947254b8291dfc329630faa81e7a3cf5a2c43b33da53ad51a81e3591d4a4b611

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ced0c8b3472839f37ba84e91446a6493_JaffaCakes118.html
Size

37KB
MD5

ced0c8b3472839f37ba84e91446a6493
SHA1

7fcae58c4c71654b27c220e83502fbdd622efe5f
SHA256

947254b8291dfc329630faa81e7a3cf5a2c43b33da53ad51a81e3591d4a4b611
SHA512

67a8436816d006faa3519832f51a653dd702b818ec3578d0219e2561b123a6bcf9531e3f5e753822595a230901b4bfd1de947542bb3154e58b9a25b9cbbf7b5c
SSDEEP

384:6Q/H1KkrGtEGxd5mPR7Lbe0UmL7upj5fnk:rWNiR7Pe0UmsjNk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000a26468d856cc08236aa2c0f686885b697a71d9b8f17cfdf48538aa8a324a84db000000000e800000000200002000000027513573c9a9bdc3480788a7d3efd31ea5fe090c507be76608470826cb5df4a020000000f8073194de744bb7c3a2037daeaa194fd0b2a649cbce51723c7e2c1b0402fb8c40000000f0553fdcf7f74fac482853da71ed2cd5deb74703941fc4d9ab88fa1324cdfc12835ff89e158a4d6ad6676a1c41c9ae6e17fe9adf4addf21a9e063c5617977de5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000005292dca975933e2ab67a89a8e2edc52c495bb784c29f58709e043bbee1d7b1fa000000000e8000000002000020000000e3109737bd47eef4fe4a14875df6d2dc70f7312c70498f3673c53a4811517f1490000000662a2718d75a5a9276bd19531d555d27055e14fa3312cca8b8c0c3704e6c8225f49d63a48eba00babc1aeb1016727e09e1d4284273a3656d3f2d4a4bdc6eaf94b7824cd9e9c329c9b33cd8b06bb9c1cd1e57d790625642a98c5a6745c2d93f2c5a4753cafdb347ad6fad3b0b033947930a866fccf52c4d6b40889520ac6770209508597cfa931e950ccb4b18da2d982c4000000065b968f3a0800ba9ed54dcea9eb909f4a6a2d685b65ff3115fc0a2c768c5e9d478bcaa7efe835bc238355ad0e5194ad822cc8cc11be1f43a0dbde35e7a6a5db2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431763705"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07324c72000db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0DF1181-6C13-11EF-87E3-523A95B0E536} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2468	2348	iexplore.exe	30
PID 2348 wrote to memory of 2468	2348	iexplore.exe	30
PID 2348 wrote to memory of 2468	2348	iexplore.exe	30
PID 2348 wrote to memory of 2468	2348	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ced0c8b3472839f37ba84e91446a6493_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e41dbcae4ede30f5b0a79d440a88c38

SHA1
d6d8eddb395f023ff2b1c7b26863809d3b3fdacb

SHA256
77eb57b9291b83d68c4fca134f1100cfa171ecde56470f5effc198d04a9c69bd

SHA512
adea45617dc5cf15ae279fc65ae5c0fc0ae2af8de9fa59f995045f8d1e09f4ee5e1c5202bad21ec5f321792ff1ef0d94928969f416db154ad160ae57ec1c70a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
879462008417a3cb98e4ce23e9f71d98

SHA1
8afa74e6d7370f812f75299cecd4106d0111c0bb

SHA256
4b96786fb867a0edf956c0d495cbb823022dd38798ccf10193fa84ba145f37ae

SHA512
0a1805c4972de8beff30809c794838f3404249bf72457d3b6ff6219c659d1660540add4398ac95cebe08234775b943c72e819b99b532a0f02d64c66b2dd316e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93d788deecef542e7331e92717a34cfb

SHA1
c266c233900b1576589cf604d5e55cdb3dd69bb6

SHA256
48634e1a369acb587adc0095c960bba881cf0a98ba8b166ef1454b3ca35484a2

SHA512
6a214151ace9a70361ea84ed3e15b3da6000fbc1318daaececd31e3e542d92c0b7cd1a0115712e946e6b5b65fd2c42e0cf55542f47eec257fbe0941cefdd44bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
250b3c3e93232783e6ff2a76e746f943

SHA1
6d71cd7b16e2196f3eee78ff1bfed5ce481b958c

SHA256
5c1e75b3902f6541a4cc3f6c925caf4f65834f708780487079789ee3f80e3b04

SHA512
c10b53cb178a3c4ca6992f86789993acbb3422aa0083a5d9ddd704978087146e462a1a4c4cadbb9b9de41fc8c2553307c1716b709cd8e96359630e3cb4114209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb3c39b50d45527913d093c3af83baf5

SHA1
be6a6ea66f710fbdc6650a52d35a9a60d1e1e455

SHA256
2d7155bd9207963511e13305cc9cf9458ec000dd44089592c8b7ed68a086c792

SHA512
af7dd524ef3a1c3916ab874c1504d659c6c016b7a571f1173d625c159c0cc57149fa5c6698111e0f3bc49b66cc2fae5b79c48f6bf06529a39eeeaf550971e207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aab4f79c414cb4954144baab258f24d9

SHA1
1489932250f5e037fb4409828641c1ee21622bd5

SHA256
20d98677c2fde29da38d46dfb7f7d5629592ac454bdbcaab3622e874ec883441

SHA512
25511ecac8f77dc6b9637153a6568c85bd27096be30af54d49bec110121f5fca409a14183d7c5583bca82b0663907264f2fdb485f6451e28e8dc49526602e9b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c181dfdee88263a2f7191c3a99dcaec3

SHA1
74e22a7a4cf98d0d963c5e1b2bca21d8be2873d6

SHA256
d0d621a5301ac5a3ecd76435f9c06e18197d98784cc5980ef9b481287ebf032d

SHA512
6279e4087b6c1a98458151f4ff66eda78d0f1facd9af07893bce843be22e2209dfe6b3930c5864a3e20a81a6dd9e2636a688786353127000e3214e96aa9053c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59910eb25d4f6ed268c487288756b2cd

SHA1
84257ab52f6b821024b8cd8528d112a93ac1fc4a

SHA256
d0b9d7988051eab0a518a899a1086c26ce56c3f2f650be22e1e1af4024747a98

SHA512
d2abbb0b6ebdb2ec88d6401537e3e322725a81d683ab26c7ac090296b9d41d1b8d7a9087c1b1cbbcc3e3bc9e73cb9e1f7832977d832deb4ff5cf4f01fbc7ab3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
000cd6ede86a9f797c462c4b6c2857b1

SHA1
28493bad4dd593806fc8fc5b3dbd164cde997318

SHA256
3d64ecaf54b9739e48d4b591263fa6ee78753a4432a1883daa2de6c312560225

SHA512
04665ec27351bdb8cfded48ba30c456acba1bd4319360898cd4c23cf9f0f4d643781939cc7500af7f8f5ab64f3fb8e11c7d00439e1a10d1044a24ba023c96656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72dfdedf18b12dff4b66ea8fb42b7c60

SHA1
e49b227fb49020a7d6d0f96c3d5caa927334d827

SHA256
cf10140b4a75d4498965ea90fab3686ee695f815063da1ac685783f70e5bf34f

SHA512
b828dbea7e104cb2b2c5a7e82c01d87d9f7beb1be38457915ffc11b568209c0ae89098c3afd88702089fa71c52a46f69333908dc612c2a91a9e1225012b93608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf36aaf2639e0ab9c7f3ba715c6f21ad

SHA1
95b394a61c10ee55ffbe3e56acd6c09f1935a964

SHA256
849a859703024307e20b971f1ba840c3c4fd37ae5fe10fbb538b1f297ff8e88e

SHA512
d4f719db3a99c8ccdaa1e7b2547edce49c5bd5591c705c439642f71bba5b0a2d05ba827c2142b83071e95f88c06410b0d6f408e53f039561efbed83580cb7a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE487.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE527.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit