1d21b72596bedd34737af97cd7ce4063d1a37b3d04a10084b045350a039fa7b3

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e512400edabde5c13243da9f92d57d6_JaffaCakes118.html
Size

12KB
MD5

8e512400edabde5c13243da9f92d57d6
SHA1

3d78680140290b456addbe1671c360d3d725c2f7
SHA256

1d21b72596bedd34737af97cd7ce4063d1a37b3d04a10084b045350a039fa7b3
SHA512

34d57d85201744599b2917d18f67577783875c065357bc0cf6a3c2a2e705e9c33e1c32fabe233354c138af5433b5533f9b6673fa24090e3ebfc952faf5944860
SSDEEP

384:sUlIcqVn8j+V/gugB/Z3n1wWda0ImzguLZ:QVgZtk6xLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000b81468089f03bad836d4d19c79a361e9b1c39b1bad58c06e6c3dbb03c600693a000000000e8000000002000020000000fa5dc8dd58f089a6e5f2d73fd4f569d3c602e1a20e2b42a4b530371df7ace090200000005a9ffa2055e2d91a1f480be06bd46232bdf3227249aec9eb35a51e38ca52e3db40000000847378a87c3d3b71002070f6372111d3958b7d5ef5a35a58ff949d09e1c951a40258fc78404e590d5d1dd309b7718397b9e8c552ad5905ba4d08ba35abdce0ad	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000f37c637ae4b1f13a79407d0caf54b755c5fc26f1bca268c98aa0c5f134170a37000000000e800000000200002000000015796f8caa58ba2a3685ad959be1c798700fd7852f24990eb9a47e401bdea6d8900000005a2704535ccb47d2415fba05b4bec014bcd83500fe686a028630ac9ef7a2fd95ebbb114a33a57cba138349247b52d3b880f484dd4a22e0b026860d86bf077990a5f8a03e903a86a3eb17560720570a2f7fc6ad57962d44fad0cc45aa5237b2eadfee6fc9c49dea310892b63971442a861edf7b53b33a530b903686321e81c0f8bb160a6464895dd1a6611607f9e54f174000000062f2d4d04a101a79e3f2690715346114ea25f047235dffbfb9d80ec598e931e1ed0f55ac3a529cec8d5d6b01048416171cfd5228b77a44cd6bf8e74aa815c66a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429618998"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67DB3F11-5892-11EF-969F-66E045FF78A1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0af8e609fecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1716	1976	iexplore.exe	30
PID 1976 wrote to memory of 1716	1976	iexplore.exe	30
PID 1976 wrote to memory of 1716	1976	iexplore.exe	30
PID 1976 wrote to memory of 1716	1976	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e512400edabde5c13243da9f92d57d6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74b97c35010dcde91ea87cf72de3dfe3

SHA1
1faf831353f1429353b2799448fe08513c53abdf

SHA256
6427f08d289d1c79db0b623dd60b6c72491fc71340a16f8e468f5351aa0d72ee

SHA512
5969bffba439fac849fde1f969a9fc2fdbc9dc4c74536cc70e2f66f97584617825673e9131a0819b0b5ecc7ac1b25bd1ac10b99ad428016a241e99496bb53640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46f9e769e481756bda28c216d8507603

SHA1
1528acb46a93dd072572bb8870bd000fa4e5b73e

SHA256
ac76dedf94aa9d2343865689d691185decab2fea858d47be230cadc96b21bce8

SHA512
7647fb31542af6b46ee70bfa51859651a8986a4818db473947be18fc7990cba2cd9c2e1a76c6e98fc61747e272ffae3b7d7cc402680bab50d87ac6b648b02988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49d298a75b82559edb6ec8d6cf638858

SHA1
b3be26406826ef35e05dfc5429fb1a410dc5e7f0

SHA256
3a1ad9755196d2ed3c7c41e03fddc5e0b59eb3b509bc84b2b32ab992f9976e89

SHA512
8d8b94119364d584d32f3f62a5c68eca901eac9a37f29c340baf9444fe6a22cb8c57de0d53eb05ce1f80405e0e555df45cbf2bcb896df1434468f58eb765ea47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0758a7d6e13ec66c625cdb2a4d940804

SHA1
077a3f2997b23fb77ae6b138623d1640b9398e7c

SHA256
c9481924ab1206e380b67ae9d9e0dfeca0bea1e653f3208fd1f9ef5068fe4140

SHA512
61215cc98d6dc7dbf731cac84b40cdc8c8d1eb0109dbe19ecf57fd5a918a8a11cf2d46e1f6b7c1edfcf6e61ae07428a2f6e4890a06b4f7d03b738c4b430edfef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f262085c63c83ab3e2a7ef35a9d317d8

SHA1
491081c7d838d4fd7ffa872eb08dc82d683dd485

SHA256
b5051d0c03a460d0fe86c2c31625ce149bffad9263082aa125d0aeca7f1b5c84

SHA512
73f41511ab0cce2ceb785f665acefa5f0721310431943dcfb755163900d8371def571dc6fe0d03b57533a183731984f5ef639ebadcd46af6db8234196269822f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0373db9e383307d34642c337663e0a23

SHA1
63175c397c0715d85b0e14210030ca6e523f9536

SHA256
dcc0a6c471d667acedb71688b93c70a6167df5a3f2c76636cd348fcb2af1813e

SHA512
2305a0587cf844d98c597606b85dd3869c19ccfa10b081f4e57b3289b79683c173ae81474c082177d9e36ab6ec690b7b2a42f5a87f6bc97b2aa1f0be8cc4fb80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6a09f2c8a87ca94d3cdc0509ef8cedb

SHA1
75dcc9c32c1fb390f150795c416a03e836615c24

SHA256
db1ce011288aeaeb1e31039cea8f042f31fa67a330c9730293f648082885508f

SHA512
158db478e336749947f8627b9a4fa9d87e452b7b521b3743af5e550f5bb8ff324bb674c4af589e66c11a335bcd557ab5952a1f7ba023d8aadaf5e5a5c71caf69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8e266feb7e83559f51b134bcaa53b3a

SHA1
968cc56efc703ad8f98796066cb382da6e1700c3

SHA256
1a0c6ae0b6445ed5b6d445f4fb57e32bbc571a1122a2f0ceb47efc78a89ff494

SHA512
4100e4ad295ed888e49324cb755f13597fb2e98e9f23dfe4d33b4e25bd0f8c9af5ab75cffad13942dd54e8e1cef7d44920a45f6dd027bcbac3bdd7d5e797fe2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8638562f63bc81db66946dd609afd023

SHA1
eafe9043d35757619ee9a405c1e267fefdc85e1e

SHA256
6e6c9f296d89a21c859733c1577448a762db21da2d4fc3483ffb1d028ff8b70c

SHA512
7ec64b0d37d5e90965f08f2b957a771b8f03ed503ac9d9ed0945d2c1d6706c1afa8428a0a48943f16c5e21c150e8e73284c1b9942612249b33962ef140a37e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fba66a4e7530aa1bb761387f7e3624e

SHA1
00dafed715699d4eb8122f40239b3f0b5d7b6c09

SHA256
958d94f581dcf17afc492e89017bcc2335b0ff9ba5f8715e23d610e59d25f047

SHA512
5981e2555434bca2cba1aa82ebf2fa4c3b1822cf4497f5aa7f1d0f910dee75179e262f2665c443706cc33671863422595fa89132298e92620aad6ba8476b233b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d7ae641971addc3276a2181e2794b65

SHA1
7e3a65ad1be0af75e178337f7f9ffe3c01c284b8

SHA256
9233c98f75307a49f7f9797a5bd0139437dad535dc39c8f68214739ea96f90af

SHA512
11887816b69943ffb9dc6a4f82043e1271ede25b7bbbb53e027e2f30142eee8d95f1dceea027070e10e4d6c760d86e18b8692af31c4f4a25afc8c7eb9e745be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28226aea61747259551e6b172a6df1ec

SHA1
4a92b6011b418fc891591202f8bdbaad7bed370d

SHA256
716f645fcd2e7ab3448723c9ae031c453bf0372661ec30db024b47fbf366ca4f

SHA512
96572b76b72a3bb12809452a75438369d12c38bff27545357358269f36dbf55bf193eb7ca7b97660b876dcac72608ddd0b1a77d2425f7aebb8f4d280b496b198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2783e020fcdc50bd88d4b92b4e4d2973

SHA1
8e779f4e84415ce3985579399b7b91601b75caca

SHA256
ff1a39312493a53c11890002849f02f1db4c30d106a88310c285c96314138180

SHA512
cc45c7bf197046772d97a02cf1c5032cdaef48e56566e7a1179a164572afac9979888251a3352dba3338a8f0378c35945b119e14a173e9c13dfa1b38ae6fe134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68a8131282588f20e044ba6e90736118

SHA1
fd6bfcbecea7a112a2120667d1f75c8d2ee8883f

SHA256
1b7da3985e01b9abb7f6375a2bfe7b4f2a53b5542e549e19e8269c6fab9deda6

SHA512
d0cbbbf91a1d7c79d06a6ab900ea4e97a77efafae675ab60d7f0378219ac13f7f4ac8fbc8a9058b04198612241d34969ce67dc729b5e2aa8434c24ea6f60eb7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fbee301cbce2225746f95aab4998f9f

SHA1
70c1a7086bd7c4548be0ce17dc140497b6aec166

SHA256
2fcffdf0338dae701100a52605c36c92b4ebddbff9daffe022cd9fbd73be6d39

SHA512
97a51cd38c3e1d3889bee066e43c67a802c53de9683057de1e0b13faa02432ebbc9b32777b3dc5a97445d0a622c25402f561754b829671f2c8d046ac9c66ed54

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD71.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADF0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit