5d92a6ebffd22bff5039037b428a6320e165484f0909dad1131bdb24fe272145

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf1956ca146a026a70cbf76e00e0cfc1_JaffaCakes118.html
Size

27KB
MD5

cf1956ca146a026a70cbf76e00e0cfc1
SHA1

018de87b4daa4aaa086cfa9a0df5c58b1793f680
SHA256

5d92a6ebffd22bff5039037b428a6320e165484f0909dad1131bdb24fe272145
SHA512

3386173f3208b976bc53b946b2d032a6b645f1aa7c1a43b3431b0d36e85f05ad45e4cf35b9d518a2e1e94880b94135c12ed86c1715ad208214af9b63975d3167
SSDEEP

192:uwTob5nw//abnQjxn5Q/dnQieANnsnQOkEntXbnQTbnxnQ9eudam60d8GQl7MBgf:D/yQQ/g3gO8RSSdZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431772712"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fbdebf3500db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E975A661-6C28-11EF-8EE0-F67F0CB12BFA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000009b56839afd6abfd51b472147105dc7c95285e81c55d1cf6fecebd894667a137c000000000e8000000002000020000000164b76057b3e8a2a1b95b7caa8dea9d51b48c80963fd8d3f4332b01eeb735bf39000000081a51fdc247a4b9d5d2810309d71859a54193d4561b734f4402a571a61201f8aaae90eabb8c00f1ff69647861efd0130bc0391d750fc7fec9bcf6b12eb69c85da5ec272da2ec628af416d6697ae12988619f912babca5f9483f4a0e21bcff4b0497cfe62f54ed0afe1d47b4b89813ec32da5e927e9da6431f9d1775df82ae9c6f6972f7cdba936eb7a013216d26b78414000000049a50a414630efca02dd86a19bcf0e572f41d07a6b41ae244c9a278837895f85c177f593b804bfed15d4c78c494a1245caa05f44f11de54dfff9a9d67a117087	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000012815dd6c0009b196f3aca50a71297f4006ce43197d0a8eaa65aa8b365d4e440000000000e8000000002000020000000ad8ec41aceb814fc7cc1541aa3ec53b03aff3c45d2bbca5d16ba5f4d9c909c7e2000000057c7d5e2310e3a6c7cd93df462cc63bad485529e157e3e70bf16f9a03b571813400000003e8fc3afce1d4e01b4e2b4236ba19e333f41557b68652623fa762c671298a73def6ae5d59623cc141672b1e83d2db46c975ed86bc1eac2b9b8875ae90723dcc7	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
340	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2716	iexplore.exe
2716	iexplore.exe
340	IEXPLORE.EXE
340	IEXPLORE.EXE
340	IEXPLORE.EXE
340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 340	2716	iexplore.exe	30
PID 2716 wrote to memory of 340	2716	iexplore.exe	30
PID 2716 wrote to memory of 340	2716	iexplore.exe	30
PID 2716 wrote to memory of 340	2716	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cf1956ca146a026a70cbf76e00e0cfc1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29d6d8350ffb3073ebefc17b2d966b7a

SHA1
655d4b8c4a4254df8a854bf9dbeab00614b9e7ed

SHA256
24ec4858359177fe970d6b8e956b9b72517c8605e9fe3c3ec75632d6ebee2f37

SHA512
c66edbd8bde85a4882eeac533ea6a5274707e354244b779cb2abb12b605b4754608f40a75866dbe1b86e93f811b7dd53ed29db5ea60ab9e554065ed1ea91623b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40928e293159a6a533e9fc638c924542

SHA1
5918b09ad0f78c2f6899e5fb6b8eb1b17e36abcd

SHA256
78d5bfefb8c9b45db350d0fd934eb8d2ca1ed27f5c20eb7689cd06e4789cd596

SHA512
b80da30dd7f2a89471b4e03cc000b859e8bc16e3ac9f778bca4fa5e700ad48f448926515e221f5b4751244536d43a0ae6dd0cd0d9b104c219429f8e4881da126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65313d4b78e5300bea0244fe4bc59e68

SHA1
bc0a63ce904d904ff29789264c022355f22428eb

SHA256
007dcefb7312b84bb2f776c9d5ef0dee932834a80e271509d839984a20f796d5

SHA512
a529fd9c95793eab1c6ccbabc955d98edaeb915fb6465a6068b946cc6ba6745f53bbb2ecfdaf54cf7c4a6bdcb415a3489e60f875f1c982bc15154c333f98c39d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb472a159772098fedf15a8a847783a2

SHA1
18fd453ec6d7163ffcd52f0fc7b85d3170f7a09a

SHA256
05f79a967a4524369af92b816f3cf84551c8d9f762f9d508ddafece9b5608bde

SHA512
652199bd0b52dcf61f7ec38e4bfe14fe575c308bc153b2fe4676978c3a7dbffe1e1a609f21b8971c5af71898d06372423fe4334aa708beebbda0330f6fafcc94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
833cf62ee9d506a7b7611b18225bf70a

SHA1
20c917b464208fbbc75d1338ad19c9c3b4856a76

SHA256
474a75fe70731aa4b5714546b9fb1d1fe16301b1be3441acc2fcdaf703759ba8

SHA512
5b5b5c7790c9f2f30fcb87fed35e34a473f5ad2a1e4eb08e6df423d2e47270323638d2ad25bad48b02e536d0b2b1fbb7513fd23901836bbcd52947810c2bb86a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15beb68c15a2f13cfec6b893fd511bc6

SHA1
75fa7e16f9762f382a2c7cb2bb0104e972ed1fe9

SHA256
0738049dd7a14038b31ad2bd5668779a0e337bcff18dbf8c38b1b78a5927f9f3

SHA512
e57746de6e258504f2bfbd6fe32f4dd76b08d29aea6cfd456dde7d3419e727d9b91a8c9f2f872cb68ecd963889ecfd41698cbed174a62ce452e2ff450ea199ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5981090f3a6f5d715b7f1a30a8f149c0

SHA1
3d047501f45cc10ebe6fe2fc437dd3d0e08ce0b6

SHA256
8854c2472860583b94dc1dba99a8decb419c95f22b972336eb9915eb2ad1c9ea

SHA512
a06131df72dd12f00630ada57348724c315659bddd91403fabdcafc54c3e759edf1acb09393b9e05162bda0231ded69f63fb72121ab7b4c8aa666edcf13a1556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5d84e7fb19b611e2a0f609f1ea2621a

SHA1
608d12e247d102070c572db68a6af6d84839b5bf

SHA256
45bbebbc4f15771b97ee026caee25cfc6fa9065f7e3d1bbbb5ab12bca1d4e642

SHA512
9ad3ac7268a829b3a9482ebad6f43c03a3b1f0e9c9c36de6731c18ee98c290d74c7719ddcac7b03691bbeb545e3ceed3e3933d3590d43fd04304379ece93d26c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c6c1790283d3939752970ec58df4723

SHA1
e77395a8deddc57f64be210d324b8b3ff43cde24

SHA256
d53a79f69e3ee3de0bfba059ff23ace4c8b993b1cfe9df9d0268332972baf645

SHA512
8d02ef61537ef57cf607ff45c2e1cc9a6ffc8caa270c2c3f3ac3bc7812587c90728cf58ee2bbe8f66f8c47a82505515a2a3a0c51430080b88bd7da9d07ae6550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a3dd215818751c15b30f716bdcb0d14

SHA1
30a7bba9eed026aa46be8ab7957a688bb93afd5a

SHA256
e48f5139c35083190eeee0951f195f77e1739330f39e83935459e12d2fe96138

SHA512
a9113b6235d7b14d371336d191c8980a3e51bd88240dbfe95cc250767dbf926d72f3a73568952aa7ec19df4e95a37627972fac1ef3ce903f69dce7164089fa73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06899e1854e10b4ad2d7d524a3a17f22

SHA1
aeff9c572ce4781f20880cfcc37dff1dc2ed2ac5

SHA256
ed2b0a15784a0503698d0d088261d681b9520e4a69f5a178645189951080041e

SHA512
274e756baa9b7e61109466213ef3cddeab7f06ce8e504486115ce6532199b5650903f8bdef624b1152e1cb3ea728f4838ecbe10180542c1a0a7305bea569922d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE40A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE4CA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit