fa9602b2828291242fdef63d0c590c68da4dde9a658084d2c1da5db53e96cdf5

Analysis

max time kernel
137s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf15e6d237db6640727c8f8cc5debde7_JaffaCakes118.html
Size

18KB
MD5

cf15e6d237db6640727c8f8cc5debde7
SHA1

1b99954fa011678a1ff1b4dede75915f92d8d215
SHA256

fa9602b2828291242fdef63d0c590c68da4dde9a658084d2c1da5db53e96cdf5
SHA512

0fddd4a7e7811c67464d2404f5e55edceb13f9bbabf54c127a4049fdd90eae42168f617329c7105a98486651d1280e2777cdd01f2e1a4da701e547791992e1a3
SSDEEP

384:JXcutYgQXXXXXHO5wXXXXX+qXXXXXZZabcTp:5UXXXXXHXXXXXXZXXXXXZZaby

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000d20e19b9ffb3ab5474b29b1a795be3f0d83df563779efb6a58c1c424e68db03c000000000e8000000002000020000000164e272600b16ac07aa8b235905285f836e8da2f3c4054814c6838b00b7e996e20000000547391b17a4198f97ade2760ec30cb4bab5e7b7833336abcbeb0e46ef8540187400000001a865e9e9edbe6ca76a387041d7764b592eeb976978bbca68abde409f8e9635944aeb495952f40ca73391ffe3f2a005c23a38387adeed1d7ab5f37f497ff3f95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000481c3196f12bd2d5d92cb9234f5186e5d33d7e67e6c1406a4c069583e7612918000000000e800000000200002000000035fe1d2bd00c45f2a55281288b3727524418a424096d841c4ce77f03284dcd6a900000005484c514170d8fa69ebf0ed74c6703c06e1d384e5798774e3ccdaed3f3917347d2202b36afa199ccb36556f4f5f99b1b7d1697762ebbf964afcd000b79f35aea846c3a5aad7f240e0d748d5bf85a4ad808c0c41586717eadb1ffea822fa8278fd7b8de054fe98251b1ed5038d3270bb535a181a292a49c2e62242ff518f1375017614135773bd07267002da7cf57c341400000009874a919dbfac20a8255c15561ba2a9ca9f8ae155773251af01e24bd96953f8dd1663e01f5d7d53cbfeeec5510edfa8a2183325123e8861da8c3e7ad2eaf53b9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431772326"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01D75E71-6C28-11EF-B6DF-4A174794FC88} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01bcae13400db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2616	2908	iexplore.exe	30
PID 2908 wrote to memory of 2616	2908	iexplore.exe	30
PID 2908 wrote to memory of 2616	2908	iexplore.exe	30
PID 2908 wrote to memory of 2616	2908	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cf15e6d237db6640727c8f8cc5debde7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7020b0d227cae7f2d10654f9cf685be0

SHA1
ac5822752de03207ad2b27dc674c1249dd6a20b3

SHA256
0551551a9699f99164154db6dc49e88afb3401cf27b0990dc4a3562ee76038e1

SHA512
a883c76b4ae5372b2b19df2cb7113527f19458d482333e8395c8a846dd7d61abf554ee89d2cac2561431fbbbf9260db63935016be210feb1fad7fab3f494d40f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a46d02c5814c62dc3fb3a978bf728f3

SHA1
b492c202d4a6f1c918cc61171a39f5cad404e3a6

SHA256
b1164a7993a726a4f59f75c1bf24f24ec56b40ba065e812e0a045032b919ea4f

SHA512
c64e28ed023c5923b3f8d402029f012603ea9f6cef5b01ec595ba09d4e24f3d2fca20a8cd3499525e7f8220eff45c95d3f2b140b10780337bba48feea982c8cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7408b24386207286f274edca95391a21

SHA1
caf0842087b43c7cc78aace1282f20920ccfa626

SHA256
9cc080076829742b6616a2f92d3dc65ea215de9ca5dc24e640a581ba893c0c06

SHA512
64eb4071a763558a47da625939bd8d757bad3d48f9e6c782965544dc576e26d369b571d39b455f463cf40a7edd251d7d148b1a4c2ffa306403322e9004e89cda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87ca97df8f6b8593c6c0f3936490dd88

SHA1
01b26c2b3e79d514c443c737a7e8dcb4f0e82c41

SHA256
e2f7ef5b04beae1fa5f58440e21985cecacf1f582688fed325a2633b31cba930

SHA512
eea0cd39904b00b27ca2468b54c015cb1deb397093b647fbc7d9e9737125060cba663fda635de50eac51eab36855e5912b75c16af65de805fb1106d6aff50cb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4eb2ddf877b73cba4a288d5b6acc62e

SHA1
b4b2d80def8815db58d3319a12df46b3f82b8732

SHA256
88d809bedd47fa79f732e6011d293032fee7c64d33c70ab6257828651fe0a6e4

SHA512
1e224bc699dde996e01829d10a991ada9199d83492b0dd5df2332dd588dceaac7346bff7d6ca440fa2d8436661ef14f11ca36ac9d2f19781d866baf5c4d38cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae0e6437f47c988513b5f96131367269

SHA1
b6c588e7c87d3edc4c4cf1a645099b51b0660296

SHA256
8bb811adc1b721861b3ca43bb02f0edc2e238b19f05936adf1d45ac2a77cf3d3

SHA512
ad3a20be45b536bf5c3ea55e400ebcda5b07bade9da8f47e7b5c9e2450260b62aacc682bf7d9ae41036c7b1e33570dc4b65fecd5a1dc7ded1c4a0ae2321e587c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eaba64c3beab4e909dc71a2e4e3fa62

SHA1
8f50dce48ffc85eb2144f4207a5a15805f4baa1d

SHA256
d3659a78193269f863ca01a5c626754f5740b445c795aae7332fc2ccd11cde44

SHA512
a87d9f461c40f5d24a72d5d6cb44aac5dd757c936eae16a88ce54c28cd331b84accc1aaf06c819deb0447447f862404a46c99130f2103dd7548290f6a6cf7436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b644576d997a21f98036f08823175575

SHA1
c4c1daa1f2c1eb44c33f9fef91d5233a44f67b96

SHA256
bf5399a0aa4d085ae7455a14bc9014442c5f09c23d1ebe3515a52ca28436a87d

SHA512
f96ca5e65c346f51972d7a84ac8ada3cf5ffe35abcfcc4715230b6375eb25bbd1008080a1ddd88f6b27736ef58b76db7b6eb861ed8af77e4ec898abf349c2e27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
098eb34f5ddb1ad96ea3bad4ebf3eaa4

SHA1
83f1ce798ab52d49daffd2d34cbc94c59a3b705f

SHA256
9c070f56a2e37279e14d44ea73ead748cd3dc49ef0b88410848062c361c52eea

SHA512
4dc14b34394056738e47322a92d55220feae4f1631ae2c77676db0a8bb1fd6c3e7e7c06ca93925a93c00df3e6938669525ca6cb0935ed050396bb6b9a7ddc83f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7d7faac6f68b169e3202890fd77b05a

SHA1
5f80c974d1549c45ee1c822725c2789148a33cc5

SHA256
bfe9f448b0ae0f2cf9632f2b16b08861bbce532f162a33d4a8b7201e646b0272

SHA512
0265b246a515eea05c3115f9c3c413433eddf650e51c4731acebfef46b216649bdea3c63820e4bcdb1f4d711c941ec4278480aa998e54bc834f43a9c33ad172e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\56KJ964X\spacer[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB04F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB050.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit