHA1
fd1a570ca8ffea4959e02029be7f899dc035d1be

SHA256
d847419e2d28da4388e34ef30dca18451d4baae34a58ee354cb3f7f373271f47

SHA512
daa46561a21acd763caaf0c583a2fc23a20b672b762a3837392ffedc08a1b13e64ca4a731eaf788130ae854edd131af189fb17bdbc89f7c82f2d40bfe078b330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c85bca530799a21e7b3d1a672f2283a

SHA1
9a66cacfeeaba2e6dd843265f7896c71e61cb4d1

SHA256
22222de19a8a80256bacc9bd22b88a94ec9a10195a88dd1877c2b343b3208acf

SHA512
56ae744ee9a7af67c806159a4b2140c00d47c10b6d71816539580473117f8b64ca542e17598942771f2c1a5bd28ec4ae7a6324af20c3631c79b1d26174a741f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fe22f11d6a464c1cd910b177a9e7439

SHA1
9e37086b77466c38860521feeb8c867875129233

SHA256
0a018415a8a7a33bf8585fae564089df5fa24e6a755b414ae3225b25374787d9

SHA512
0c7dcba3c856b5012aacbf2e723e00fe6a50c77c9c6b96cd8f939f92ddd5c4a6dcd2ba82eeba28c9cbc6a47ac7fba5d56a4337158bb607a6c56bba40d606b2bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92b55c22559adc0fb092e960fbb910fa

SHA1
79a13d8283e02a0bb81d7e03466060032d06dbe3

SHA256
6a58ff0ec308a370b2a42578ad5b9489b5502bedac9be5a325ff4d0ef4997532

SHA512
6f4f277725ce88bbc4481ed45344256f826318f8d39ea9aef1e190ee0539249651817b4902d593d47717af9fa60c6005ebd85462cf6f6fe017f003c0fff48b60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27cf46d93b1bf228979087df87e885ab

SHA1
b6a2fa787e9928c846ce0b4d6857d5ef51f79734

SHA256
164ce4f19f24793cdc9d6727eb89f9221b78dc454f50d608225c5c40b99fc95b

SHA512
efaa47258bc5168d5b88f4499d88afe050dab0bf38d69cdab667f936693f6b1de624b255c935dc4600102e65da2c1b99b9fb9926a6d4681b35427c5b84bcbe29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
860fae7647be895ab2b00b5b5087316d

SHA1
11295bc79d3f7662e67b715f19a2ed5075e53258

SHA256
4f0a198a3b4a83fb68ca00dcbda42dde24b0a7b7b63f047297bdbe7c26825735

SHA512
1b8940fc3edd37a2c54c84fc422c9260c01c1cc1956754ad1e56dbc1a66e448dac3cb51d3bf19dfa4630638838e7948a6c024a6b3acb9df247edc19aaf416336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8051b529a1f2875daada15a350adb75a

SHA1
525909a0faf5826cca058814fc2477efd969a24c

SHA256
8ab4e56528132e0dcc67e89f12e29c2d15c1b1ea5a7e208f869036477c3c69e6

SHA512
60091c60437dfa5be3d7723f33e162620a831b4cde2a87c754ad35d9d062e405d8d20d7feb7a02197f2137eb3f70f4d8b6c56cbcc4186e2f7531b2b4e9a19874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9096c903da698349b5a89cd0396d698a

SHA1
7371f8bc74bb4b50b4f97b36e3ee3cbf9fde2621

SHA256
d25fe095bf98428a76b82b999de4af2d54a5741902794ac1f0aafdd8fcbdb109

SHA512
14a5f32d353feb6274ed3f43fc818cdea119f6c5729608e1b48200dc4370dbda6e195bea52674ad279e8b8c71591108cb7969507e2d8457f67987bdef4762be1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecd4d7149f9a940854cd857a2d460bf1

SHA1
23fd48aa08859234651cb34507671fe0f7948d14

SHA256
e2220b6124334a1a12ec42811e5d7a798627f72bc2667bb36269504018c02a00

SHA512
5ae0ced402059c6a2b35cbb8f3a49d890f6a6d9c6b4d6e70261c13c8f01992cf1f95f322ad2fe97508c7982f02b1dc4feec4060060b7f679b085856d5f73cc62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0e1ea28ad35b609ce1b4e67b7fbedb5

SHA1
e73281cc12cfe33c7e9961fb0d864903cd91cb84

SHA256
dbba303f18380355653effd9d1d39adede7d5075cc34967090651ab95750b09f

SHA512
1964e3f2b111c97814414e897f6b4e37b30b9154e73e10a0795468f076156e969b1f41c122fa149a6b04791c0e42585513fb029fc8c4273cbba809a5e257f631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
163468455d4982bf67aec82dd6ce3978

SHA1
e2aa685571ab7673c6a54b44ecd836b88848f226

SHA256
291f3cebe15fcbabdccdc006650436813f2dead6e87994fd04b92f4fb4db4c83

SHA512
bbc8c717591f15b7469316ef19e030f5b400a6acde72ce94c3d56ac2fcee9804f43ee83bd2051bb407704b7d888294043eb89bea87153f3eddc9687bceaa88f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e5cee680ef90dfc79f4dcca1b555a80

SHA1
e89a16370b166189b1b07e64abb3b5501807cb1e

SHA256
44631736f47a23aaedcfbb9a6a14644b3179a53054e1bbb51ec271b288060981

SHA512
2c26e7b0a8ddd06e326444012c70cb91b2216208b7e826c2497274041181fdc019561d0cec3a7c0d350db77fe20c27c47969cbb766843b3ef44b4c772bf982ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6e0fea971c116252e2684c79b2219e4

SHA1
870f013bfc76568dc7ca1b2ed4a265f36ca73e66

SHA256
a5f78c5fc9a619359a1e335edf609d02741b1d1194b32451d41facf265c12f08

SHA512
bf7c999dc0c3dba0705b93a648f40637f6cc8321f2f81d9c3f84671629a7b504b94b936437f30ceb493171c332a20eb930698c043ddf11fc27998b7f178e888f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3047.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3134.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit