3b3fb1ab05816d44be9f08d3e654a82a0cc8cd857e9c624fc355aabc53049be9

Analysis

max time kernel
144s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ce256688a2ebb914ac5d92b80404abd1_JaffaCakes118.html
Size

37KB
MD5

ce256688a2ebb914ac5d92b80404abd1
SHA1

bd42d42bb755a53690c777117a6e9b5da1519bcc
SHA256

3b3fb1ab05816d44be9f08d3e654a82a0cc8cd857e9c624fc355aabc53049be9
SHA512

5a44f02cf3f040ce0417f5fbb3bcc80fe0950d45f6a770c3a7eede03dd85f86c044b365c2bb620fb46cafc98e9c7338d088dcd07f2b7a334f5190b2831ea5799
SSDEEP

384:DQ/HIaQXX5XcUqe/nCWPNCHI2BTR5Gwr9SM/QIZlVq:2uJlNC2fwKL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431740761"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F2E8E61-6BDE-11EF-976E-62CAC36041A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f46855ebffda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000005b9ed30627f42998a9c1f1fd79c75682ddd53c5c373ece064f3cb2870788c7e6000000000e8000000002000020000000c735cdbf40bb1650def8a019ce622f944885cdb113c496b5237128e85f280cba20000000d26ea99ccd32d3e045d7332cb5a3e3be456c4ef6dc51a0a16aad6945fb36265a4000000034bd717abcc47ea89e9a5dfc835fd0054b4de4f7d839bfd2ba168ca72ff7db846603613453330c135403c9e273dfee3c07f17bd76266e34031f0dc7785f0ad74	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000002ba954334773d96b3be65800db23daf4553cc50c51e173b7b221e384a93b8608000000000e800000000200002000000022eaddab81f780ffe4a2c8fd2308950e19170404d183e8b90c751b617b0a4ee9900000005f74e650d8aecf94e9b919c6176630003b17ed649b3098cc20d99a92f19d93307d87327f70693e08f2da56dd9991d8421c0c6e9bbd7b825db6a8b6767bd532933275ec819f28dd5cbcaa0ec6fa3e3f70c7d7b590569c72db3845fe9d3e0fa681d6a537c067a6d0e46f1116bfc705fdfe75825f8b2c7ff296b4125930af9edc3223d28eb8d164bcf2dde1951c9addaea0400000001ef1d0865255f5a08dcdb94fcc15a1a23b137b86eb47147df37b9b5d02b63f35bb05eea43db72e4b81b65dabd4386127edb3d357615a3f9a04b8c9e6ecdcedf0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3028	2376	iexplore.exe	31
PID 2376 wrote to memory of 3028	2376	iexplore.exe	31
PID 2376 wrote to memory of 3028	2376	iexplore.exe	31
PID 2376 wrote to memory of 3028	2376	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ce256688a2ebb914ac5d92b80404abd1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23184e2341163923086a45eb61092564

SHA1
a4911bdea78536153a409798a55441e56e34a442

SHA256
37370efa6cd82d3cb0197abed19656b91e51691d0944f2fe92e288f8f999ad97

SHA512
763349ded021dee8c00a676401764309278c3960a903c442f970a51d6d21cbd21258888e533ce3c7f57615a98cd30ef2ca524feca322a8994261602c29be0f4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
949f263070545007aed28610dc2722ab

SHA1
02f6722b413b0fc3082d0d70a86d065b514c7c39

SHA256
a90b60d758347ae5a4e123564e7d229c6668291afd4bda393332c72105db58cd

SHA512
425ad3f081e0f96652ebdd1bdc3520a06499856e6e4c9491232e77ca763150cea3507407d77731b431b806034031a45d3cdffa61f1eb9177ae4bdd6246faefa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aca235a9a8127846c85924dae5c9b5b

SHA1
850fc3f6daaf48fbc7300fcffd3111609f93bf17

SHA256
1f8c92b24c5a0dd85785f8413bc10fe1dfd335aeb0f42d7b49479bab55ddbe51

SHA512
9cf4d2fec3c10a97f08af1e64f33d8d24b1957ac6c22523c58d7e16a9aa104148eaa9018a5070f0219361c4e4238555a1a96b1ab1f10495921f7689b2be1803c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6199a5580fc5fe576ab386684852a6a

SHA1
676803bf7633bc28ae5adc4adaa4772f2de3f4bc

SHA256
b00a07692f0e24b1a2149f428a3ae059b94e654333603eae5fe87c1989f49b27

SHA512
535c05b86973a3a5dd6f8d9219dda84317f206314c2f5a18cf0406ee612fe08bd17c7e3eaf225ebd0c3bfd0b97e5fd0b35dc2d5174a8a8bdbb8c3494d585fc37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c31b3f2457163afb66e970ce271165d0

SHA1
8ead148f39bd7b1ca40fe82b7a257a272e4752e3

SHA256
c3be5f56ccedd1284002614582de048f391a4775e009197161a82dde00eba6e3

SHA512
0ac16aaa0780f2c8b194bbb65d3ebcc905e89a75137e814b85b5163019558931b7eec902f6108d305ea75fd7353a0d488aee2ab3738eda00d357de0301f6df25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9958a74a21e125f56c580bec9927cba7

SHA1
f4d1ac2d3c44ab8f7a7640902f247d2a08a39a14

SHA256
f23fb9a68265280b9ba9ece546662c0498333088ea0d454fe69f434abb11eda4

SHA512
dc260d70b677f17c2c28a5c63d856b9f30ff6ad9a61ceb380ec1011838c12cb39f8f3cd269ed64b2c939c468d75e0cb0f0f0648c7e4dcaa7262e36a73cd3ca8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35d74621d9d2c213cb5fd5a288cdf22b

SHA1
06adc3c34391786ac836eb468977a7c7a9e65224

SHA256
1354012ab7e69c4cf1ef392168269ca3a851338b1ced2ac264aed144d8ff83cc

SHA512
fa01ebc8efefd2a8c27361d54875d1761ca3eb5917e187be9b883bbd125019d6d19c5bd8a699cfc13a75d632beeb1cb9440861eb555adee0a21abfc490a73775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f5aba89e46dd4ac35da799127777a35

SHA1
8c73ac160462781e17e0c4399e0e8e7e13dd60ac

SHA256
d4529435f4feac0166b6685a9b46dc78056aa804788018ab6a3c65a41a0b0ed3

SHA512
4808bf93e08d226ddde5ab9d61af31114048673a9c30dd0ce63344152be6803886a3c4108f85a019e87472a10a4073ee4054b6f2a7081447cde5ffa5a9e93f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fc73ce7a862171428051937e95b6a60

SHA1
d206587c475393085d93f20b80d9ce1a81111f1f

SHA256
42ea8061fa68454a9da015ad5b5c5f4d0b83acf6de15f6743f92aa80b0339172

SHA512
7ac4d05474ca5a8c07c3d5f225734bd3311be54bc29739f04f4ce237738b0becc6f690bccfdb23257f6c1f33712ce4b08a7802c28e72effe4e923b8cc3ef1b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9603bbaa20cf763c1efd66e96fa2a90

SHA1
0fa5ba079ca536b38bd60beda1c021d619583eef

SHA256
8b32b9fe10bf0ed309a540f9c3bcc88ae1552a674d4d390cf54addae9dc51a18

SHA512
ebed3df8c0e8f28e048f06c36323e164035bbaeb4e48746f5e4c8f1834d42c00e7f28c1fbcb3772091e714cb932eee1de5c796f8e437caf6f29a1ba07040eb0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b7d4f2e02573529490ff74e9f9a24c4

SHA1
1e0181ec1bd4cd874c72e24acd3f3babdf3a64c2

SHA256
6da0c3ceb6b50193ce74b2e7f8a750284643779535b1fa033e2248b3c50dd198

SHA512
cd37c2b93cd3ed6a51ee96318a03640750aa2b7eda098c15276da7033270e6beb0b920440e49be5dc8b3bfaaaa3d3851d8fe5393419dd19c5bc69556c9be6b0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e482166d556d26ae87d59b5975132614

SHA1
28831dd875b65c28171efa8a0e2e70f7edd7dd02

SHA256
f0407776cbe8cd88c54320ec8729ee52dede16261cfbb195c8d53cfa57bf43c8

SHA512
751e2e959ca2dc7029d70b16e0c42ef2dba4e1371c1edb7471bbaadaa6e52324f8d3c9de4e267e32b66c138e5bac44c574fa609e7de25b85fed6d856863b0d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac960bcd75149cff221c923ca0e5f802

SHA1
7c6d635ef236276351404619fd72391a91116b0c

SHA256
468170764de97bb5c6f9dc41a0f1c69f83ad0d6e8478eacebdc025ee00bfa0bc

SHA512
33553ae1319437a2ba638c4388f53c6032866ba193c45aabdcf8f1d7ce9a7f996adf9123b8d692215fc9d42005bb6c5140a4222f1c074ee1c3055e27438825ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB3E6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB457.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit