7d65ac968e35d0562b119dc73b4842b277289062e078611d9fd003748bd18a3d

Analysis

max time kernel
126s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96d935f74c4e564c510e509f830ff509_JaffaCakes118.html
Size

15KB
MD5

96d935f74c4e564c510e509f830ff509
SHA1

61c9c017323d99598e1fc06618759bb6a4d4a47a
SHA256

7d65ac968e35d0562b119dc73b4842b277289062e078611d9fd003748bd18a3d
SHA512

234d2b640c9fd19b38b04d5db4a95fb95d5b28d5c39376dca6609406a5d2e6422c62fbf6d5f713eb5a0ec0a1f83724a5a357e297f99b1197b11398897b396f3f
SSDEEP

192:Eren8VwgJSxGAf/LwlLuuH8YM8z2+sB1fIqPEQd0lLXalc0Dp+vfRD2qFKlT:NxGAf/guo8ySpB1fIcd0lDaZtEfRK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E163EF1-5A5C-11EF-A3CD-E6140BA5C80C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000006ef1d23584a519b02977eb14eef81669e714e773b7903dc2f32ce2afffe3882f000000000e800000000200002000000061113d5d61a49c235021f63db62f3bd4fab75604ca44fa6eb78d86976459ae712000000031ebcad2780de7b1c9e44d395c75d02ebcc5aa32b47b71ce15e5ce827124c3f5400000003bccb21813775257e634ffc75eb7b631cb030f43d5d42471ef437ae8e2464a7bac95c062237e320297a4c8a42b9be8f1af44caa7d5b011c5eceaa99e4b08041f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09f363569eeda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000c7a7b307883b5830a123c1ecaebb550c25562981d523794c641354d7b62d9bd4000000000e8000000002000020000000ee4d11227977f796b54f1bab30cf9d80c0e462f83a16e2818efdc0b677ca000690000000e9a7760d5e8d43496c94da6660b6e170b8c8ad71bebca9cf7baf537bc79047f9a391690b8be470d85fefc965698f7ae338a3ec6a55c37d9587d882c7a4c570560cb465caaa07daf021b618f9316f1654643591d688ea1266a6d2f2c98679446bdad90a31c6420736e5e9935f3c55638c1fe7666ff0b4da0333d83ff06de5d960877f9d52d6e62b4d88233e9737cb1eff4000000099574245bbf90d4a7eb312a30231b4ff028eeb2dd6b86a3f68b9344e03d43bdd780c1caebb334e3ab4c822457d9221a94d484068cc88ecb4f1ebe6258ed335f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429815692"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2720	iexplore.exe
2720	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3064	2720	iexplore.exe	30
PID 2720 wrote to memory of 3064	2720	iexplore.exe	30
PID 2720 wrote to memory of 3064	2720	iexplore.exe	30
PID 2720 wrote to memory of 3064	2720	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\96d935f74c4e564c510e509f830ff509_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b59a27083b8b74968f0d61887faa2ea8

SHA1
53bc4d86904daf2044e36f64802ec4d6678e897f

SHA256
6bdc090512853825006315c455bee8962b34439b3f71a7506979e6e7195faefd

SHA512
321638b21560ad253e16c8091f2eab709017322e36a8be7a090b5a2bea0b551fe99a6d7efb6b0c4f7747ea1dc2a213863fe703420a4a2cda0c74d13181ba8386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19d6a936939207e9e600127e572afaf2

SHA1
4a919f160f36a378eb62f5e2a462102a4cdf9603

SHA256
572c4425d1b312431c9c1fa96cc6065d0e28cc3bf5135d4e4e9c207040ccccbf

SHA512
ed00e9e54bece99e50770d3e51fb3a60774aa75d185e27aae4a011442b58752ec2ece47e460421282e1610b0823755f0c9e27729c260f1e30cd0853dfe6f275d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5814c188af218b3a01dc05b9b7fb11e

SHA1
614c377b566087a054a03921bab9532e8d72f18a

SHA256
ed15dcac1adb0d530b237f0ae2b5da39548fc1b745dd80392fd5b7b01b43cc02

SHA512
7ef2a6017c763f4cca7696d115d523565a8425d295b8cadecb0039b4529c5b20691dc9e92dd9c64809de5cc1c555f8cb214da98e2ef2bc2a508da6d6a2c18ec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4fd709fdb863fab76825a1e749fd9e7

SHA1
3df7c5b655ae31146454efe9996b98ee219fe300

SHA256
28db4a6c3c655ec1a19449ec245a5fddc56bc29fc6134836037f2ed453abfa98

SHA512
8e0362ca7ccd7c733e626af2961699aeda3cd6a53580ca866a1a3b703396bdd56b1c6b2deda5b95fdfeeaf5f44dcb42fe2ec6edab1c88b5c7c006b982ab66782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9caf9a2ed466e28aef4292f1f4caf84

SHA1
51f153dd49b7eb0e3b0ee50df2049dd5d0561921

SHA256
3ea0bf9e4e34aa83621a04faae03d3c8aa7abce6e18ac4ce6af42eee7caf34e7

SHA512
9988d4667598664061b611fae92509927b6c6def0d078cb2d5b80855cf8d76da8834eca20ecfa917e1ed6df5c778c83a6f401d42b102c5fd6fb6e3a5fd9bbf43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f40c0f724b1d92b57946eac591df9d49

SHA1
7f5ea5ba9f0a27822646f2591a8a02a2e745373b

SHA256
5589e7aad636278c727950b0a60f682ed0cc2a7c0fb669b33c1c7c5dc000c630

SHA512
e5da7a991a920ba4ee5f1229bc2b6e90a6403e97384190b3d1c2a1f04d2e7a2962baeb97a43b770dc5829615f20110e9869007a722be6b1a13b2063ab136feb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb29547dede68626c083e2601526fde6

SHA1
cd36cc4222a3cd5a2a53eaf14e77c286ca70a4eb

SHA256
fc3e047cc7fdf1ee40906b64f7a32090f7ab6a34de0ad7ee45f44b4bcd4cf6ee

SHA512
b63aefb3443b1e13d2ea536eb760e39177610bb61389704e2b75cc97f1e0ded0f109aee4aa1437cf23d628429ccea8ea85de894c3012fd6529f23554bff01263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35f6210b2da46bfd20e47bbbb36ac64f

SHA1
44b5646cfecbe8c87dc3da16819bc4151ed19dd5

SHA256
7062f74f9996dd908e6c4c0b7d43f5216419e6f97e2204a0ff4eea8e6fcd743b

SHA512
23ee222c5f35c76739edd47b2b23bc007eed5faba4ac8f367a7010501bbd033b9a7ef5b9eb45dc6372dad3df431985af8b0efd59a0aceaa4a3c64d76ff86f6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf4319bd38f7f48d1a1106302c2012d4

SHA1
ec82b3a8841eb139917a3c1e364ae5f604d8a04f

SHA256
9fc65f7094d8cc03df862773968969a0ba08f6560c628334f0e51a87cd4f9ff4

SHA512
3d39cf556e4466238e0c12f5dc1247fa013f49b139076f252f8fc66cb0095dd80156cfd57229dada1626531d6c4dd7d1a91b656f2dc106e6ee06c6de4beeaa30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a600e483d45c288d5ab62574c9b6db8

SHA1
0f15fa40e8c73232638ed77af12fead3c779db49

SHA256
87d4feb8c5d92ea98049f62dd6ab682f62dce1b80f3295ab3bd92ee918bc4fd4

SHA512
2bf5bac04cc098b5b4e3cdf6dfc154bf683030c1ce41e1e0ab1b6440ad9684cdfeb013f6bda8111a18da893300d21f63e8fade4d0ac262dd067f4d1ef6412158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f65ef6683fff7d9fdc13f51fff2cd90

SHA1
4ba71b3142243b45b245b4196cf38017c0aad255

SHA256
b7aa8989d351491e18ab90d5ae13dec56cb791e6ef3c5cb624ce3f456537a4c0

SHA512
7a4f4fed8a4bfc92d00ab832dd8e3180eb7e6154370e018fd2796750c364ea70c2c13bfe9175fac9d359c1fc9763e45f5f8e521e17234e8beb0a3f8793fb0476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6928410ff0d275e11a3f10df6c86930e

SHA1
c9e4266a0668c526086e721d66eeb11fd4e817db

SHA256
d8d24234bfb8d6dc051131f0eceb720b82253b04769220cc7fe2953a50291129

SHA512
b23a7ad25657707a02b03828e0c138b2779f27772ec20b19593f1f40d348164eb2635ec38523d059d55470d3bc66ae1dc5fbc26d2c2254d0359a247b9e888457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
42f2ef03171c6a11328cf74a69eac85f

SHA1
230af0ade01defc9b60f3c2fff70c6b2eb15bb86

SHA256
a946720b77ab5eae9e9337eafd84a244f4d14606e2dbb5172a047d5ffa6c14f7

SHA512
058242816fea673e0e0fd6299db8bbbedf09ec02539654d80f76a7d9377166241210822d34ffcbcce8c64ed94d2e0e28155762ed6036fe1f9328a665911547f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab99A2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar99A5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit