7941fb34e12806c7f634b8e87e98dbe80d05a318fe44ee52c56974779f02da89

Analysis

max time kernel
68s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdefb0e121123df09afc59b056c1e5fd_JaffaCakes118.html
Size

460KB
MD5

cdefb0e121123df09afc59b056c1e5fd
SHA1

76c526ca0ccc9df811b9d4f6f68cda622444b629
SHA256

7941fb34e12806c7f634b8e87e98dbe80d05a318fe44ee52c56974779f02da89
SHA512

4b874e08018d0ad36790dd6964c3c3f75e1cfea24fa30bc947b916456610b5f15be5a69dee9df07e4f05c075e82899c37a6c63f88185f5b1619f93c0d0ec2cea
SSDEEP

6144:SLsMYod+X3oI+Y8psMYod+X3oI+YOsMYod+X3oI+YLsMYod+X3oI+YQ:e5d+X3615d+X3y5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69529D31-67FF-11EF-A2D0-E643F72B7232} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bb75420cfcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431315084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000003300db26aa6191bc27c3e7521632ddec431d7965cd3ba57f4fe2f75cfd54e899000000000e8000000002000020000000df015dff7af1017392768e84c3ec2dc0d4eb294ac2599906f1a73c6359551b132000000068c7576c1b42c04d562d6c66b57f6856c24228341f3423682389f64e07a1fb1b4000000051e7f8dfba8839357c2c8280ab2beca3d0c133f31425a379929054de4eba4d7ef5d2a5f49a8ceefbf249175d0c636e49914a7714e93660096a115d58b1c38fec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000009622975ce2d1b339bdb628b9c44b426944653feb791697ddcb75eab3f3df1da1000000000e8000000002000020000000c7412a156762fb04c7162144113cc4766f76eedcb7fd1674eb5ebb188a002090900000003434a48e51bb7c7cea139d70dda69c69c61011b1b553959f06324fd13039065db5f52dd7477ecf4a951342748bea1867e3d53eac730847608aa634f50177d5c93635fae57a95ea7b7c24f5f0d17df754600bb8b4516707765490e5cb45f78788a129d77a78c52e066a6806740f8c68a564e68393eae00c2edcd887a53687f08076e63f6f22e3273de81f8e3a9b99bd5540000000ede2676313f1fb215c59d1ba21e2bb324f94b682681d9d4db131318ea421cae72037f854ff68ee4d9c8b548d84dfdc45e0e5056f13f98097dc15eae8f7f0a3d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1244	iexplore.exe
1244	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2388	1244	iexplore.exe	29
PID 1244 wrote to memory of 2388	1244	iexplore.exe	29
PID 1244 wrote to memory of 2388	1244	iexplore.exe	29
PID 1244 wrote to memory of 2388	1244	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cdefb0e121123df09afc59b056c1e5fd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5af28eb1a27e1d8e5fac3d120b0ed6ad

SHA1
aa4aca3957b84f6c0dac2ffa1fd4d4936fa2f793

SHA256
f2c93485c0acf2d7cf9a19cd448f15006c484c73f7201571c711ce1cc398abba

SHA512
d7f9623f140c5ebe7805df75f70dad937ff9b686bba1462828cf541e5ce179ff260983b3d265851e8a5d6c457042ecb71d9c64b88d0ea60ae30f1818c515379d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce5ac09f8db41536bf0b100ff0bb3d32

SHA1
6da63b19bc2220c2f081c8c1acc0478eec395943

SHA256
b838bdf9d722fb2f294fdae2313967b92efa324cf3f8206037009c94f37cc450

SHA512
2fce718f2b04869d7eb9df4929a508e54f3dd90065631152ef6ab3dc0d9dd31cfe21acab356d75168980ed156c7dbfe5e873503621ae0a5733e4d717c25546be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83bc7feef7a17f24873bfbed7de4f9c9

SHA1
1951317b7c1c2be6c678b8160864e1ec45bb859c

SHA256
757cc0ae79929127b56f47eb21ff4c3a1b364f1381147388238c1481e848411f

SHA512
309f445f0c51ffa681a78e3832154c4d8ea4757a6141678434f58540b047ddf8e892bd83419321d0bb4bade440817c838a410cf1195977071cfff23ce9ea945e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0e15ed860b9cb094f964b59e1bc50cd

SHA1
f73c4aa573662d16a46cf6ba2040edf494db7ea4

SHA256
a8678c68a75513e1bb223b58c78664e579cf03b019392607e2b64501ddafe43f

SHA512
9d5d9030fba0df2c139dd93883d4b2e9e6f741340919f15e88d4dde8ddf806e6e570188642e5038098e2580ec13acc2c20f63a08f449445b8d70c376df565ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
687061f2afe3e1c790522b503de80785

SHA1
b7c2f09f0ea706b40236ba2947ce7bddfdd5ee1b

SHA256
1e24f54e66f8ee492be0f785f5423e53cfa1db88b26a6e9fadb604c876a61df8

SHA512
fd27e8671367ad0e1165e2dbdbefce72bb6c91deb832072fd8c67b21f239a02d1f938742e66dc5b42a2ee3ec947ad0b796cacab5f68ea24d0bd88cc763f44b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69b972294edfbab106715c4a97579feb

SHA1
95bd7b02acb925b16d355ebba0a2d45cf50153b9

SHA256
51ec86ff8e8e2c115a36b12ba7435954befb8af01fc7aa5c9076d940f97ce848

SHA512
d0040d79a40bdd21a108e8954b4eb5680614bdb08bb1f6e964837943fafd06ab0b357609117d8fdadd53fd48c6ad4e7b9ddcc4aaf2ab442f6ea0d73ee47de0f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0aa91ccc8472ada9089c061b14df65c

SHA1
e26cb6bcd73a554c719ba2279bfdc5ab7c484c17

SHA256
506e0d0ee4148d4824a42820c9184b39bccd5fdfd2a149cdd12af71908262124

SHA512
294a4a283fa257fdf8fc30dbae2d54b296562e25a6b41d2c31eab1ff5afb12589959f08910769d85291686dead9171db1db9e528b23166952c748961bff89e99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e345ddc8574b1bdbc5c6c9a253f9cbaa

SHA1
3d6540a0b5b41b2c9de6713dc837e1297b64fac9

SHA256
42d09c9893f81925418c5d635c081602a90c908c92ca79a49a7f81c1343575e9

SHA512
9fa35b7c409a6c50faa0fad68d776b0603fdac058c3c3581bc183685b8eda61f9cdd7047b3de89f87f93dd9f958d4d4a656a23ebfaeef81fa384a0ed2f33ed3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4e938406f04af3385229a2e1a9c39a8

SHA1
e9458fa21d0d42052aa002e485cf9c9e10e672a1

SHA256
7553d9f30b2a45312cde20e4c697d911e6540e558332b14a57e1772127e5032c

SHA512
067968ad5b6cc2db1712ff291d10f827f3a37257ab6566af5f0d3b8ccb41e72f2b880fd6fe125f662925f93f1324b658826d00ddac413f642ebe656fca70377c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7b6e77bcfe47207e62268320a595a5e

SHA1
5db023bdf0985c02ba71b236166443def16bbfd3

SHA256
8a0933c1cc54e71136c1a85f91662b5dcd39172e3064f3fe03405f916a6f25e2

SHA512
2ae869bf9a95d4c2befcacb41ed2f668dbd91b380ac3feac82107900fe6edad3221be86c71834b7f67f94177e3f53c718b1c40a1cc40542adb97b6203204d3f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65f4d1f18cad2fcb19514e673586f3b3

SHA1
a29913260ed915036dd80b483277510b0ac59694

SHA256
ff857e562fb8cef7e415b4848eb64d8a74ed26fd48da8bca20a08b7b95037592

SHA512
c791e5093b85edf6adbb118f8bd1d7a54000d477026c40556c2b5e4e6e3ed9b38682111942e6797a4f7fd22a331521620f69aa873de83f76f264d8106d925b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed4935c1a904f62e5b1c256e95291359

SHA1
8c3faabde99ffc1637daabf12b3e2a0eade9bdc8

SHA256
2b58294b43abfe16d35d316395bc78ead34b85d608f38ec33ce3de6bfc73e2fa

SHA512
e552bacef21969a29e4aed34845b71c537dfb34b14564495fc6b95280a29f6150f2b2663af5244cc36716cd2585e4445f10d5b6d5696aecaeb4fcf313e9bae8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
403c0fbace27413e292bbf99e26c2989

SHA1
c652b3e4970ee838eb53da6c9f98ccd3791b5c60

SHA256
aedff0c61e507c1ac062ced57606bd6dbc70be869154999f8d87da52b1bc12bd

SHA512
6719172014983b3cbc54ae78111662c220eb5a80fe9f96d07d5f338a078753ccad2f632ba60d50b78e04a29f453998a31fba61394beef5f74fe975969bacb40a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13ff9d5af93c2e6e3c822e2d9e2f2fdd

SHA1
35dfe410ea0b9094de7f452f4ce16fde826a6571

SHA256
52b557c355b1e25547543803f0dfab0e4ff14952215c8a8d737db8a39788c579

SHA512
cf4cc82553660d41bfc338d0c3149308b5f0dfc99078c899b7f8fb4cb1514d4bc4636b03f7bf3644b66029389209585b836785e590b31d0d8dc263d6828b7b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e15b903770474dfb82b7f40deff9941

SHA1
ebf4659a517a382b599b67d4c0c119d587ff12fe

SHA256
3a845238ad1491c77d66371f6a22bb5364fd490a2fd1b87ad9f58123aff68887

SHA512
9d8ce399364809c9daf86c08e068820be871048533d6588996ba6822a07aae2e0dd934c74055b35e130d949a074bc2ad8363de36dd9732052ae7ae9fc6cdb63e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28E7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2958.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit