450e7fb041900df422109a886dfdbcc13dae6711a82912987b953cd8bfdf85c8

Analysis

max time kernel
140s
max time network
140s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c266bc6445ccf60fce3c709a333dfe57_JaffaCakes118.html
Size

139KB
MD5

c266bc6445ccf60fce3c709a333dfe57
SHA1

fc5254b5e19e53f14746baa005181ead4009ca08
SHA256

450e7fb041900df422109a886dfdbcc13dae6711a82912987b953cd8bfdf85c8
SHA512

03c10583749791093937bba968fcce49621aaeb350206d2b492db33dae98a420135868266a61b257e00efce4403612ef41ba1f5cd416580d4e2b2a1206115242
SSDEEP

1536:SvTSbIoOmlAqZGyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:Sv+ilqGyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D681851-636F-11EF-9DFD-D67B43388B6B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000000b86ab82a4595af7a74f536b40fb04005f794f53390eaa2a98ab97aaa4ba3b02000000000e80000000020000200000005123bf351d71ca7fa1cb0fb041fd73fc8b2ec54e0dc7342d833ad37e4525fe4f2000000061ec8d37bb72e2ceb9484721b71a24e1a3075953059c95d66cd29bb1bedfda644000000083e3edd74d5e88c8b048315812b8afdbb239b08c6165bd193bb18b05ecaa6f8001068cdd5bc8b34703b50f3d8567d2f520f818442a30916f864f7f449b924706	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000aa6f90b4df34a395eb298b6f94c49598424993608de894e1451bcc963cc4ce4f000000000e8000000002000020000000d66aff8c62fe49a23df95554a94c6f5731791dc7fda2d6212dea0937009ff73890000000ccd73417a175826f91d3aca1aad629e094786b7b38f0e3a4b9b491a5e92ca390d358eae342340b38f8cde68cb508875a6db709dd16f15a9dee795e4605d0fd625e7c5c1feacda3d732613a85069cf9ef2a8735948b2412c8c2f452d5dad25d40596c5e6e92318b945b40d1d0c9705811f80dce74577012b4cdc8012db3e62c79b686d97dbccbaa2277107af281df8278400000009a80328140dce5912c9664ea6bcda27c4fe5a7c7ad8236f6c8a279b09621e666140512e88a9e6e85709d8ab23c19fb8fc5725009e7c9b376435ded32dfa01386	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430813387"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03966267cf7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2072	2320	iexplore.exe	29
PID 2320 wrote to memory of 2072	2320	iexplore.exe	29
PID 2320 wrote to memory of 2072	2320	iexplore.exe	29
PID 2320 wrote to memory of 2072	2320	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c266bc6445ccf60fce3c709a333dfe57_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
617b4617c0526c0c6f3044f5b3a507d8

SHA1
186857eca3805f7e3a30ceb76e1d5f784a28e272

SHA256
842d4f76079abc8c21763a834b8312b84a82481782189b484c8de37c4a070522

SHA512
b2a39e27006303e6664edbedee32c6ac9eb741be1a5b4d56708bd9ebce14ed34207ec22fc49b082beab0b784565d19f0a7221275f3ada648554106d92211e4b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
183f98cb5a1661a84f832ce73f1f4a28

SHA1
df17d5a877f77bd596df52e41d1cec61a29e17a4

SHA256
7f0990d362cfdba375d50e3a1fce0c04a0a38f7fbdde6715ca5ca1d2a7b88107

SHA512
30e36c3416e522ded54eec1bb292e2162fbec83097f2e138c515f175406cddbfa7a30ae7d9088e0887c0e723b5ab41912ab7b08ec95c354f93b3ec43e9dd83de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
626a7b885593bca01f18d913a186d23b

SHA1
60ced50180574e6a26d470b200f1bdc56db76269

SHA256
e7afbb2a1eeabf14ea35b323976c0a04d39eea8071b3ca8897f557cce802c4e2

SHA512
30bbac0b3a8e01e93a3388b00995f5b1b847e62a170ee044b090f7d1bc388e701baf383a7b0124cddf59153075686ba8686630aaa6dc8e57790e06dea2b32d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11d49cd6cbe0d25834e9317e57f8a091

SHA1
cfeb57e9134de478665449432802975a42508324

SHA256
a6906b4da8c96d16d72d344ca480d502b0214aa70c785292bba9f16dde005d4f

SHA512
15a8672433c945131861444a8090b37c2d132a8a161016f58df535ce9f2ecd1913f01ce543f297f69e4267b70ce8b84b3d0a2664df697e9235dac5dda8ed5277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6bf2e0e466690cc9fcf6d135dc5485e

SHA1
082d04ba2e3d6b8b9d1db40b886e40859d93816f

SHA256
40bb80c27ed62e46aa89bfb6049c17f47d137bc057eef6c8981fa06ced7c39a8

SHA512
e1f8a4b53a8b053d3f08fc8cd8edc48b583de75e52f6ed317767a26c9b822e725f70d6233e867d065775698f7878f21410a70d58d20d88472661685a0e132162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81c7454c68617cb4d2f8ba4aedfcb99a

SHA1
5fb8b33a3a3e8b33beb94760614098f94a232ab6

SHA256
a344f39dcba9048353ff52a1faad98327c8d401ac66a042469bc1098fb769de5

SHA512
185c589aa7efaf8db54320943706655622c2ca2d9633e11d0c646dc1604eb20e2aee304dcd2ec57d53f4acd8a153aba41f78f3c68b766b011f45ac8d428a46b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
677e25cdc36f33bb6cd9bac774903ce0

SHA1
5ad5cdbc7e5c7b90366c9008a64393adbf49d5d1

SHA256
9cb7a637a10fa51d92c5a257164ae1e8bf8f722e32d69be20e435400b693696b

SHA512
21b962388ea7fc44d9e49af2efc8732f71a768ab3a43b781b4dac2ec4e758e9eaf559a2eaefdc19fab94d37299b2128ad5f5cb15ace08f4b6547010a3dce00d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
690cb2a6cbbda8c1bd6595cf06347fc2

SHA1
b61fe1544e343cc0394f2ed707c08b2caedf8e64

SHA256
43ddacfb32a8cf0d52487205d2372a78bd737c0799bac0ac2d069a4bfa818274

SHA512
77747c67d2c4559ee4f291a58e02014a809083132a61ed9673fa003fa4a1f0f369ea18153fa90386f17437774840f96f994fb1eedfbebee24b6d922a7720c3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f47678664beade4f2b30953fa1b8e042

SHA1
4d5e29c344648322c60a773819bc2714972b48dd

SHA256
1080c2610000ca539ed1357bb616f4e7c9d6ca598acd47fc47ba6cbab88f20cc

SHA512
c3b118ca54c03444c56c5192ccb332a9ab70f842c11e3ddbb643a0acff02fe75a37d6510f5b110f4ed790f52bd75f42424c15982c3a1b3c0a9cf5a382515343b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97cda63f7a85718a86ccf698ca9cc2ad

SHA1
f382b74f638f33d95324e73974a575a0062721d1

SHA256
1e28a3c0f7afecf36748b2abe0133285e8eb506a65968d10cbab60a541f25b4c

SHA512
5cf4bad00213397b501de9e1f9a8daed3909dc25249d782a0a60790b35d193b1a3d16c989653c9d66e20755ebb6405461145d5be0a2a9306bdc26346b21840e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c758c6664f3be2b1bf6181b3745b5d5

SHA1
215179979feef4311f3df0ebe0cc49f4c3444550

SHA256
0108ad441328f53462646d914a47bec4f1e8028dc0e870c9dbf742f1037d5fc8

SHA512
4b041b94045b761ef24b3ca07408be288fb30b88e096d23531a61b1701fc664b7e49db6f5acd8df903aceaa6c59852a7a4fbc46c2144c9884488d97f44c75050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92342c698273834cd2ed5b55c6f18d60

SHA1
156e3166042289cfb280001e7033bba7332aba7e

SHA256
22c244e18c96af037f2f8b8183a21a83fde76842bff3a903b5fd49f3a06a5884

SHA512
d87f0ed197d422249dfbcf694eae072315ecc5d89c5b879c91370f7f8603cd4136ebec5e5dc77bdbca2731e5ea2922d3396f157dabc39c4d339e0012cacd0af1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05f6cecd2cec4c606337d9176626a4ae

SHA1
da9841cf2556e6678962e447d296ac9eea748795

SHA256
a172b57d8e4c9795c685a78de1531b4cdec557ea726d131ce8a91a5a24ccbe76

SHA512
9ef89483a8f7bd5ee1a6adc14cb1a7d7406a38d49c6eab62c7273f3e07935d96b868b94879e34e04b9c32aa4577fb28a635309de9413ab5fec22a92733abb21a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36EB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar375C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit