08f5bda3d064176cfb5d1bb91a3987e67e564726959ee2f9bd10f8857233f35a

Analysis

max time kernel
135s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf22594ee362e549e79fef670390508d_JaffaCakes118.html
Size

24KB
MD5

cf22594ee362e549e79fef670390508d
SHA1

a2fb587a586268d0216c5b6ac07c4216b22381b0
SHA256

08f5bda3d064176cfb5d1bb91a3987e67e564726959ee2f9bd10f8857233f35a
SHA512

b4a542e0469459a063c6cd60ae52ce1922b8d335c505d5b9294a2c2b4d7b3744f1fa0de9977a4d5523cb024870277cb10b7e20d7957380239cf8545c65f4479c
SSDEEP

192:uqN7HRb5nW7unQjxn5Q/fnQieZNnNnQOkEntFYnQTbn75nQeCJVevo7NtIFo+NzR:nIQ/aygcnnBW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431773965"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0090dda93800db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3A91DA1-6C2B-11EF-9C49-4E0B11BE40FD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000019e7c6883a0d1c5766c7bad809e68590b5799322b9d6b187e0ee0a79ceb85f97000000000e80000000020000200000002c3e58ce0af165e3b600f3d41accae554b60fbaf8854a78ebb7b22292260ab8e900000005bee003625b3cd51e9a99ae082216ad38e704a76fc01f80e0ca3ac7c4d68d974baf981bf5b5d7d86728e93d11e104504df0b7f4613de67b2844bdf503a46a65483247710927c86a87ef12dd06e162a2d8f06f1be6311b6e58847b43cd9ce8f5ca4e96f42a7cd349e8707d5436d7b60a57d5cf33ec242d93747605e7c73d6f6cd7eea62a31749e258c59b6884882a0911400000008d8d54a4ceaf4129f0c7489c0531a6594a1dad31c7f7d78e5ae0c7fd92c3579a8c0551f6603bc7660ac0ddc8bb8b211a9754e791a7dacc4b068a797376c8354b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000168da98d03cbbcac1ac4bbdfe1325e5ece55ac7d00df09c2aaa32206184c1e00000000000e8000000002000020000000beeba29a72db0f8867df3b4f559f566f2010c842ca21d80d3eabacd8b9a8bb1520000000133316b2405ea1f0126b6e30c8ea3e2742194bd156d03a53b6e4cbc7bed91bae40000000a1984ca4c7d0600e0897959e6a9c924e1926a2f52a94dac7a585dac2f0ef02db44c5fa64e4c7df3f4684192fbeba67efb25f807f7c46f7c25a7530a7965fc746	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1620	1704	iexplore.exe	30
PID 1704 wrote to memory of 1620	1704	iexplore.exe	30
PID 1704 wrote to memory of 1620	1704	iexplore.exe	30
PID 1704 wrote to memory of 1620	1704	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cf22594ee362e549e79fef670390508d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b79cf84c3c8ed97648f23a502ebc020

SHA1
dbad76935798d86b9bdf9051cab0422b09f551e7

SHA256
83219cdb233364eed83291241f441f3e262696c6a1052a2451e9694e754fc692

SHA512
9a4380c41eea55ddee191c48adc8c34f5969c5f28e8790cf6fdf87d82e85fe3b882ecfbcf4da332073ec98e0ac4619b84b5c1d8516a59b02327ccbcb30961d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5305bb5f437d678dcbfa4f72e92edfe7

SHA1
333d9d6518f4783951732c6c271a0d1c4477e592

SHA256
484203004742e96a26ebe335b1ff56ece66829490fd9e766afc655283d9f6398

SHA512
c4f5c316b4adb06c85029a76363a6377604ea7396423c745bbc8f2efed186a85548beabeac72763cb4818767f510e15c5a17ae273eec0dd909cddfad25e4760a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
601e528e6b0b99e2773aabf5d4eef6ba

SHA1
4d160e4dd0e59c6477f08ec75419e58346fcd816

SHA256
2f138af527a1a9da2e41f8764d3049af2666e10cfe268176f4e1f9a09ef9a393

SHA512
44dfe2fdd23f89e2411943f43e2d19548a68018719bc18f0dae26576bcf3683a698ca9520890c9d30936cca899ba621139cb340e261dbb01eb431b8a2ba646b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
129b7155158242b7991fee32c905859d

SHA1
d0874a73f1caf264ee687d8c32a80822cdb5def5

SHA256
60e82a30b5bc057705d964e3bea6e05778d7765f1bf2c9f38677fe87e9e3e683

SHA512
0a1a15f16d4f6d09ca1d28ec474091ae3faaca4712fb1027e3d79c1539f2a0b623d85d72a8d1c6e1c1298e4b47a82607b12313443a53ef8bf93cbbe15be87df9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d22e0f6f02584b3f4729417031f2f6

SHA1
ccd3bb2150b28a08900f129da300a49d421467d7

SHA256
fcde503dce75ed6d1c3c221b340159a0f3855882790034aeda73a64e46a5468c

SHA512
a6a8859056e6da0d968874e8fd2c4a6f293bb0288a47fba2bd92b695a0da93addcb70677695e90d8768020406c29157cb157ca3e7fde70e8050d80a45a7ae0ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44710b7b268d4ecb895fbdefdab5af47

SHA1
275ad95b52a75d881ec54a60123f14c0b3c12a62

SHA256
c42e63397d3d215fe0d54319beba3436b444074c19e64d4ced46ae9ef42aa3c2

SHA512
6765d395ccee58da90059035550c4491016a070b78514640561b8dfd91b55de89663eda4bec457c637cc1f7e6187ae9cc797a34bd7f439d0948b9b0ce98a1f07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8435e7d1cb36a2c47edcfd71cb889f7a

SHA1
23008c913e14e405dd756a6c264c47975aa4a5df

SHA256
5b9c5585878c6ccc21a509babd49c7dd6cf7a725347ef8cff634701c1cfeaa36

SHA512
6975db0239e4d1d1bc90884c6660969dc30e1220049e56a3ff59d1670fbc60edfad613db2bfda7cb18b75c535e52f291503f1bb00dd7f49c59a7e100b63f04af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66151a2c0d82c941684fada0432b5c51

SHA1
dab14c3f8847ad9e63e3cb1ac5e02f1dfbfd0383

SHA256
7879b28ae24c5cf0f45d97cdfac486b2fbc874e102e904e9da08807022595c13

SHA512
ae5da07a48429c9c1550bee7bbc4fa93db84c84ec4b3913ee272952fad5d2f197dd8dbada7e325b80a9008e32407af7ee7a6d66743c0f40a7f75c3dca47c1a45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eddb984de31ca810b075681c7c3b25d6

SHA1
88c4920923602365e7a2e90c12798b0eb8442afa

SHA256
a33d5979122c50ae0c92bf9fc94af17d3b517a7ea6dbbdc7962edb57135b1f76

SHA512
6f0ba701ca74fd45dc1e57e5cc4759be392c56dfb7fb333d23f8d41c7802ffdb00f0c52d627bfee0da8c1ac631a6dc24073c9cf7642c825ecdaf14ff890b35ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0643391eb28e8961c89d95981619dcdd

SHA1
34582956a67c15c806eaa36ec57733cca150828a

SHA256
2f1884f9114dcc8722fa8d93db4acdcdef196ec184ec265717e14bc108c7fee1

SHA512
b36da9b76db5427cccbf1ec2acf6fe79872c8d508867f4d87c9816dde5c379aed01fe1de9919d2a607291438aa97c87b5a5197da525d2f62c88ce36680662ae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4332de8c9c69f3ee0a7c835bae879e9

SHA1
79648b71edd8321482eb3f2fddc74ea711785eb2

SHA256
c1f9db47261d3ee3edbb53a5abd6e2ce422e7c3f09387d972ecd91e5cb94a75e

SHA512
d1cc165b6012471da2152f5b316eaaa07117364d692f04263a265e287d7727d9aeb9581fc2d1e542646da205ddb88860a05320b8787b636430b9effcf377dd8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c7a7f9de7cd0b6ce2e4b934df4e0684

SHA1
2ce7f9910f1582a867c357237e289829535494f1

SHA256
0cc925ca8c1bbb7a5c5340adbdcaa0e114ce2607325bf993f50d11b80fde5c1a

SHA512
7c6a4ee86d137b186167e01a96fe56c4cd73212fe7948280126169765b907f32a4bc7467ee2f6edfbd33d0ffd7277749c01a742f8b1066c073e570cf963fccc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
724587915b4b1d00a98fd12ded02e037

SHA1
3b112a5987e480cccec93699cfe1a068bb477b2f

SHA256
b7a0b49ae75b9d4b2c0e14d5e4c9bceaf67a755fe6ca6c63fcef687be61552df

SHA512
36342995517834844bd89fc57dfbe7880941373c6348883a7d97de3b05314f543cd0c3b2f46fd8711cb514fde575eab6e2a3634de0d169c4dba70ab9fcb6deb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1dd38c887a0f637144b53bbd906f44f

SHA1
9b94ca0ea758b1e067d3d73a3a68f830d17073f7

SHA256
2fad43c8adfc5e328c47cf79a6fb86e61dddc7aabac9ce39c8d5bc069782c7e1

SHA512
38320c328dfe71311ac329a8c13cfb834c199dd2181f1b311d632d2b96345d1e9234221fdb9c78528ea123e27e9135201ed5db300b7ce563c33fdfe27f2ce659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa3ce01e1041ec3318e76425e58f5c76

SHA1
252b73ca0221634dc81b1944de37da89e9994df6

SHA256
4f5fe24f1cbf0b5197e8680b1292d45e37784dee6d567ed17dc67f7038329fa1

SHA512
ccc8943599f6c2fd1db62c3fdf031a65ef2f048e353d54f5362623fc2cbe1ab32ea143be64523bf222e25499896deeb5c80ff021e280122d61cbb4d51d499140

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDAE5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB96.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit