ce0d9b33c239491070d16008d39ce6c59957936adcff4e74719012f68106c422

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce7ee7dc0c972cdff9178418cbf33046_JaffaCakes118.html
Size

40KB
MD5

ce7ee7dc0c972cdff9178418cbf33046
SHA1

6d603a2d811c7484cb5a90809766216d80f3019b
SHA256

ce0d9b33c239491070d16008d39ce6c59957936adcff4e74719012f68106c422
SHA512

2935b2516bdfd85bfc49962fef8020ccc6ec3fdd637a37e9fc59a1893aadb98cf3e64e0cadb11ef3e42edc1de680f4f5d170fe7b9277bcb481cc24ef5462c77c
SSDEEP

384:NJlCMElfCyjWd5EdS/yIRSeBQ/mq9/BCE/N7uqTDIZU7LBOV1EdwcQ0/wBN9GlSe:HU7Ns164n9GlSlU/V0+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02db24d0900db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000009f4605816c83a2305999bf572893c0450982f9657ca155198cb5512e0605ae57000000000e800000000200002000000093500d92a13b3b38e01bf9654fb1db5b768b435fb12af9bd804bf5702e28a15d200000007c4e4cf7da168cca4c5d3696e18e5255922d3f99b4e0b3a6910ae7b4a68895f54000000032e564fecb27c769fd04c55d0b84d43e3751a63d6a99dc607eec186e60bf6341490b71907315d8ccc49ba2342848be2fd37a69ef24d430a4a40b2aa5b7fbf097	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000003dd7d7aea9d6d131385ed45c23d73f96626337f1acb2d7a45124d583e2cb0d7a000000000e800000000200002000000018cbdabec6545fbe197229ce4c6259f31e3395f1d944dc8f33852a3f9469210b900000009efaa1b67817f7a863de78fade466292c695bd51238706ad63a03f85e2a2b86024ed4a19d070a4ef6cf2ff9411a285a1742907622cdb9754e6407c2db85863106f5ccbe965bc75ab872f9ff24cbbfa1805e6bb55476e3e389721d976f253a42ed8a2e92cb4efafe97d4afff028be802804e7b0058c69165e22a7291dff5dd383e6db6e09ee291c0c7f020cdd300cd16b40000000c4a84f17f5db03343fabfe3578725695f20815b42a01e1ab947dc5a7e7b8ffdabe7d7f474eb3cb59544743599a63cedf0b53d5033564d8667f0d21746d08e0ac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431753622"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7781BAC1-6BFC-11EF-91D0-C60424AAF5E1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2204	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2204	iexplore.exe
2204	iexplore.exe
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1608	2204	iexplore.exe	28
PID 2204 wrote to memory of 1608	2204	iexplore.exe	28
PID 2204 wrote to memory of 1608	2204	iexplore.exe	28
PID 2204 wrote to memory of 1608	2204	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ce7ee7dc0c972cdff9178418cbf33046_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27f2230e75fd91711e41295602f3856c

SHA1
41e1a48eed9f06f4a1f0fc58364ed433b493a010

SHA256
a374477bd256fd0b542c07628d276bfc301df608f1248c1dc175c9ebf6051d12

SHA512
acc74c4ab948b4bc7a70c9bd13d663617c36b272f49c89926bc916ca09c80633c71dc42574d36045fdf4d026c7d9220d637abccaa45f061d6c358a1b36c93cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32d0bbf762bac19078ddf38bd2b4ba53

SHA1
de347548de2e15b0a0092e92478019138b523fcb

SHA256
3b89579d68e160f11f1285ca0cc51c93c1357bbcedce7bb247b1279ee636c843

SHA512
118ca5fe0e8ee864891ac1973cbcb0f9e6b938fd51627f0e8b6623a5a25e453aa3d2528ea1a921ae6b8dd32a4a87c16c3d184ee0d5a075599221b93e491fc0f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55bac24a9c03b06ff28918b47e78b80e

SHA1
25ae0b247676f41ce1414beabc6305ec364227c4

SHA256
770d24b75ad034da2bf7dd97c4905ab5854e59723831e114f1d0149ce37937dc

SHA512
16ce46793fa1b74b2087eb65c031eed34433eb0d508cc7aa2b95b4fd12765ad1145943bc417e78c9522ab35f0331d03600a4cb9c850338bd36c03fa431df9361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89a32ec49c76208afc991c67e684f3fb

SHA1
08b683e42c27e42439cee1f1cd89145dfe0a0bf1

SHA256
a8da72ef4a64c92737624ee15d5b276b35462cbe87ce1b75189cbafa7d1040f0

SHA512
40da0ca5e0609b280792597ac057e3744ca6a0e96ccee65226f834cf53607ea7dcf93c1ec289fd2989412812b2d2a4a3a4219e5fa361fcf5b0117e1c8e572429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
852f89720af63660191cea6e8e16b7d6

SHA1
fb7b25dcd136d330d8521827ce6fc037b068db12

SHA256
ecd48f0cd7d2199c7ed1f428a5df44670a2b41faf71b7e7922e49e5a8e5bfd6e

SHA512
4fefc867f0f4f30e018e7511cbbe614d8120a1c6def97797eab1f7b68a891cf2ba9bd6c4bec684049f52293321a9916fff75183889cc71def1d210d0c329b619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0382aee714ae882bc139fc16a38d3d2

SHA1
0b25af8cc26db7a99cb6497bcedfdf8c0477a029

SHA256
90044d452e82c707fa3d3373bb27f29479afd8891d2339535d8d0cf1d575a377

SHA512
2b51b8bf5e235ca094d56dca52c84fbb5578c49286708abc0098e7e0cf1e21f16b7bed5ebd8d3975ce16ee8ae7a00c7648591ef21c99d5e6cde81a53e2d394c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc42451918f4385a958b83568c45614a

SHA1
4ae561c9be1bede89fe90e000210166dc26b32fd

SHA256
53e1b0c36f7b52900589623bbf780c9ba4a6adccae65cca70e0cdadca2bca3f7

SHA512
ee2cbc894b0543c8b063e1d57e34823ae229da87c2512487bd23a3348b2047645f73c6ea897f75c7516cf2c83d703098edfb30c7e1462f82178799fe6c895c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cf9689b2bc8814248d489c9023809e2

SHA1
85d15fb12a7edbb33232503767ebf74668baf31a

SHA256
40dfd42011a0899eb353f28b9102b71c03e3185a632b8b663a8b3c818e5c1ff6

SHA512
354f0cd039335b7fd06f9bbed9232013b17456874d1293b14ea1503c15431761d15877ca0ef283985c5d3f8bf1d4e9fcb2ed6016d86db739b4c03acd40beade7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e51e9f34fa40953517563818296d64d2

SHA1
8e074dc4ffca14f42b9620d4d57a8cde91b13ffe

SHA256
d08c05bc2a9287cf86ba222540ec27329fe875564b531a35676d58832bf6d309

SHA512
500e0dd5847ec63e5a43cd1d5faf4b06b6f48b8aeb2fb606ef6c624271f7bc298a56fdfd37d9e848fc0c93fee7af73ad27dd5c944676178e2bb0a668a2643eb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e54e1e6aa8a82101c662f271a33c18c

SHA1
b50021a7f254690f2e459298b2cc370f556b64c1

SHA256
14471a5fac95273bf9132a6ea0dcf1d85b5f1ed9fc6eb6be9b25516464e750c6

SHA512
f1d803ef6a22d22bb45186916353e30f21892733524e3b75345b93585806982cc6d59a80aeb35bc7c2caa5bc4da5979c26d21cbc581eaa30e3df549568f04b79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
779ba83200e085b302955b5c40058c67

SHA1
f1fd90b835efa608617335844f46e541b92f2046

SHA256
0adb5d4a53a717e2c4bec1bd320fe31b624d08cb118bdda96435c5152bc62669

SHA512
177fe74276a5b6c6f3251211125a57b5c2b9a366587b65b87537a4b5c07c980fd6f7d30051d938ca38e05352623733104209403cb2642105f27087c97b18aa9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8616a8af6bdcf40f0b81ab8a8fd37046

SHA1
47c1c49f93756d818d29a3fa7d2e42897d4a6f32

SHA256
4f27a799c1a8ca8847a47c34d5d48c4b18e511d25374439a2099fc2518c9e69e

SHA512
37ebaecb8ecd2bc4b2aca9305f608ce36a9cc594b8d0b87b14d24e766ad0efdf1e71a494bc0fe34c098d9c33314f54b65aa17c1ae637ff1b8c39e7cfbff9b11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62e5f14f0a0e98296e524f5aea813c73

SHA1
5fbd548d5a9b48b8ad57ff23949875265fa37dd6

SHA256
736954a5815518b9ff3af2040fb4fbf3f1e5b990df99c0025da638ac335fc88d

SHA512
2360da34096fc56a87a44fb9d3c2fcb9bd10f7cac545ce76ad6b77e9b711ac7c567963e291ae99b409ce4be0f63bf0f4471182650572b7fed5b113097300ad8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC0D2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC152.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit