b99da3fb848f4317ceeefad75483fd6c5dc7e7bad91a0968ff40fd08a965967c

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b562daed4d7b5aa2021b23fa7b266ff1_JaffaCakes118.html
Size

6KB
MD5

b562daed4d7b5aa2021b23fa7b266ff1
SHA1

c9db02d08e3f2e948137ee607e5c244dbcc25301
SHA256

b99da3fb848f4317ceeefad75483fd6c5dc7e7bad91a0968ff40fd08a965967c
SHA512

830c95f330e08a924e9bf2ca1b588dc4d120e3e30f3981f978a2e232aa38deccc9b027cea4231668f8c9c120e8e96c44e1185f21bff0c7ea7a0e4310872bd04b
SSDEEP

96:uzVs+ux7/0LLY1k9o84d12ef7CSTU/ZcEZ7ru7f:csz7/0AYS/ab76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000001b37f439ba9ef948c3b612dad7a5b648e00338c467d8da47019adce89d77c853000000000e80000000020000200000003fef732f8e26b0dac9388d7ccdef98a8f870a79e3f491ffdda3406624df10a67900000006a3d28aaff47907c944a6797e999c831c5a6dc9c8497b19bd94b4441017d70c3f2af59e511d300bc7ac25c297b2120a762213ea04d168405f4a5311fd7e7572c4a2dd88fe51ac801b311014e11d039179c004cdcb27bc3f78722716101fd88ad35fcb1ee60d1aad12aaa662a44ebd8568330590394c1d7393e03a19149468ca7c5309d08ccf5f7e351fe9cfb469dc2b84000000022e31c533054924e293e7d0562d77ec2b5c41ba62da15d5dd74beb8c9a64eeb49fd2a257fcd8a32534898daf1d87d9ce444990a8440c3fd3c30650ab5bc0d9c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430442963"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10efc6af1df4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000049e23d91ff908737274e14c69564620af2004aeca348a5b2be5ace2c26ea82d1000000000e80000000020000200000003a86e2de58d7e4dcc70fb8b8d1908a34134ab98006587dfa35fdfa636e27d98f20000000d9353277a3fe5a989e4d2a033436682398dc4b820a048484b937bf38279ff93c4000000080aa264a25bd255069dcefe3f38e0c0ec9afb29a06e293c8d2e895b8b5c9793e987d2a19f8abe5a7dde21fa07c9f141c661f60602e5d5336775e7907e9dee22c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9469701-6010-11EF-BA5F-F62146527E3B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2576	iexplore.exe
2576	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2316	2576	iexplore.exe	30
PID 2576 wrote to memory of 2316	2576	iexplore.exe	30
PID 2576 wrote to memory of 2316	2576	iexplore.exe	30
PID 2576 wrote to memory of 2316	2576	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b562daed4d7b5aa2021b23fa7b266ff1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2576 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e94f06f3a7ed51231a831b60582645c

SHA1
f3c5c1d3e16cd8e6721c0a7791008b5501270a4e

SHA256
c3c220b318e8b3e27556c3c396ed825d90344f36dbae977ad19ff8401800ca44

SHA512
2124ade983ad417dcde88f0925dfeabe89c9186f3c5d6eb3b9d6dc26c7041a654f6d4268da0e80d47240335adcc4da9e9116c2acc16a2bf6d7f3316451f6bf0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6474fe3f46c93c5f6024cbcc1b1d7831

SHA1
adbfe584f22f9708b6534e55321b705803846e21

SHA256
2936e0165467bccf36f32552f3a09384f2788acfff59f371f45c4572663995b1

SHA512
958b73e9653202732ef0865f06cc601a437eeacaecf1d5b51191ef6a7dd4f2c87ab6cb2aa9e403a3500aaa59bba108895f5bfafbea99c182e838e2bc8b94235b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cd5fbffb59169cf50c66ac94e067ece

SHA1
96436fec4167fa8d4d4da8fa0b73eb3f06a192d5

SHA256
f27eb5a56bcd6764267bc3a91b292f7e0926b5e72701c2fb60a66fdd74acadb3

SHA512
6c5859d02cb659c80066be713a21c212279b401f3690755e69be2f7bb5169db259ff4502b52f74422ede5efe1d58e757b94b4e1a8891ae43b67a312dc2c67418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb78f06fa62d3757194240d7f3608af9

SHA1
3ff2fc8fe77236da7a6b80d2469d1937b7ed5d2a

SHA256
e1ef42235ba333872e0ee1c8a28c16ffa35f9738cacd0cd8312d3129e5992477

SHA512
4d75fe5af6b8eac570570d6ba85ceb1b4e4277666c81f3cee8cdbae3cf8d1a7375d775f9cb6a10d0da0640f93bfb7b78cb516bae704a13f82f60955ed63faf77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a8ab4c5986fc0e9fe9802a20e024b6a

SHA1
4e586362b55b2e0e583d8d4b00afb33f47533ebb

SHA256
2931587cccbb0617cddd8b8dbe8efc6eee9a44d68756ca7258e78410608e2cbb

SHA512
597d11daa1aa0b8aa3ac27c5b90e4426e062096606559a82a8689a6e8e7fb4929455b17276c0c2e2e5656e32a8c7b1a4faca593274f849ddca668682db780254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d30f84ac86873618233479c43cd6a51

SHA1
1e4906b22d14a3c7e3ba7a23e1cf7411f4e7e6cf

SHA256
b71ea9892fd29b0aa360f5b6d8622840543044acb67b1a83f520f38cc9ffb70f

SHA512
04d47c02229195ed9edd1b264673b725376a7c5862c9939c0326c3c1d9c1940f1ea1bc708af498f6e147abac2ce27b8e1eba7e98b087c271a51f0d3d72b0c12f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dfcb7979df593226a40de4c86ceb9a1

SHA1
aea0b76494640c312b8f0dd4b41f54fec826988b

SHA256
463040e95eb37c5be5d9b284702e175e21dd57bf00c609c87008189bd38aa2ee

SHA512
7f430a3bc49c5434bbfb7f555473382fa3b841142a719493e11a55b22be62f255f1ab98fa8a904f452d9a8236f32d9a76c8f628b111c0a03fbfe8efd29b9c42f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6caa8e0edd238de163078ebfd067e47

SHA1
14d3d2e3b70d12319ca599774f15a72a2823f768

SHA256
ff26b703d5c7b610c68cdfade05b53f72fa125b058f2fb411de8a992a20f040f

SHA512
9b73b561c5963038f452cf2edf3dd1ef62bb40d7f9832e4c79956a4d8a8c05b73a7580e907fe11c6ecebf0d2dcb4671bdeee4a412068f9e227ce621ae442fbbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c91b185dcc15ef1d2b14e3f0214f6f7a

SHA1
018949f3effd96c2024d4239fb66876a031a707d

SHA256
828bad09a6eb7ce16a75c28d79616407ce00ff50fa62887cea3218b89b6aa48c

SHA512
bc9976d4fabe07ac5a48ac3be1ddbe071ad4453757e96ac1201400708031a2489d8b88903e890d0ad9e327be35fd347d2743f8a1875b15cacc7d1f199b992bcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
425b835b45cbb5145ec930c180bbdefa

SHA1
5821a280898b03ffd651029fceef225ada97d395

SHA256
18fe632073cc438de0c6354222452911eb756c342a1a46dc5d533ce26304e0d9

SHA512
95139c145a38376670a9d98dd965a08bdea513d1790395651f910996b56939293362d1e9151dbe7eed3fb6eb6abc4a98634a661a16c70bb4938a989c46435b14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
520e34520fa7e6c6e15d4500ff1d48a9

SHA1
a0556f88ddd088bd3cafb580447f52b2877d0749

SHA256
346b7a7f01c2df06b5678c448e6a449cba19db77d93fea85c15a8afb3eeaca6c

SHA512
605de645f903648bb2c08161318b24c4b0f7a1bf88d9304c48fbe993ef33eda9d539b2e0a4d92a955aa297276d1c7f86c8ab83f414dbfccd11947d20858fbf34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbf8cdbe38ebc8a7ec0ab1448806965f

SHA1
b752c67625580f0a684b740e4501770fa7ac1d22

SHA256
48c413285049fed1c1015bd77e1149d28ca4f32f169b35704b4e03613f7b4952

SHA512
8c9e657fa7dbb4489652dfb3bd4ffdb05ddd37878bdedb34619ab7e58dc3cc9c5a745dd6e64662aad6f2dd6cec4e1d0ca573863fea39c7f75c356798e309f9f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f90a04521c4f05e7d887b6d6103d6df

SHA1
b270caf8dd0aae5863f4066f146b48b6319c5dcb

SHA256
495127075721e9d1c9fde402a02951cafc6b4357534127aeba4578517b10a702

SHA512
a9de6e8ab17ae76f47c9c8035e97d491a414393642493a8356be990d1dba4aaf5e34518bf40f03ae7111c27bf4c3e51c5eeb52fbe192a1f1c11298d1957ad892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55af529e7f40fe573ca71d633f21b962

SHA1
ad08d8a33618a1ce1572b9fa808b3106ca81c7a3

SHA256
e0b8dafdc105b697c9fe9a5b2565655db4469b2dec80412f9a31998bcf72d1a7

SHA512
9ea7c1b15a170b5eb8cd087f734a516c9115b39c36776462c530d910af6db77e45d0ec31083cd10b705f7b36061888789d52402cd3631756705e8aaad3e21af3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18f4f9c5ffbff78647dfdf3e8b27670b

SHA1
64874af3f2d6fc70c255082ffb3f2c7cab8ebfb1

SHA256
19bda6e94cfd6b3ec75d3e5b93121d1c4c202cd842ddc6c54ec7a2595e850e74

SHA512
e9a42253340f790205ffc81ee703ad3c15b4dcf7e59334119515734b5c0f229c7cf9cf7fee143a559daab55400b4d5276b93d0d7bb6409b5b05935ce503d107f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCBAB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCC5A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit