e92a0664047b76c7533b6a0bdf39d98e5a770e2c363c2a3363c00b08c7a49741

Analysis

max time kernel
127s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cdf4eb2337898161daa53606409dc1aa_JaffaCakes118.html
Size

138KB
MD5

cdf4eb2337898161daa53606409dc1aa
SHA1

8096ec11bd4cb3892b31272d76edaf37af13f545
SHA256

e92a0664047b76c7533b6a0bdf39d98e5a770e2c363c2a3363c00b08c7a49741
SHA512

6058c917e8431268a8ea3cb969f70e5c5d803ca26b1252b10c1505a76e01e42f18986b649f674f1ea17d15fbae695de84d066f6d65e6fed2c98a37078da3a65d
SSDEEP

1536:Sqd5MzjSPm2wlHOWSyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:SqDmXTSyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431316136"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC6446F1-6801-11EF-9CB4-D238DC34531D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2324	iexplore.exe
2324	iexplore.exe
1364	IEXPLORE.EXE
1364	IEXPLORE.EXE
1364	IEXPLORE.EXE
1364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1364	2324	iexplore.exe	31
PID 2324 wrote to memory of 1364	2324	iexplore.exe	31
PID 2324 wrote to memory of 1364	2324	iexplore.exe	31
PID 2324 wrote to memory of 1364	2324	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cdf4eb2337898161daa53606409dc1aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eecbf91427a38815fd7ce1296a5b221b

SHA1
223b28c4994745fcd611e56c2adf70c21a7bed60

SHA256
b2b506ffbf7df115a8632c7de4d096a51c1ef2fd0f7ed5189710c49159b26113

SHA512
75109bc713c7621baa85b1e0558a59c26d1727147e222d33f03c64723d1de12fb5cb20336ccd71840ab8601cbfad02f90dcd980c147a99e6cde892d0e85b75ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46f1aac14480f12393ba8eff34ce47d6

SHA1
f91d69160bc330246255cc907e59f6c09fb101c6

SHA256
2c44195f171f22dcbce929bc0ec0f1d0aeb958da63fa2be51f9007cfd6459e1a

SHA512
72a5897ec3fbb512a9701547ddb6f66c7900df3f4106bfbe0aaf4e56ba8c066437032a95635f810bfa9af9a683b79a3b0b4f2becca896c9c0d296323a7f4c4e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b286129643acce3ff836cd5baf29eedf

SHA1
e3da5fc0317d9b1d39924dd63aaf4741634f8b7e

SHA256
20681482894ab004f14a6a61d46be9ce3f499615dc74335a0e7eefa92a8d864f

SHA512
2902b9b4f687f69931c4ce919e156cf69f0960da3aadec55212c227acce52a743e2035869c4ca1b5fac6d4fee641727a1c0bb4c46ab0b75fafef3085ea05427b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8006e1d7cee908a8d1878d91f8ad9c1f

SHA1
8ed8a241a8c3162a6f76f12bd4fe650432ce1e41

SHA256
2fc83e436265e35493db4bcd685fd06bc35c3bf2e52df058e76e0998f34c1edf

SHA512
9e6437137273d13ed7062c85062266b61d35c9d0f36276e9c7e5980db88b9db7cfbf68f977b4e134bd969086bb82cb6ed29e530be9d4cf2ee72aed910a52beff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01d1f42864f505f91d53ed6c80cc1c1e

SHA1
e65751adc17e95f1361c46faa2cd38fc818c6e0a

SHA256
3abd277112d54921666e7cd89f19bcf9c1f3179799b89522020e1fe92c8f71e5

SHA512
05ad8d4af2519effe5273e84e9b5e55776fbaf3eed9f19159fc861e5fc3d017503d4ed3304e90d0ef934f9564972e91190ca277f857d88d08673af1de7c83edf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95225613f322789954224e2a98a70aa9

SHA1
1c60faa8090958c851ea2bf94dc7b0755117de9d

SHA256
2fc43cdad323664a46de0e386948732f375c26ac71be9c0aa0d431a7137f4142

SHA512
db7ad9d0ba23a28fecc4ab80376a307dd8ffcc834fa60ba19d2a5bd61f20aac821f9df874f8db4459a8396d7fd482f9de12e0cde44a27247e919a3e4a2f82f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
599d0006fbf807e2b482aceb9170448b

SHA1
d9cf65ff9bcdfb006ede828551f5a4a32442caed

SHA256
0926ec9eed1560a8bccf03a12da6c49aa914245c8cc5e2c3f3570ca7fc4f7ac9

SHA512
535a346a145acf99281c432207236de9237f4d66ab3c5d983eab521b699b05d6d9f3e9552d9c62c05f529c5e3ff02bb752a23f4e51202512ab713807bef15390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a6876ec03cc0a561692eed5adf35182

SHA1
2041b32bad9f44755100abcf953422b7d5f22c02

SHA256
b6dc13d941151d767870766d92b45cfa05b5a5fb5a0b6cc6421008f27c101d02

SHA512
5ff84b8adde22c5d2931d9ed6572b6ca65309010d243f98e1bac2ea228ae70b3d0a5a376b50e0c0b04559f07940d257897aa3a3b8edb6f13053cd04566a7ca15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d809bf86e04484e8fc99e5edb054a5ae

SHA1
6273202ce29c7d68ae297f0a4a4fe0666e8c6e39

SHA256
02d98330b5f9a773470d6cc00b44c1021ddaa39452212a3f9fc04e8149642151

SHA512
e081380f3c1af001467a994c701b93e859d04343dd429b62be7b501cc0f03774b49ebedadda17389454c07e2ff8b337de026c7a61c3d877026dbf204010f3b73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a7dad8d8fafc72a9d2b44fdf0773a69

SHA1
2aeb4062762f0a74aedd7ce1b3423eba74eadcb2

SHA256
c5f542829d6a001345ecdf0d73141e6b0f1100175411302fd3bce5cb27c54cf1

SHA512
3fc17b2f82def6f4b78598cba28133990b83a66936a625bcd760855b10fc58668f25d49c943eea97c2c1630f5aec726a7f655a28bbd61dd6f6ff0df30a9cc896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5ee10e1bb9a9d63589c76196be0b0eb

SHA1
f82f8c5d757e29d1d1377049f1040d1cefd37489

SHA256
b41edd6ad70ae69fd4de219963da308323355eec571f7e409b5bb32d7ef07405

SHA512
2779413e4f5642b79b3933c82e8309b2f1a97537b4735c052e49c9d9c7d73ea9844ba83ab2b9ceb1046cdba8485fc37635b4ccd354675a6813ee9d598b36e5c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b4b653a751b02140abad8e455d58d9a

SHA1
8830d0c41e85394b77b013535307a4031130f0f7

SHA256
bf3413a94f841257e3f3c2277498c463afd8f0fd0a5341b1a1b00f277562a449

SHA512
d00d04b53162481023241f4e2dfc5e8f2e850c113c1e9cdd2e69d59634bf334a6a60df0f24bf3b9dd60e859514e16a86a99a68bf5e8d8433293fbd4d5eee1d0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70211d4f4600a34476e0a68091810e48

SHA1
e0c0bdb331dc255c9df451276805a3d3e6ab44e6

SHA256
c68cbccb6b2848d9eaffd70335fd131e8a66ad0b44eb3cbf9a65184be3077536

SHA512
70949c1aa31e118f6f3a90c29de68e6294ae27a4f1237c13e983e1ceca4007736d31d034ed99357d9b117692fb2bfc55734644fa7974a952193e92faefe74c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a54e37cbee49585f138fdaea88507f3b

SHA1
9c507328b705a8c79d7c6a4ee8aba9574a3125af

SHA256
f25aa24a9d71f02962eae652a1dcf4f3476218cf9072a1af67e4051237efeed4

SHA512
048772b8d10260bb2238073a9eceb4998001589b86fd78f4851fdf70de6f05cd927d10fc5cb50c9c6ee764e18fe2f6f615bda2ba1b0cf29ec5959a4e2199d177

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad23759e8e69ff76189df2d3d3fea312

SHA1
22faad1a9666c81fc4cf20ca001d3f6138c2d86c

SHA256
61783a2e4374eae023d90936dd1ff86922348ee644c7c76805748286e9dea012

SHA512
a28fddf5edb336575263e32a7d1fa05865133eb18c7fa845106b82ea85b30bd894f6524f39c75d78f6de3c5cc69e70d0f4190d9042153f7c2a5303a334fcb571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7991e612659410b5b6981fe35737412

SHA1
6277b525487453cb9f6eece3ac55bce2420e943a

SHA256
6b1ce86f5dcbc7e29f6e74964addc091db21c72a267340e32c46076683af7ada

SHA512
dd829f5d2a3f5881e683204a0ab46d5ff1a5d04ca48ac70eda288dc1e237870837a52ab5fdcf082e3e0528098d4c2e92cedf22ae883569e10c9d7ac16719f77e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6217d0e1ff7986936c541639d088da63

SHA1
85cae9d855216c65483f4b1bacd911df4c4457d2

SHA256
335a55d5cfc07a69496c384a4c2950033110483429ab32692a63add0ffe40300

SHA512
353a57882a0cea8e177176a4659d70b8a456ca0bf487025033f0818ab2f57e13f8856e7adb05d17afacfc0b2ab5053f789d09dc7d15c2a8acb067ffe90afeed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF385.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF443.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit