b96a49c8cd73894d9844c0a7e99540637df7ac7661b6e55d94fc11d23165de65

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf1f2b930c18495afaee24dd668f51d9_JaffaCakes118.html
Size

12KB
MD5

cf1f2b930c18495afaee24dd668f51d9
SHA1

c5d051843b3841fa9083f40ba29c9badeec5477d
SHA256

b96a49c8cd73894d9844c0a7e99540637df7ac7661b6e55d94fc11d23165de65
SHA512

5da498aee8e3f1a417bae91f6e9000148748c1fafc829baf84417f20618f359c9eac758691d0da704c797c1dcaf05c4c4b707157d439dc22a1df2e127c290a97
SSDEEP

384:+3wgXEugQtN8GrAddlFGGOhqLOtZS0oQXBbK1:ngXELv0PI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b40bb03700db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9EEB221-6C2A-11EF-976E-62CAC36041A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431773548"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000b86c4c3a8b9d97e1389542b57db83aed04b9a6b6ec184d11b61e718cdac2e3a3000000000e800000000200002000000059f787275ef8faac0d1a6c9f20d88f0547b230b6334c0e72ff226559f5075e8f9000000044422c490299bf2e0d2d17609d2073964a33b4993aba0763f596d17bc4edb7630ebc439989f4408ad38127aced24ffa40b7d74b54ad984178a813f30471f00c7bbf9e6adf2bc5f4d6250dfc27b1d625be0f0641d05a48d93830967409b82d31e66dae72a4250891473b97a472c4c1ec88455f1653420e3462053e2e15dbd88def0241c8c9bb4ecaf1400f40472f2c38b40000000898dd3b0255d9aad3095b255263cc6b87531141e921aaa7a52e3bcded37cb7aa7684732a15ef8f6fc3291b27a23c8dcca10ce7744eae05049c0f1c96b3f32ba0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000001637c48f7426394a4106726c0f6aeb6f8d294c7509d16017ca6084da0efbaa69000000000e8000000002000020000000dedf12a42330f4892767d83bd4df495ccc7fe616e66b072652abeb5b395092e320000000e45d96f9ac5b80d917736fa7c44ad5647a30bb73efabf8ce9e125d73db905cd3400000007610d7e63d5f0422b38d4f0c3dc5acf9cafad3a9de8cba2cbc967a464f340c6052a718b4d9797bce6b354c2c687fe6d26e45bbb73954c8c35f3224e099298661	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1860	iexplore.exe
1860	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2336	1860	iexplore.exe	31
PID 1860 wrote to memory of 2336	1860	iexplore.exe	31
PID 1860 wrote to memory of 2336	1860	iexplore.exe	31
PID 1860 wrote to memory of 2336	1860	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cf1f2b930c18495afaee24dd668f51d9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1860 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f74cd223f7b26d03c1815729be44972

SHA1
5672bd0fcd034d2daf116ed15001118906ea9b17

SHA256
65eae195bb80f8cb8dafac129f740a838b33fff930d06728300e2bd0af855460

SHA512
e869f6e1e41a64d2466f1512f8ff96eff1f117caaaa0ea45d0fcee9a4abad35acedd76f6286c9b956d32e82914810f4cb90c8692639c043ccef99b12f5e22952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ef14a966a4775090fc73454a7b91316

SHA1
17fb934eef5ad6c628e8ed5e7ff4d5ad2ee79cb1

SHA256
d007b9ac1776fda7cdb8866d63ad92119b9343c2ea82b8a02dcf5796747b81c3

SHA512
c7ab0b46e03a28e128fefb8ce430fcdf0140d7021f0781a7faabaed6925e08a6df94eb8b3a4e99587923259e3fe27e924f2cd5e7ccad6721485cd7d4e5b7a90b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45dc31c73d656237b0ae46b68f7f3b82

SHA1
4822f48da577b0842af72fa28eb67ea6c65c6248

SHA256
c232f518be6523587a3151c5b667b4d17f22e7adb94060b2d6c08ed9c83a9d8a

SHA512
2be1f747f7f97b3df456c2667d723caed74cea66fa8c3be348bad92ce98a64f53141878c7309f81d139f2586e562cc650e8433252b08145a75a05b47ee48dfcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0800382c6597179d55492f8fb6984737

SHA1
6b697b0021a63c60c7a7374cf57a66b1cfba39e5

SHA256
1c0c2ecefe5c183cc75b97ccacd5ebd575f9be3902fd66d05f80cfd4b19772f3

SHA512
895ac02281b8c45f0cc8ae10130a29d6f8b3ceb3ab2247c8dbc49f1c608e1cff7da7f1ddbdc865887491c6f9bd6780ea1a4f8bf19b2251ecf1ae0c9654e95df2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2ffafda5481d1144eff2a0be40b783c

SHA1
54fe6a15bb7b6945479556c8bda42416e2f13ac6

SHA256
ed9d456c16788a25198a2c058487c704fedb4e4cde7146d4b1efa494e744c1a7

SHA512
3ac2d9747e11943658dea520c6fa79a38daefba3f63a753e82bdebe92993c927e3873300c1817e61e24c4b26a3760def8c38db19431d9d62e572c7a97abdd042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25096f1f5ef1cfb4df2019c72413e5b3

SHA1
9d72475c52e17fdb0f876a220ac434d94a163bc9

SHA256
1eaab3b9ef18ab35ae6878b52aa4ca0055bb0663cc0cc352b2db9410d2775369

SHA512
d7d0b65d5fb593ec8ec81ee2d003bb8cd3934eb9ed8b701dd61e9f0803ed9b2bdc909f00dfe62a1f0dbd83298d2cb57dd66ab232cb3bbb59f5191ae9a124acef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2da6168e94914a2b296f236bd54802b8

SHA1
0f6af990314bb5c5b11d662a00c93cd058d5d895

SHA256
4b264bc0da7e5fa7c5d77271002c3f9a18d8b9692c81a28cc986259e1f4247a9

SHA512
5c7d3d9c45a1f4fad39bf340c83dcd1f0bd34b1af12d0f18ac8fbb96ce5fc429f3871555930a8abd635f47a474db123038ba53ff8cb0d8a7554d2f593267074a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f39ef3986a29b8be76c6415be813209

SHA1
d11e3571a04c8d08a6580eb6488f0fa9173a0725

SHA256
677cc37ebca66c58c6f3574d0302613d789e335ff87ee16c39ad5a77b005cd2b

SHA512
03521033783ef811b3ed1733b06e583d2af37c3374a24a032aec9efda58bfb9375493f6b4fc6bb7a14850d8e2824dd655a5b25f0b8b091850af0c61f6b9d941e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c2881783afcde4b0c00627497db731a

SHA1
e63a27ce375a8c85f166c626202e94f24c2bbe52

SHA256
09ac475b7971e45c7c43e4eb9ed138ee13fd0442214bf8ff1978fd56b717653b

SHA512
3148f1b001ec6a1557eeeb3eb3701cc5f0b4213ca10f86fd15874efb85dc2daff26dc8fa7960b149428b38631e2d4ba9a7b4a4aff7e39c51e35bdae9dad62ab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cccd84556b6813228aaf8d0a233d6b6

SHA1
8df7c0d81aab25ed7d9941fae6f199b6fa126293

SHA256
ba63a7f786a6042b03b6686fae109170bfdc4abb458f5061dbeb5eeec6341db7

SHA512
78e61ae037616b3819bb66d29c82583ad62db61640b7c98fff5a69f027003cb6b4fcfbce92eb86fb2f8a825fdea3117e8acfbf87391348ae6ab7ffbd1d30c779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f0f7a731b55bea892729d12310ca6a7

SHA1
346624139a017c7ae6bf5e68a7013b0f779bfe1b

SHA256
17b39e5d4343afe1f7b3a4112c7e44b02c0adb2304a58a531bc6ccff52d8dedd

SHA512
adf1d835860c3b19f0e687c2d2edf131125af3a53ff50ce71e0d0ba76456c5bc961bf991fb92a7896e04f0751afb2fd51ee7a166d562041966052de53ef39dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73cbd7d83d9bb352f6c52cf71d93afb4

SHA1
aac32bc54a62148ac4b8b210ccb4d5038aef32ce

SHA256
dac5f1c72345406e222ebb77d3165779cc1d7b00dae0cf70a038ed36b7e9c2b1

SHA512
93f7e182aa510734150427509c2c41bdaf1c5ff6ac25908dd1e3d50b6ae6b298ca1fac69b885218ee9c9bd384872b45c73c56ac746213c9dab17958db5061c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a086ec17c05cc2aab10b95e66431c8c5

SHA1
bbae2859c99ba2ab9bf53c5134e9a6ae4d0d19ad

SHA256
3c22368cf2366b0195aa24b358859d30371faaa4bd15a8647ffc7b13bf6c8a37

SHA512
7a973b3c08b4dc0018efc1fb8cd19a5b95859348a89339bc67e6a1d9a957236b61550c15fa501ea7a978c531215a4909937029549d8ad59805acaba9ff2a547a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a9d9c21d087f9936fea21504f34e820

SHA1
be959b2ceabcacba5438df523e2b0daea003cc35

SHA256
835096c62fbc9028570841292fd69a0cdd6045bb614a7e65470598b8e1cb4b83

SHA512
33011bbe94f741c8ac05cd6d5ec379d4fd59e8164b44236435d3948f19a32f1273c53406dfdf92e17327eca4e592b16ca0ad86ac3a11ee7df74ff600ebf146ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a047f3b1f46f7e383ed8a620284313f0

SHA1
5fc1afb410daf4002ecce2b731fc4c28359418c5

SHA256
18f0de56ce06a79411edeeb881eb1d2f3ea0d425d827ffa8f70d875a4c9f4be0

SHA512
1aced6e108eae5eba307b6c9601a8bdd20e34eb7c1a81917c8fdf720fc5417eafb9329d407c22d96e14269f448553542edc95dbdc17dedd9b55ec56e9d34faac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08821f57e97305e03bbbcdadcaaaf509

SHA1
4ed3120add122da8fcd396df1c141371847193b6

SHA256
f0a4cda6a4e00180be5595a2fc853535a6c4155ed0915a1436791d838195cbb1

SHA512
960993655a7f6eaacbe9f909559db07a820acc31e9f0562a38b01da1db2ecc04551e1d40e2b134fa6ec7a0a97b995b72f157f464ddd9c4cb11b2d4b32271b061

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB445.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4C5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit