d60a4c67e006f00271bc3cd79f543c44b1d4faae75f06c71b4da53c6eab4be81

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cecde0f1b75b0408cdfa364fad0f1f89_JaffaCakes118.html
Size

143KB
MD5

cecde0f1b75b0408cdfa364fad0f1f89
SHA1

34140f086471cc9661d0d4e9b3c555e7ff9e8fc5
SHA256

d60a4c67e006f00271bc3cd79f543c44b1d4faae75f06c71b4da53c6eab4be81
SHA512

d28f45b666cba7f162e952170a6513de64c15c2c73f1a80053df674b898a0ebc4f5cf14c4471222b585015f55f7582bacb1c21a09691e8ad80e269f49308c95a
SSDEEP

3072:SwEHUMx7dyfkMY+BES09JXAnyrZalI+YQ:SwE0Mx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431763342"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{187DAA91-6C13-11EF-A5E9-FE7389BE724D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1092	2308	iexplore.exe	30
PID 2308 wrote to memory of 1092	2308	iexplore.exe	30
PID 2308 wrote to memory of 1092	2308	iexplore.exe	30
PID 2308 wrote to memory of 1092	2308	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cecde0f1b75b0408cdfa364fad0f1f89_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bdf84c7d2574032630e29394bb2d047

SHA1
b4bdd55bcfc08f9ecec15e46d9116d6d3b55ac3f

SHA256
428e82623214b6a696ec2d7072134dc2fe33919d4c0865e87c52395ea0e61b39

SHA512
cd50be57c75e078cfb25752067e89ff9f19880509ea4988fdfe291af9c3a11fb21b4ee37ad93ac91fd1ad4c2be59894c522eb87d457fc27f2760bce124f5a5ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b2e4698b5f79fd486f178b9db91dcf5

SHA1
269687650587f7a394ace1994223f54b84b6f73e

SHA256
6eb1e51eff1b3561f93b4a573d5859acb20e2a67bfda09dc1a1c0e936719472b

SHA512
c94a9f81cfb2f18edf0017c5a54110c8a0c0de9b6ae14657dbdf810c8999884f5d92b374dd4bd86f0abceb812b290d4e5be832b15e0fda1e36b6d982c0b80681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
767f91b393bdcaba01971261b108b909

SHA1
709a825c6f23e44d8dc4dc630a8585b32d999415

SHA256
3d5a1293c6099ff4b409da7a3c4551a29798d502baaeab9626108ffe8003a090

SHA512
ebf8420e78354876a9c79cd9b95106cdd5f489f94407aafe7bc3dab0050d2bc6d44139fb130405fe940060691d9264d502b44b5c15368a2798422ca5a2f9e739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea2604da842af5154693ae9148f7a4be

SHA1
9db5554ee663d06a43de5ef61ccbb899cc1d84bd

SHA256
3329d452807c57b702d70df9f90a61ac6ad58ad5eb647b12613131e5a55d8451

SHA512
603df39dd49d28fcde0944a836b3741757c5e80428df0fad733aab95f0ad9bd9414349687c46aa077ad5d5ff73ebbf8f25f3e4cb379752fca9ebabb662ef4ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d93275925b7a9976f43460951216f79e

SHA1
95f456c4f6d5b93b9eff3776e86c537d80dbc2c1

SHA256
93ead2449e9be7661740912c0c7af20dac6915288008ea2a76c5c491fc1e29bb

SHA512
a2b6d23fd90c3fcfe9987f337f294102df27b8035d4405b2899d6eb694a3bcec9cc5a817c67d8cd37f030e2c37d856e9d8ebbdccdb3ef6320874da3ae7dbcead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d0ad992a5e91991b747a845828a0ed1

SHA1
b0b96d2baa4058039b74eb5600b3e1bb2edc82b7

SHA256
a7b1d1da57d19a73db4adfe4d598cc2b9f83b903eea87bb46820a52617d80dc6

SHA512
142ab444be8b882b571bfc6474a404fbbc652a442a97286bad3bd02b64e56b26136a747796a33316a9981236106f52da2e6ee1d6efba79e7db6a563af8aa0bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22da934159dc0e38f8d8e62eabcbd9a8

SHA1
7f85f90e634268aecf6d6f9cb1751052d8e3804b

SHA256
0c5bfdc8699ccefa37f71958e0c5ae22c457f44a4a4291595b398b87ec08c4a5

SHA512
59573d790fe7d2dc0048569c431e36ac4890d10fc6ef9ca64d5e98762fe5595270edbcdcc47e73e1b9ab574fdea9fe9cb6b24f9ebda012d1d0a8ee15faab4a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92980d500e790d74abe65a19f70a9138

SHA1
6dbb29ec178f02c1fac6a431f7e6f28861e60595

SHA256
fbf243fed1037fe6ed146351f47b23d2273ef9859b42975032caed6b94aa806d

SHA512
36d96c57ae78d3c2f8fa076bcc255a03315e6f4616d0954d9ea6df90c9ddcb89d92f25431828ad5bf1cd029d999000d14f5387cac947ff3ee6c995761c05876f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
752bed9b003bd061b84c782ff3146140

SHA1
09fc8c376e0a4cc8b31c233659f239b4d5addcc5

SHA256
4ad704b2cefac9066a99c2513b308ed9b5a3d6f4e8d9a730fb84578bbf60e514

SHA512
aa495dc1dd5ba7491eb208e39ce0d5b344cc8346d500ac254d6ec32b66d7f639b748ba40ddd7fae071243ad160d76e20c7c5c98cfbfacb16fe7a0bed4fdfde27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dc7ef5a1e47b66cd94aa45bd42da7b4

SHA1
8b57079eccf805c9c0abb8c08e273e6fd713e06d

SHA256
a5b36e6a62b4eb8d3f0faf6b34726cdbc940dd7e546ab3b26fcce29054ef3e58

SHA512
fefc727b6276687de527dc8e9efa83bb78ba63e59772bea1ae8be0b6207db6afe866057a635e9cef195ed9127bcfe139d9ffdaaf57e14cfe2edd36a03b2e5b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61c0c7e09d44e0069b1afd070ad86f5e

SHA1
a7d779d78d5d440066cf552d5c0c2d71bfeb4a54

SHA256
4147edb0cb4e62a07019c9a971d660515beaf575d37edf2d1b40c981d21b8ccb

SHA512
d68d83a183e876da56500fd0d876bc0da16f91e7c789fda7677aca24d713a06d6d48712837b62184d95b0f7781093362e55c4bd77384c94084d0b122c96b65d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab5fbdaffebd471f8af691625c7ce939

SHA1
81371be612d60dbff399f04434460de781ffaf5e

SHA256
5483630912739477cab70273c65a79258ce25fd648843cc63122a966e55bb534

SHA512
cee4581326188d0e2969baf16e40b2ee8dd3b7f79c5f1406fb32882315aeacfd494b61273c3fc3e7d8fa63bd911d1df937df89210cb0030abbf0fa719b910c63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6d93b92c034d29e6998ae8639a0fa0a

SHA1
ad19df63181d8f94500eb2299fb1496e8abcc0df

SHA256
6bfec1f1b155eada8a2dc73c33705b547afacb5c91bf4e7739ddd284b127cc16

SHA512
bd5c07b28f5b694176505334412ec5a03dd591d57e7b33a81de02b9c90cff6b4d485d88144d797dbe1c8a99749b6f15d659d0562a7b4f6447f036ffd9443f074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf49e0b33c00813b4ae2740149611f88

SHA1
8bcd2fae0564b17ce786b01d1c746db0a889e88c

SHA256
deeacd64df30472f746f4d556c0ecbb9a96b4d6319116d591abd755358031966

SHA512
8ed397cd420d43281dab90031b449ded7ddc45d3cad2f7bca8dc3d25f712aa00c507ad28317582416ccf118d235013fc47ea9a74603aab001b2dc67b72941cc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd8768588eff949c52d353e1e11d1222

SHA1
4e2b56bc89b90e271a19cca71fc08aa6bdd5d640

SHA256
a429891af137c6f430f52d80a2f46ba314eba4ded72cd20f285fd77497b7ceb1

SHA512
1de90f8769b65e536ee3dafae442c057a2af2e7279f7353e3dc95a3ad84fcc1fd15a188965c5c56681ab5cede2bc89e4498cbb88ca4e5e99f0dd42adb58797de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c59153d37612bd81e0a43e2a994fe0e

SHA1
2eb6732d6654b67dcdbc0afa3aee85f64fb8b490

SHA256
aeae8245d6935175e8fbdee57d08613f907b85aae5a164f89fd8e76ab7ae66d1

SHA512
ff3875e96941a8ef1a4716c26e2c2a9acec40994aa236ab2d6af5d4af15571cba55a71f89926660053f3724b2985b571940a4787e11d1e78aaca1e842cbfee53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de9b985e7f4d46b98ac8063ae28ded5f

SHA1
5300458e3a4e529c8ef9291e8348cc03f24cf165

SHA256
12221a8322c4285cef482fba98acab84c64369790dded137bba0a4290e229d70

SHA512
384d39a8c6300063ca37a908656d7f6404b418e2c96ccaf3e221b4d014e2d90667419ca49deb5c987a14e36c37d36c0cf7ba353153afad22359ef4b78519687f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16ab46c09124d5b2602bf0152b342f98

SHA1
b1408b332ae270dd8cf1250b4deadff5363d0816

SHA256
85060f11b7457d6e57a5db9380fc7f0a18088b8d491ecad150eb71a68d2bb4af

SHA512
9b575f25f17cae80d6ae48637a5e20865a6bceb8305bc199766d199adbc5f9edd04892c215e5ec7a3b20c83582e992e6cf196a5da5888f9d30c1bc7d25936a3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bd295a5526748df6eb4ba37bc915e41

SHA1
cd131ae917a7c44f8aa0525058ef4d484886c35a

SHA256
54ca9aef5525d5de62dc71e53a1bc1e90033214bdeecf0cbc6005fd27acf8654

SHA512
84a3d16ddc24c27ca266e966c5b03a139b7bdacf58dde1c02649af6da0f83949b87741ac63f4d09bb70d9df19cf627bfc4f01dddc4df52cf62450090d80b1b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA72A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA78A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit