28c893165664198c3db046c8a1ad9a6fb8fab14ce8baa2613561785d047ca2c2

Analysis

max time kernel
120s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9e804b017af960ab691b45cc6fcf661_JaffaCakes118.html
Size

11KB
MD5

a9e804b017af960ab691b45cc6fcf661
SHA1

57b23d692ff7b3bdee73a59709b5ba1eb0e31913
SHA256

28c893165664198c3db046c8a1ad9a6fb8fab14ce8baa2613561785d047ca2c2
SHA512

bb419b3a93f7050b8d4d55a96f84f6dc8296d1415871e44f4af63faa7a8c365b484906cc4db7c924ad6f9bd6454c010075c161c9abdb9f3f6f82e8122c79bb32
SSDEEP

96:uzVs+ux7RLLLY1k9o84d12ef7CSTU3wj3OlpKIoB9bRcEZ7ru7f:csz7RLAYS/uBQzb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430210001"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000c21bd86aca89516ff76d29ae298f5331e69be50797bcae8b0f27ad909bf75577000000000e8000000002000020000000fde6f2b2a4d91bf393c37d63d03e15c55ec4c2d9870837cc47e7c1ca87417745200000004edc44d9f7cbdc54a9ad3b6091ab1d8b7894a59df2c3bb026c6123c98ffe847b400000008a12921ca1afca7bc455287509ae2c8a156a24e66172f44b8d4e77b62abb780581cb9b3cc988a9a5445176cbc69668da4a8a579b7841fa50e50037f622f94945	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90782e41fff1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000062a1e2b91b9cbf166356d49159a4c6e62f6213314ed2ec7107d88b025c8a959d000000000e8000000002000020000000310eeaa9f9331b0b52872c518d455303d004c5490f9f298d9f1303658ab91a7c9000000055a52aa9796cd7d5a363be98e745e6e2b24249db719141446eab80e00e8681d496b08cabdd071e5e998c25b347c490830c614bc709a359a5b01921dca68d0a5cabf6723ec0450b7d9d6f312e0d6cb521c692dbfec7d6f41a41efd62cbdfb503f9f36eeeeb5a21e4f4133aef47c26edafb9e139699bf54c1450a029c903d933e44f97e82f57339dd30675140b2217b21f400000001a67de108f49df1155fc677cfb6198f9a7495eb050fc859bba81169064c0f48dc417e8ef36cf4c53f695e59fd7b0261f07f903c9327e1149dfd71766e318a537	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6368AD41-5DF2-11EF-90D6-5AE8573B0ABD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
308	iexplore.exe
308	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2336	308	iexplore.exe	31
PID 308 wrote to memory of 2336	308	iexplore.exe	31
PID 308 wrote to memory of 2336	308	iexplore.exe	31
PID 308 wrote to memory of 2336	308	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9e804b017af960ab691b45cc6fcf661_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:308 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
96926ee1fdeaff30e7e07dbc00ddd307

SHA1
2e20d98113ea768e7580a54646e1c772b89fc8c9

SHA256
a6cf5dbbba5383206c58e5d1c05633c7958ae7b7f64683f506c7a9500a18a3a7

SHA512
d99c998d4bda6c7b76dd3b7c1d469064d5a357055088e8f3a5152bae8961c281d94d56fc6350bfd25fa31902a8d3dee73e3526441321910a806d43c5cd1f2714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
43e58cb23876aa536d24e5fcdb77caa8

SHA1
90c8697ffd40adc891bb5996abb883c549eca725

SHA256
c38cb9de1d15d85630ccc80a9ef9a2f8d5d5090369adcc7d2674b6db0bd975f8

SHA512
6277ddb5789e7bb710f23db6677d756b7913b0501f428a2e2a3a20a309c5ff77741e71c17db3504e6ab491c9995525c7db78ecee87a81b1ac30e2eaa5f58020b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ffc985b57534406e8a0094c1e4fc1be8

SHA1
c45f8f407cf456c7f39786e53a8ad6b2d46c719d

SHA256
3dee206f01f4e7aa3eca79b2e89ea86e28bff5090a6155406451c3513cb2d1d8

SHA512
9edd2358172a591715f9e8d0daaa46c968c0b0acd0464750168a139c80cbc77c8048b0e229ba5113d01b74e792c279fa55f0c5e4fd09be7532c6d4d57a70cb65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bed4f809761e2964bf5a95820dfea983

SHA1
218112906872a2f84d609b8f7ba5b76854531e55

SHA256
022c9b6abd27028c057af6d19d2fc2fcea474f343f930fb4b1bb20438e94ec5a

SHA512
4eaa0b8c7abecc9c498232e8e4551ac60a245353db826d9c369c670ba67f7ac70f83c8a1b1d0646dd913715283fbb6977a7d862c05682a650a7954ff482d6d29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
18ef4c16c7994e9a03ed94c547a27c35

SHA1
457663d5f6abd2aa04a5c27f336f65e9d86f7614

SHA256
4cf445d04663089f40d0b258626ff3104d3f16d1689668095b25cc3bb71171e2

SHA512
46a157425d35200d0ca6b8fd3bfe84e5437f665c2b481e93ce754cad8a4248e8191ea773a6b2358317d54820af667e6ecaaa5a917daf63065f24b4f059df6afa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5b41f3627abfc40714feba36b81f025b

SHA1
342bb7b524b45e2d50a5cd872e431c7de848186a

SHA256
1435a6503d000aa9380fe0caacb377c39306dce564add8f8f35a2d0532b44eab

SHA512
5026b8c313a1fda58e2949eda46979ef0bba701873114cb32c958d3b6a526aa25128ed22de04b45e424c119881d5fcf1cfabccae76e70e5599364465465054f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c4a3dc6769466fae55cc8652f25abed9

SHA1
99bc2fcba93a797b811ec8c5ffa13f6cb7b85731

SHA256
4f777ae8a227ec075bfc67f7d59243cb6f5e6d4877f93e2d69a2d15fb704e7a1

SHA512
41651e85d94cf70cc08a527afed99a081354a6ff6a707d44ae9f35b2a87f03dfdcf1b7bcc69c2509900d4d069a1cfa7c4f6c2cae0926afb5f7822de1d2a52018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
029227023ab25b4167e43b1c81b79d08

SHA1
ae5a86acaf6a46980e7338fdfa41f3bef6c9aebb

SHA256
99fc91d1f96e32fadb5225d58dd47e930a995766df5bd3bb2c0c6de6c4f448d9

SHA512
70bb20ba5c1d6cbe09602f4ae6b6d8e268c1a0d482c93a983fe9951050c032eee6ebc727e2e7c9767f2a1342907737271d089e74cc2e8d2146b0d6451f30952d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eb9897bee743fcef6b812ddbcaf0b73f

SHA1
eca22e57965324ff2c8281db2a1f19e3fc0896ee

SHA256
5adb1dc5919724958e187238f2cf2a85d55d583d666e17986f4d9a0d03877a50

SHA512
a48c7d2250452ce6dba85c240dd5a8e360e7f085cc363a526bb960713cac72368b7f8ac67184526bcf846f4f2c184edcd6a6b212a31bb9e4e9f578700b1b1902

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b95a3b2ae847b1bc8ae9eff99df88c98

SHA1
6743a196044f0f45a82450d80968a66b373781c6

SHA256
5457033bf7ca4aad3caeab2fb33d0d03a4b1ae18cb628bd343eff4ddd4c261ed

SHA512
5869a31169ae24c1e975289870cf11e1e43ac9f02b32307e765ec1a14fb4ac9bcd0c00b1b9e361eced2f97c24882b29e6cc190887ca6b0fdf65c5b890b66dcc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f77f2f859979df675568d20a55a4296d

SHA1
d8f1371b0007472d452f9f4ac8c8bf6f6459ef46

SHA256
6c3a74d91ba9790dd5b2e72dbae335c85fd8b2eb52688cde29b84ce167d51fe6

SHA512
e8f952c28a265785651f74d5c134ef066cb4b88aeb30ef905a0a41b745ca8df989de6218d36f1a29d53c1d6894e2af6756e1fde6b33066a27dad4e4d5eb4eae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bc143df2c925333a913446795c6b8c9a

SHA1
e07a6b6e42d34c8000805ced5f2e60a55420f5ae

SHA256
ca1512226bd7026b610d68b521c5f446b653e4456a2ea120d5fd98778568b1e3

SHA512
08392703c2241be829d145e22614f47cf7575a548c3b33be0f5d0cc5a72ab0f64b42fec763fac1c749d2a3d7c6e104dbdaaf7423f5b8ca9eeed39378e145dba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
66547cb4a1032175b47b9d104cf90a14

SHA1
75ea91084a99630c515bc13620881b8e9e0d93ec

SHA256
81221e8372de44c1f5f3271896ffcf4ff07ae991b9708794a53b9179cd3c4b90

SHA512
3837bbf83d9f682ba387ba4dae78255b9493a8ff3b194645e02c0fa37104c78bdddc4697f75ac022a9558d7da7b5b91fc50f0fc5717b924a83902ee92510cabf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2d9774ab71e4371f18ee7c5cdedb5210

SHA1
1fb0a40b80c4288c7acfc219d3faaff04e5405a1

SHA256
fcfbfc8bf4a0ecebdac7da03e8ed8fafebc06e4a9ee00602d422829171065aa4

SHA512
b45887ee42ab3aca62e4695dd001cb07b6a719ec7a96675b48b2fc4ef93b3f8080c570582bc2da782363d34bc7395f00742db04eaee2f110628581bac1c9d914

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab363F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A9D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit