3c80d3febbc2dbd4b78e8457f9183fedb82e837bcbc3608695e1a4c898707a23

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cddb4fed4b4218c707918271e938c357_JaffaCakes118.html
Size

23KB
MD5

cddb4fed4b4218c707918271e938c357
SHA1

c5fa905a6ac02335a955bb41b765de634d454411
SHA256

3c80d3febbc2dbd4b78e8457f9183fedb82e837bcbc3608695e1a4c898707a23
SHA512

61412e337e7c8cda7be51b8b71c4b8ef27a25df39a529bbff86e91e8b06cf4a703412f5887f2894f5d1213292d3896035ad166056f933769e8d4bbf9aefde191
SSDEEP

384:cQQf7UOpZ8XRW+esLAYAJJSxhMqdVoEwYpumFll5BmPKvWbNO8wp:cQQ3pc4+kYAr4hNCE5VeKR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431311349"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000006c35920151191c927c1f648b29b65ecbc59b00bf70b1297eea354488ed5819d2000000000e8000000002000020000000e896ca1c5400907ac7973a932d4c3dfef12f85a0fe58b8756491cabb7f20627820000000a445f72a5c510038381502931352f0253938c9d8159961135353b47154df3e0940000000e5b2a95b54a30dc23417f4c0b5305e7a0fbdd2ff19b8e7518c100364fb9ffd88bc3f23ceffe97e4dc80d6fe8e2137f4552c2a517fe21a66ce4f516e269e870e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000087d8dc5ac2537ebc82a288963def4a6e852d05ce794335a1783a05524e2633ef000000000e80000000020000200000009e63eb44016f6ea47214f488c592615e7ea7e2b014d574276d4c099a8f30b8bc900000006b2e26c15e4102af0a108e647dd029e84490d5fa7845473b67f7a6accd0a8f5f2ad797550d1dd5e1a56e7e83a2bab0bbc88ec2adf342cce23f9778a5583723d1653827ca9dee0abf2e79e15da1251269be8cd4c1f2b7c4f44be53d8c86f7691d2a7409c733d3c8b392f5fa550203de212696441a2fb7f4a93d8c89c339bb101f36aed0812c34cfae0c14602a281a44cf400000007fde448d1a062f3fade56f78d83863f2f41d2c6a22f1fc14914a88e5bfc5e9f59ab68b2c528a25749c18a037f857148c50b7ce9d5eb8ba87da782417e8b5dfba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B25223B1-67F6-11EF-B985-CA26F3F7E98A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305ddb8803fcda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
900	iexplore.exe
900	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2532	900	iexplore.exe	30
PID 900 wrote to memory of 2532	900	iexplore.exe	30
PID 900 wrote to memory of 2532	900	iexplore.exe	30
PID 900 wrote to memory of 2532	900	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cddb4fed4b4218c707918271e938c357_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
55a02ac6fc634ed9421d26dc7d7e05f1

SHA1
44e8fe05aacd7fae626618b201c4d6e68703d25c

SHA256
7caa955ef498a20e39a56fc5e53398c2a65c2a24db5b93d432c54b27127ce04e

SHA512
202f9cdc630eb29003b1acfe74a15f4d65e21407f85bbaea53b5c5e64d72e751997432fe374660eef26a46b89f2151d735dd0d65e2a79ed66336a99f194fbf9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e5660c4c742745f0d83862dd9e35f2a

SHA1
836cb7a056d90b26c3b81d27a7020636c13bba0e

SHA256
39eddaf1b9787c735bc4009526ae01c16fa603ffbe791edab8e1618b433ce99c

SHA512
28dd72381860fb1f0901e3b676147be192df967ad1b2c77624015f404a8b3608d479a3402129aa8aef003069d27fa6ce8cb5ae59ef5f9aa49cde8ddab36d43e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e2fcc7a8f9eb7a39c277738f2ae2bac

SHA1
07ae31aed64ca94e8ac4a6239f33b461665b507c

SHA256
32a335344b4bb1c17f5c639461b93c083c96c081f68ea0aad316392160934822

SHA512
0f74cee21e18de21a1c457061273430ec104fac3202d72ef7b959b444c0f456c3839afa2a48c0af0126d6f52d3f9c29b60b819d7bbe26732a01a6fb08e1d8107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
237c296a1cef0e0be346f9e542bfd875

SHA1
d293c6ac5e7b9acd415ca0be9bc025a24b3cfd15

SHA256
e536f20eb0f226c3ad3d27a269364ab34a4dcb38dedb88158fb9f7cc18e40d92

SHA512
e13780b2ef95e6dc859225c24b8e77a962d216122b5169077c8859d98e029d028ad50154df92ae2972bc60421727d71218b479c2f07dbc964c8e30c7e310bc9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2915e78b9c5fd70f3aa6964eb09b6e29

SHA1
59634bb0671f88ecac08421de50205175ea52e90

SHA256
64f1f21eb75cbe180faa2cb0dadecf9e3650038e7ed3085bafd9b7b7a5f903db

SHA512
b43824fdd0539aa773215f23567dabff3c777e214993d5c73d0468beca7ad6723eeec0886696db01e8e3f10d51e5cf12f418d0677bd5cda4ad0985cc8400fa4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b7b362edff77433dd33c3e716539e3d

SHA1
887105c531d7ad335950aaad7dabf23a5dab8aa7

SHA256
ed3688e97293a72b459be2d825076adcb85ddaf5cfbd55d64316a98769076180

SHA512
6d02543c2827404fd377d5a13f1bc519d66bbf6e8c903b2d4c451c048e0ece7f4582e2d73940a5200dfa6afdc3d9cdb51c08be3c8ef9e94be595791ec31d4d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a427dda1c55c0ad9c33bd54b37bbb792

SHA1
550e6d589d16f9357a303ac1257aeeabb833f910

SHA256
38833ea217b902f93bbfffc62e8f9830e1a63df7a340244fc2d07a77c3d34fa4

SHA512
710ccda7b65cd102b9fe52c62f0317ab57038faea82f2f9c56f88ce6dbd0928eb5459c9b40f6173d6abecd87d12656ded7d16ca6acf56dec9531035b74faf3c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4104d43feb640130bf5a632c11b5dea4

SHA1
31bd7036edb89faab84ca66a665c6f3fcedf7cd6

SHA256
b9eb1dc41d12224525f0d05e96eb297de87ab3d27dd6137a9fcb3c1999a547c6

SHA512
e3ea24773829e2c2fc077baf1791dbba200cfbcc81094f20764522090328c74419b4869775b971024da81ba3abb97f73472e63e092213356124207fd23f0c981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bea31a6b0876e9d2f8eef27cc511fce

SHA1
142a1bcc15bd94dc8d624e153707a100f12087ed

SHA256
0058394af674d2378558091a976e8a76486fa762578bdfa8cf9ba43f660dd314

SHA512
8e64f93d688e53d5d9ed2dfcae54ff7727b75f47773e0828fd820d1a91d00a319a9344b0a62529166ab2329045b0a0c65cdc8ec234a72f77c5e02c16623066a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04b373cf21d988c4e4b6233d1dc9e662

SHA1
7f9265e2ab7c351a3465c39eb454f02e9d6ea66b

SHA256
a34f4e58d39059925a4ee4819050bee363a3fae1a69b6d6cfc874c0e55674c77

SHA512
cefdce8aa8a12baa30b11290810b310da67025635b2745a00a02fa813eed0f0b69bfafa88dbaef10581e4a9bedea104e9a63c84b524c8371df63f6d7314bb52f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
906c6e939c7a0d950d36888bcd68066f

SHA1
cf55b4842e0a960e0bd3013a9378714f09160122

SHA256
902dd80f19beb2abc4f26c57d5b2d001c182eebc46c89b59c7d987e0fe5b9403

SHA512
1ef9db6c01d0d78648643c765ec44825f305018a20ebf7240721348d5d426c40b34079cf644eab1b4b7cd8f52d4d4ff7c81497370ac08cee26b7a1aa3373289b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8f057196d4dd836633bfdc895d44db64

SHA1
fb67ffda28f37fb8df4dda157e196a98a9fc1068

SHA256
8245e868478ace0bab308c4fa193126527b1ea5b6883157918740577329d5e2d

SHA512
e36ad4718d07cfb10766b82f9847e5bceb56fb88e5367dc47e2776ddd09e6357d17087c55c75e6f220bfd89deacb6b16a80cadb01709c2c9b33b3d318839c7ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a47a5d1c478677a51037c9317745ec01

SHA1
b89619379da8eb029303120e41eee9a50c85e08f

SHA256
79b8602132c69298766497d3f05420007ee05f6548d171d1d19477f6e91b76cd

SHA512
1994e01770156ea7d1d7dafd8cdc387c6cd960bd4cb3d90f203de097a3b59218ab1095bba4474ecf228daec386b2c531198da4f2023aa129243e4a357007b11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB43.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB45.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit